diff options
| author |   Zhaoxing Meng <meng.zhaoxing1@zte.com.cn> | 2018-08-05 01:52:07 +0000 |
|---|---|---|
| committer |   Gerrit Code Review <gerrit@onap.org> | 2018-08-05 01:52:07 +0000 |
| commit | 8b93fa5325258ed50e6bd5c385a92a473462ec44 (patch) | |
| tree | 3b6750bff69a0383e7e1441f4d73326612af62b9 | |
| parent | ea2e95fdb43c0996c5ba58c8648d3a74c956d5e1 (diff) | |
| parent | b8a4a260fee9a4fcc9d479c590fb74872046be58 (diff) | |
Merge "Enable istio RBAC"
| -rw-r--r-- | install/enable-istio-rbac.yaml | 8 | ||||
| -rw-r--r-- | install/istio-ingress-rbac.yaml | 24 | ||||
| -rw-r--r-- | install/msb-rbac.yaml | 21 |
3 files changed, 53 insertions, 0 deletions
diff --git a/install/enable-istio-rbac.yaml b/install/enable-istio-rbac.yaml new file mode 100644 index 0000000..3b66fcc --- /dev/null +++ b/install/enable-istio-rbac.yaml @@ -0,0 +1,8 @@ +apiVersion: "rbac.istio.io/v1alpha1" +kind: RbacConfig +metadata: + name: default +spec: + mode: 'ON_WITH_INCLUSION' + inclusion: + namespaces: ["onap"] diff --git a/install/istio-ingress-rbac.yaml b/install/istio-ingress-rbac.yaml new file mode 100644 index 0000000..81bbca6 --- /dev/null +++ b/install/istio-ingress-rbac.yaml @@ -0,0 +1,24 @@ +apiVersion: "rbac.istio.io/v1alpha1" +kind: ServiceRole +metadata: + name: service-viewer + namespace: onap +spec: + rules: + - services: ["*"] + methods: ["GET"] +--- +apiVersion: "rbac.istio.io/v1alpha1" +kind: ServiceRoleBinding +metadata: + name: bind-service-viewer + namespace: onap +spec: + subjects: + - properties: + source.namespace: "istio-system" + - properties: + source.namespace: "default" + roleRef: + kind: ServiceRole + name: "service-viewer" diff --git a/install/msb-rbac.yaml b/install/msb-rbac.yaml new file mode 100644 index 0000000..bcb1d87 --- /dev/null +++ b/install/msb-rbac.yaml @@ -0,0 +1,21 @@ +apiVersion: "rbac.istio.io/v1alpha1" +kind: ServiceRole +metadata: + name: msb + namespace: onap +spec: + rules: + - services: ["*"] + methods: ["GET"] +--- +apiVersion: "rbac.istio.io/v1alpha1" +kind: ServiceRoleBinding +metadata: + name: bind-service-msb + namespace: onap +spec: + subjects: + - user: "cluster.local/ns/onap/sa/msb" + roleRef: + kind: ServiceRole + name: "msb" |