provide users with appropriate access to resources

Users need access to a number of resources so that they can run scenarios.
bitcoin-dev-project · Sep 7, 2024 · 6371898 · 6371898
1 parent 7374699
commit 6371898
Show file tree

Hide file tree

Showing 3 changed files with 76 additions and 4 deletions.
diff --git a/resources/charts/namespaces/values.yaml b/resources/charts/namespaces/values.yaml
@@ -9,8 +9,32 @@ roles:
       - apiGroups: [""]
         resources: ["pods"]
         verbs: ["get", "list", "watch"]
+      - apiGroups: [""]
+        resources: ["pods/log", "pods/exec", "pods/attach", "pods/portforward"]
+        verbs: ["get"]
+      - apiGroups: [""]
+        resources: ["configmaps", "secrets"]
+        verbs: ["get"]
+      - apiGroups: [""]
+        resources: ["persistentvolumeclaims"]
+        verbs: ["get", "list"]
+      - apiGroups: [""]
+        resources: ["events"]
+        verbs: ["get"]
   - name: pod-manager
     rules:
       - apiGroups: [""]
         resources: ["pods"]
-        verbs: ["get", "list", "watch", "create", "update", "delete"]
+        verbs: ["get", "list", "watch", "create", "delete", "update"]
+      - apiGroups: [""]
+        resources: ["pods/log", "pods/exec", "pods/attach", "pods/portforward"]
+        verbs: ["get", "create"]
+      - apiGroups: [""]
+        resources: ["configmaps", "secrets"]
+        verbs: ["get", "create"]
+      - apiGroups: [""]
+        resources: ["persistentvolumeclaims"]
+        verbs: ["get", "list"]
+      - apiGroups: [""]
+        resources: ["events"]
+        verbs: ["get"]
diff --git a/resources/namespaces/two_namespaces_two_users/namespace-defaults.yaml b/resources/namespaces/two_namespaces_two_users/namespace-defaults.yaml
@@ -12,5 +12,5 @@ roles:
   - name: pod-manager
     rules:
       - apiGroups: [""]
-        resources: ["pods"]
+        resources: ["pods", "configmaps"]
         verbs: ["get", "list", "watch", "create", "update", "delete"]
diff --git a/resources/namespaces/two_namespaces_two_users/namespaces.yaml b/resources/namespaces/two_namespaces_two_users/namespaces.yaml
@@ -14,11 +14,35 @@ namespaces:
           - apiGroups: [""]
             resources: ["pods"]
             verbs: ["get", "list", "watch"]
+          - apiGroups: [""]
+            resources: ["pods/log", "pods/exec", "pods/attach", "pods/portforward"]
+            verbs: ["get"]
+          - apiGroups: [""]
+            resources: ["configmaps", "secrets"]
+            verbs: ["get"]
+          - apiGroups: [""]
+            resources: ["persistentvolumeclaims"]
+            verbs: ["get", "list"]
+          - apiGroups: [""]
+            resources: ["events"]
+            verbs: ["get"]
       - name: pod-manager
         rules:
           - apiGroups: [""]
             resources: ["pods"]
-            verbs: ["get", "list", "watch", "create", "update", "delete"]
+            verbs: ["get", "list", "watch", "create", "delete", "update"]
+          - apiGroups: [""]
+            resources: ["pods/log", "pods/exec", "pods/attach", "pods/portforward"]
+            verbs: ["get", "create"]
+          - apiGroups: [""]
+            resources: ["configmaps", "secrets"]
+            verbs: ["get", "create"]
+          - apiGroups: [""]
+            resources: ["persistentvolumeclaims"]
+            verbs: ["get", "list"]
+          - apiGroups: [""]
+            resources: ["events"]
+            verbs: ["get"]
   - name: warnet-blue-team
     users:
       - name: mallory
@@ -34,8 +58,32 @@ namespaces:
           - apiGroups: [""]
             resources: ["pods"]
             verbs: ["get", "list", "watch"]
+          - apiGroups: [""]
+            resources: ["pods/log", "pods/exec", "pods/attach", "pods/portforward"]
+            verbs: ["get"]
+          - apiGroups: [""]
+            resources: ["configmaps", "secrets"]
+            verbs: ["get"]
+          - apiGroups: [""]
+            resources: ["persistentvolumeclaims"]
+            verbs: ["get", "list"]
+          - apiGroups: [""]
+            resources: ["events"]
+            verbs: ["get"]
       - name: pod-manager
         rules:
           - apiGroups: [""]
             resources: ["pods"]
-            verbs: ["get", "list", "watch", "create", "update", "delete"]
+            verbs: ["get", "list", "watch", "create", "delete", "update"]
+          - apiGroups: [""]
+            resources: ["pods/log", "pods/exec", "pods/attach", "pods/portforward"]
+            verbs: ["get", "create"]
+          - apiGroups: [""]
+            resources: ["configmaps", "secrets"]
+            verbs: ["get", "create"]
+          - apiGroups: [""]
+            resources: ["persistentvolumeclaims"]
+            verbs: ["get", "list"]
+          - apiGroups: [""]
+            resources: ["events"]
+            verbs: ["get"]