feature: allow anubispaulista cluster wide read-only access\

Author: Atomsoldat

components/rbac/clusterrolebinding.yaml

@@ -0,0 +1,23 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: anubispaulista-view-cluster
+subjects:
+# this references our stop-gap SA via its unique name/namespace combo
+- kind: ServiceAccount
+  name: anubispaulista
+  namespace: rbac-admin 
+# this is for later when we actually have some kind of authentication infra
+#- kind: User
+#  name: anubispaulista@nekropolis.irminsul
+#  apiGroup: rbac.authorization.k8s.io
+roleRef:
+  kind: ClusterRole
+  # TODO: we will want to aggregate some extra permissions into this default role
+  # for all of our custom resources
+  # until then, this should work however
+  # https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles 
+  # k get clusterrole view -o yaml
+  # view provides read-only access to most things, excluding secrets
+  name: view
+  apiGroup: rbac.authorization.k8s.io

components/rbac/kustomization.yaml

@@ -4,4 +4,5 @@
 resources:
   - namespace.yaml
   - rolebinding.yaml
+  - clusterrolebinding.yaml
   - serviceaccount.yaml

manifests/rbac/manifests.yaml

@@ -65,3 +65,16 @@ subjects:
 - kind: ServiceAccount
   name: anubispaulista
   namespace: rbac-admin
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: anubispaulista-view-cluster
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: view
+subjects:
+- kind: ServiceAccount
+  name: anubispaulista
+  namespace: rbac-admin