Batuhan ApaydınandFurkan Türkal
e9912ba39a
Signed-off-by: Batuhan Apaydın <[email protected]> Co-authored-by: Furkan Türkal <[email protected]> Signed-off-by: Batuhan Apaydın <[email protected]> Signed-off-by: Marco Franssen <[email protected]>
35 lines
1.2 KiB
YAML
35 lines
1.2 KiB
YAML
# ClusterRole to allow spire-server node attestor to query Token Review API
|
|
# and to be able to push certificate bundles to a configmap
|
|
kind: ClusterRole
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: {{ include "spire.fullname" . }}-server-cluster-role
|
|
rules:
|
|
# allow TokenReview requests (to verify service account tokens for PSAT
|
|
# attestation)
|
|
- apiGroups: ["authentication.k8s.io"]
|
|
resources: ["tokenreviews"]
|
|
verbs: ["get", "create"]
|
|
- apiGroups: [""]
|
|
resources: ["pods", "nodes"]
|
|
verbs: ["get", "list", "watch"]
|
|
- apiGroups: ["coordination.k8s.io"]
|
|
resources: ["leases"]
|
|
verbs: ["create", "update", "delete", "get", "list", "watch"]
|
|
|
|
---
|
|
# Binds above cluster role to spire-server service account
|
|
kind: ClusterRoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: {{ include "spire.fullname" . }}-server-cluster-role-binding
|
|
namespace: {{ .Release.Namespace }}
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: {{ include "spire.serviceAccountName" . }}-server
|
|
namespace: {{ .Release.Namespace }}
|
|
roleRef:
|
|
kind: ClusterRole
|
|
name: {{ include "spire.fullname" . }}-server-cluster-role
|
|
apiGroup: rbac.authorization.k8s.io
|