k8s/roles/k8s_gbm_dev/templates/dev-role.yml.j2
2026-07-15 11:14:21 +03:00

64 lines
1.4 KiB
Django/Jinja

---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: {{ dev_access_role_name }}
namespace: {{ dev_access_namespace }}
rules:
# Core workload resources — read
- apiGroups: [""]
resources:
- pods
- services
- endpoints
- configmaps
- persistentvolumeclaims
- events
- replicationcontrollers
verbs: {{ dev_access_verbs | to_json }}
# Logs — always readable
- apiGroups: [""]
resources:
- pods/log
verbs: ["get", "list", "watch"]
{% if dev_access_allow_exec | bool %}
# Exec and port-forward — for debugging
- apiGroups: [""]
resources:
- pods/exec
- pods/portforward
verbs: ["create"]
{% endif %}
# Secrets — read only (developers may need env inspection)
- apiGroups: [""]
resources:
- secrets
verbs: ["get", "list"]
# Apps
- apiGroups: ["apps"]
resources:
- deployments
- replicasets
- statefulsets
- daemonsets
verbs: {{ dev_access_verbs | to_json }}
# Batch
- apiGroups: ["batch"]
resources:
- jobs
- cronjobs
verbs: {{ dev_access_verbs | to_json }}
# Networking
- apiGroups: ["networking.k8s.io"]
resources:
- ingresses
- networkpolicies
verbs: {{ dev_access_verbs | to_json }}
# Traefik CRDs
- apiGroups: ["traefik.io"]
resources:
- ingressroutes
- ingressroutetcps
- middlewares
verbs: {{ dev_access_verbs | to_json }}