diff options
| -rw-r--r-- | install/enable-istio-rbac.yaml | 8 | ||||
| -rw-r--r-- | install/istio-ingress-rbac.yaml | 24 | ||||
| -rw-r--r-- | install/msb-rbac.yaml | 21 |
3 files changed, 53 insertions, 0 deletions
diff --git a/install/enable-istio-rbac.yaml b/install/enable-istio-rbac.yaml new file mode 100644 index 0000000..3b66fcc --- /dev/null +++ b/install/enable-istio-rbac.yaml @@ -0,0 +1,8 @@ +apiVersion: "rbac.istio.io/v1alpha1" +kind: RbacConfig +metadata: + name: default +spec: + mode: 'ON_WITH_INCLUSION' + inclusion: + namespaces: ["onap"] diff --git a/install/istio-ingress-rbac.yaml b/install/istio-ingress-rbac.yaml new file mode 100644 index 0000000..81bbca6 --- /dev/null +++ b/install/istio-ingress-rbac.yaml @@ -0,0 +1,24 @@ +apiVersion: "rbac.istio.io/v1alpha1" +kind: ServiceRole +metadata: + name: service-viewer + namespace: onap +spec: + rules: + - services: ["*"] + methods: ["GET"] +--- +apiVersion: "rbac.istio.io/v1alpha1" +kind: ServiceRoleBinding +metadata: + name: bind-service-viewer + namespace: onap +spec: + subjects: + - properties: + source.namespace: "istio-system" + - properties: + source.namespace: "default" + roleRef: + kind: ServiceRole + name: "service-viewer" diff --git a/install/msb-rbac.yaml b/install/msb-rbac.yaml new file mode 100644 index 0000000..bcb1d87 --- /dev/null +++ b/install/msb-rbac.yaml @@ -0,0 +1,21 @@ +apiVersion: "rbac.istio.io/v1alpha1" +kind: ServiceRole +metadata: + name: msb + namespace: onap +spec: + rules: + - services: ["*"] + methods: ["GET"] +--- +apiVersion: "rbac.istio.io/v1alpha1" +kind: ServiceRoleBinding +metadata: + name: bind-service-msb + namespace: onap +spec: + subjects: + - user: "cluster.local/ns/onap/sa/msb" + roleRef: + kind: ServiceRole + name: "msb" |