Move permission templates to values

helm_chart/templates/seed.yaml

@@ -0,0 +1,20 @@
+{{- range .Values.config.templates }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: template-namespaced-resources___{{ .name }}
+rules:
+  - apiGroups: 
+      {{- range .apiGroups }}
+        - {{ . | quote }}
+      {{- end }}
+    resources:
+      {{- range .resources }}
+        - {{ . | quote }}
+      {{- end }}
+    verbs:
+      {{- range .verbs }}
+        - {{ . | quote }}
+      {{- end }}
+{{- end }}

helm_chart/values.yaml

@@ -88,6 +88,7 @@ tolerations: []
 
 affinity: {}
 
+
 #
 # Application configuration:
 config: 
@@ -100,3 +101,97 @@ config:
 
   # Random password to login to web-app. PLEASE CHANGE!
   basicAuthPassword: RrXwZSBdTXhQL6 
+
+  templates: 
+    - name: operation
+      apiGroups:
+        - "*"
+      resources:
+        - "*"
+      verbs:
+        - "*"
+
+    - name: developer
+      apiGroups:
+        - "*"
+      resources: 
+        - "configmaps"
+        - "endpoints"
+        - "persistentvolumeclaims"
+        - "pods"
+        - "pods/log"
+        - "pods/portforward"
+        - "podtemplates"
+        - "replicationcontrollers"
+        - "resourcequotas"
+        - "secrets"
+        - "services"
+        - "events"
+        - "daemonsets"
+        - "deployments"
+        - "replicasets"
+        - "ingresses"
+        - "networkpolicies"
+        - "poddisruptionbudgets" 
+      verbs:
+        - "*"
+
+    - name: read-only
+      apiGroups:
+        - "*"
+      resources:
+        - "componentstatuses"
+        - "namespaces"
+        - "nodes"
+        - "persistentvolumes"
+        - "mutatingwebhookconfigurations"
+        - "validatingwebhookconfigurations"
+        - "customresourcedefinitions"
+        - "apiservices"
+        - "tokenreviews"
+        - "selfsubjectaccessreviews"
+        - "selfsubjectrulesreviews"
+        - "subjectaccessreviews"
+        - "certificatesigningrequests"
+        - "runtimeclasses"
+        - "podsecuritypolicies"
+        - "clusterrolebindings"
+        - "clusterroles"
+        - "priorityclasses"
+        - "csidrivers"
+        - "csinodes"
+        - "storageclasses"
+        - "volumeattachment"
+      verbs: 
+        - "get"
+        - "list"
+        - "watch"
+
+    - name: admin
+      apiGroups:
+      - "*"
+      resources:
+        - "componentstatuses"
+        - "namespaces"
+        - "nodes"
+        - "persistentvolumes"
+        - "mutatingwebhookconfigurations"
+        - "validatingwebhookconfigurations"
+        - "customresourcedefinitions"
+        - "apiservices"
+        - "tokenreviews"
+        - "selfsubjectaccessreviews"
+        - "selfsubjectrulesreviews"
+        - "subjectaccessreviews"
+        - "certificatesigningrequests"
+        - "runtimeclasses"
+        - "podsecuritypolicies"
+        - "clusterrolebindings"
+        - "clusterroles"
+        - "priorityclasses"
+        - "csidrivers"
+        - "csinodes"
+        - "storageclasses"
+        - "volumeattachment"
+      verbs: 
+        - "*"