path: root/certServiceK8sExternalProvider/deploy/roles.yaml

# ============LICENSE_START=======================================================
# oom-certservice-k8s-external-provider
# ================================================================================
# Copyright (c) 2019 Smallstep Labs, Inc.
# Modifications copyright (C) 2020 Nokia. All rights reserved.
# ================================================================================
# This source code was copied from the following git repository:
# https://github.com/smallstep/step-issuer
# The source code was modified for usage in the ONAP project.
# ================================================================================
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# ============LICENSE_END=========================================================
#

apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.2.5
  creationTimestamp: null
  name: certserviceissuers.certmanager.onap.org
spec:
  group: certmanager.onap.org
  names:
    kind: CertServiceIssuer
    listKind: CertServiceIssuerList
    plural: certserviceissuers
    singular: certserviceissuer
  scope: Namespaced
  subresources:
    status: {}
  validation:
    openAPIV3Schema:
      description: CertServiceIssuer is the Schema for the certserviceissuers API
      properties:
        apiVersion:
          description: 'APIVersion defines the versioned schema of this representation
            of an object. Servers should convert recognized schemas to the latest
            internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
          type: string
        kind:
          description: 'Kind is a string value representing the REST resource this
            object represents. Servers may infer this from the endpoint the client
            submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
          type: string
        metadata:
          type: object
        spec:
          description: CertServiceIssuerSpec defines the desired state of CertServiceIssuer
          properties:
            caBundle:
              description: CABundle is a base64 encoded TLS certificate used to verify
                connections to the certservice certificates server. If not set the system
                root certificates are used to validate the TLS connection.
              format: byte
              type: string
            provisioner:
              description: Provisioner contains the certservice certificates provisioner
                configuration.
              properties:
                kid:
                  description: KeyID is the kid property of the JWK provisioner.
                  type: string
                name:
                  description: Names is the name of the JWK provisioner.
                  type: string
                passwordRef:
                  description: PasswordRef is a reference to a Secret containing the
                    provisioner password used to decrypt the provisioner private key.
                  properties:
                    key:
                      description: The key of the secret to select from. Must be a
                        valid secret key.
                      type: string
                    name:
                      description: The name of the secret in the pod's namespace to
                        select from.
                      type: string
                  required:
                    - name
                  type: object
              required:
                - kid
                - name
                - passwordRef
              type: object
            url:
              description: URL is the base URL for the certservice certificates instance.
              type: string
          required:
            - provisioner
            - url
          type: object
        status:
          description: CertServiceIssuerStatus defines the observed state of CertServiceIssuer
          properties:
            conditions:
              items:
                description: CertServiceIssuerCondition contains condition information for
                  the certservice issuer.
                properties:
                  lastTransitionTime:
                    description: LastTransitionTime is the timestamp corresponding
                      to the last status change of this condition.
                    format: date-time
                    type: string
                  message:
                    description: Message is a human readable description of the details
                      of the last transition, complementing reason.
                    type: string
                  reason:
                    description: Reason is a brief machine readable explanation for
                      the condition's last transition.
                    type: string
                  status:
                    allOf:
                      - enum:
                          - "True"
                          - "False"
                          - Unknown
                      - enum:
                          - "True"
                          - "False"
                          - Unknown
                    description: Status of the condition, one of ('True', 'False',
                      'Unknown').
                    type: string
                  type:
                    description: Type of the condition, currently ('Ready').
                    enum:
                      - Ready
                    type: string
                required:
                  - status
                  - type
                type: object
              type: array
          type: object
      type: object
  version: v1beta1
  versions:
    - name: v1beta1
      served: true
      storage: true
status:
  acceptedNames:
    kind: ""
    plural: ""
  conditions: []
  storedVersions: []
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: certservice-issuer-leader-election-role
  namespace: onap
rules:
  - apiGroups:
      - ""
    resources:
      - configmaps
    verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete
  - apiGroups:
      - ""
    resources:
      - configmaps/status
    verbs:
      - get
      - update
      - patch
  - apiGroups:
      - ""
    resources:
      - events
    verbs:
      - create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  creationTimestamp: null
  name: certservice-issuer-manager-role
rules:
  - apiGroups:
      - ""
    resources:
      - events
    verbs:
      - create
      - patch
  - apiGroups:
      - ""
    resources:
      - secrets
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - cert-manager.io
    resources:
      - certificaterequests
    verbs:
      - get
      - list
      - update
      - watch
  - apiGroups:
      - cert-manager.io
    resources:
      - certificaterequests/status
    verbs:
      - get
      - patch
      - update
  - apiGroups:
      - certmanager.onap.org
    resources:
      - certserviceissuers
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - certmanager.onap.org
    resources:
      - certserviceissuers/status
    verbs:
      - get
      - patch
      - update
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: certservice-issuer-proxy-role
rules:
  - apiGroups:
      - authentication.k8s.io
    resources:
      - tokenreviews
    verbs:
      - create
  - apiGroups:
      - authorization.k8s.io
    resources:
      - subjectaccessreviews
    verbs:
      - create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: certservice-issuer-leader-election-rolebinding
  namespace: onap
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: certservice-issuer-leader-election-role
subjects:
  - kind: ServiceAccount
    name: default
    namespace: onap
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: certservice-issuer-manager-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: certservice-issuer-manager-role
subjects:
  - kind: ServiceAccount
    name: default
    namespace: onap
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: certservice-issuer-proxy-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: certservice-issuer-proxy-role
subjects:
  - kind: ServiceAccount
    name: default
    namespace: onap