vnfs/DAaaS/deploy/operator/charts/sparkoperator/templates/spark-operator-rbac.yaml

   1 {{- if .Values.rbac.create }}
   2 apiVersion: rbac.authorization.k8s.io/v1
   3 kind: ClusterRole
   4 metadata:
   5   name: {{ include "sparkoperator.fullname" . }}-cr
   6   labels:
   7     app.kubernetes.io/name: {{ include "sparkoperator.name" . }}
   8     helm.sh/chart: {{ include "sparkoperator.chart" . }}
   9     app.kubernetes.io/instance: {{ .Release.Name }}
  10     app.kubernetes.io/managed-by: {{ .Release.Service }}
  11 rules:
  12 - apiGroups: [""]
  13   resources: ["pods"]
  14   verbs: ["*"]
  15 - apiGroups: [""]
  16   resources: ["services", "configmaps", "secrets"]
  17   verbs: ["create", "get", "delete"]
  18 - apiGroups: ["extensions"]
  19   resources: ["ingresses"]
  20   verbs: ["create", "get", "delete"]
  21 - apiGroups: [""]
  22   resources: ["nodes"]
  23   verbs: ["get"]
  24 - apiGroups: [""]
  25   resources: ["events"]
  26   verbs: ["create", "update", "patch"]
  27 - apiGroups: ["apiextensions.k8s.io"]
  28   resources: ["customresourcedefinitions"]
  29   verbs: ["create", "get", "update", "delete"]
  30 - apiGroups: ["admissionregistration.k8s.io"]
  31   resources: ["mutatingwebhookconfigurations"]
  32   verbs: ["create", "get", "update", "delete"]
  33 - apiGroups: ["sparkoperator.k8s.io"]
  34   resources: ["sparkapplications", "scheduledsparkapplications"]
  35   verbs: ["*"]
  36 ---
  37 apiVersion: rbac.authorization.k8s.io/v1
  38 kind: ClusterRoleBinding
  39 metadata:
  40   name: {{ include "sparkoperator.fullname" . }}-crb
  41   namespace: {{ .Release.Namespace }}
  42   labels:
  43     app.kubernetes.io/name: {{ include "sparkoperator.name" . }}
  44     helm.sh/chart: {{ include "sparkoperator.chart" . }}
  45     app.kubernetes.io/instance: {{ .Release.Name }}
  46     app.kubernetes.io/managed-by: {{ .Release.Service }}
  47 subjects:
  48   - kind: ServiceAccount
  49     name: {{ include "sparkoperator.serviceAccountName" . }}
  50     namespace: {{ .Release.Namespace }}
  51 roleRef:
  52   kind: ClusterRole
  53   name: {{ include "sparkoperator.fullname" . }}-cr
  54   apiGroup: rbac.authorization.k8s.io
  55 {{- end }}