mirror of
https://github.com/vhaudiquet/homeprod.git
synced 2026-07-21 21:17:08 +00:00
42 lines
1.4 KiB
YAML
42 lines
1.4 KiB
YAML
# RBAC granting the cert-manager-webhook-ovh service account read access to the
|
|
# OVH credentials secret.
|
|
#
|
|
# The cert-manager-webhook-ovh chart only auto-creates this secret-reader Role
|
|
# when using its built-in `issuers[]` mechanism. Since we manage the
|
|
# ClusterIssuer and the credentials secret manually, we declare the RBAC here.
|
|
#
|
|
# The webhook runs in the cert-manager namespace under the
|
|
# `cert-manager-webhook-ovh` service account (created by the Helm release).
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: cert-manager-webhook-ovh:ovh-secret-reader
|
|
namespace: cert-manager
|
|
labels:
|
|
app.kubernetes.io/name: cert-manager-webhook-ovh
|
|
app.kubernetes.io/component: ovh-secret-reader
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["secrets"]
|
|
verbs: ["get", "watch"]
|
|
resourceNames:
|
|
- ovh-credentials
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: cert-manager-webhook-ovh:ovh-secret-reader
|
|
namespace: cert-manager
|
|
labels:
|
|
app.kubernetes.io/name: cert-manager-webhook-ovh
|
|
app.kubernetes.io/component: ovh-secret-reader
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: cert-manager-webhook-ovh:ovh-secret-reader
|
|
subjects:
|
|
- apiGroup: ""
|
|
kind: ServiceAccount
|
|
name: cert-manager-webhook-ovh
|
|
namespace: cert-manager
|