aboutsummaryrefslogtreecommitdiffstats
path: root/certServiceK8sExternalProvider/deploy/roles.yaml
blob: 5025e11e790070ca4a8d11af2f2118f53eb67f1a (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
# ============LICENSE_START=======================================================
# oom-certservice-k8s-external-provider
# ================================================================================
# Copyright (c) 2019 Smallstep Labs, Inc.
# Modifications copyright (C) 2020 Nokia. All rights reserved.
# ================================================================================
# This source code was copied from the following git repository:
# https://github.com/smallstep/step-issuer
# The source code was modified for usage in the ONAP project.
# ================================================================================
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# ============LICENSE_END=========================================================
#

apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.2.5
  creationTimestamp: null
  name: certserviceissuers.certmanager.onap.org
spec:
  group: certmanager.onap.org
  names:
    kind: CertServiceIssuer
    listKind: CertServiceIssuerList
    plural: certserviceissuers
    singular: certserviceissuer
  scope: Namespaced
  subresources:
    status: {}
  validation:
    openAPIV3Schema:
      description: CertServiceIssuer is the Schema for the certserviceissuers API
      properties:
        apiVersion:
          description: 'APIVersion defines the versioned schema of this representation
            of an object. Servers should convert recognized schemas to the latest
            internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
          type: string
        kind:
          description: 'Kind is a string value representing the REST resource this
            object represents. Servers may infer this from the endpoint the client
            submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
          type: string
        metadata:
          type: object
        spec:
          description: CertServiceIssuerSpec defines the desired state of CertServiceIssuer
          properties:
            caBundle:
              description: CABundle is a base64 encoded TLS certificate used to verify
                connections to the certservice certificates server. If not set the system
                root certificates are used to validate the TLS connection.
              format: byte
              type: string
            provisioner:
              description: Provisioner contains the certservice certificates provisioner
                configuration.
              properties:
                kid:
                  description: KeyID is the kid property of the JWK provisioner.
                  type: string
                name:
                  description: Names is the name of the JWK provisioner.
                  type: string
                passwordRef:
                  description: PasswordRef is a reference to a Secret containing the
                    provisioner password used to decrypt the provisioner private key.
                  properties:
                    key:
                      description: The key of the secret to select from. Must be a
                        valid secret key.
                      type: string
                    name:
                      description: The name of the secret in the pod's namespace to
                        select from.
                      type: string
                  required:
                    - name
                  type: object
              required:
                - kid
                - name
                - passwordRef
              type: object
            url:
              description: URL is the base URL for the certservice certificates instance.
              type: string
          required:
            - provisioner
            - url
          type: object
        status:
          description: CertServiceIssuerStatus defines the observed state of CertServiceIssuer
          properties:
            conditions:
              items:
                description: CertServiceIssuerCondition contains condition information for
                  the certservice issuer.
                properties:
                  lastTransitionTime:
                    description: LastTransitionTime is the timestamp corresponding
                      to the last status change of this condition.
                    format: date-time
                    type: string
                  message:
                    description: Message is a human readable description of the details
                      of the last transition, complementing reason.
                    type: string
                  reason:
                    description: Reason is a brief machine readable explanation for
                      the condition's last transition.
                    type: string
                  status:
                    allOf:
                      - enum:
                          - "True"
                          - "False"
                          - Unknown
                      - enum:
                          - "True"
                          - "False"
                          - Unknown
                    description: Status of the condition, one of ('True', 'False',
                      'Unknown').
                    type: string
                  type:
                    description: Type of the condition, currently ('Ready').
                    enum:
                      - Ready
                    type: string
                required:
                  - status
                  - type
                type: object
              type: array
          type: object
      type: object
  version: v1beta1
  versions:
    - name: v1beta1
      served: true
      storage: true
status:
  acceptedNames:
    kind: ""
    plural: ""
  conditions: []
  storedVersions: []
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: certservice-issuer-leader-election-role
  namespace: onap
rules:
  - apiGroups:
      - ""
    resources:
      - configmaps
    verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete
  - apiGroups:
      - ""
    resources:
      - configmaps/status
    verbs:
      - get
      - update
      - patch
  - apiGroups:
      - ""
    resources:
      - events
    verbs:
      - create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  creationTimestamp: null
  name: certservice-issuer-manager-role
rules:
  - apiGroups:
      - ""
    resources:
      - events
    verbs:
      - create
      - patch
  - apiGroups:
      - ""
    resources:
      - secrets
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - cert-manager.io
    resources:
      - certificaterequests
    verbs:
      - get
      - list
      - update
      - watch
  - apiGroups:
      - cert-manager.io
    resources:
      - certificaterequests/status
    verbs:
      - get
      - patch
      - update
  - apiGroups:
      - certmanager.onap.org
    resources:
      - certserviceissuers
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - certmanager.onap.org
    resources:
      - certserviceissuers/status
    verbs:
      - get
      - patch
      - update
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: certservice-issuer-proxy-role
rules:
  - apiGroups:
      - authentication.k8s.io
    resources:
      - tokenreviews
    verbs:
      - create
  - apiGroups:
      - authorization.k8s.io
    resources:
      - subjectaccessreviews
    verbs:
      - create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: certservice-issuer-leader-election-rolebinding
  namespace: onap
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: certservice-issuer-leader-election-role
subjects:
  - kind: ServiceAccount
    name: default
    namespace: onap
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: certservice-issuer-manager-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: certservice-issuer-manager-role
subjects:
  - kind: ServiceAccount
    name: default
    namespace: onap
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: certservice-issuer-proxy-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: certservice-issuer-proxy-role
subjects:
  - kind: ServiceAccount
    name: default
    namespace: onap