40 lines
1.1 KiB
YAML
40 lines
1.1 KiB
YAML
# k8s/rbac-traefik.yaml
|
|
# ============================================
|
|
# Grant Gitea runner SA permission to manage
|
|
# Traefik Middleware CRDs in the app namespace.
|
|
#
|
|
# Apply once per cluster/namespace:
|
|
# kubectl apply -f k8s/rbac-traefik.yaml
|
|
#
|
|
# Variables (envsubst):
|
|
# NAMESPACE - app namespace (e.g. gobha-ai-chat)
|
|
# RUNNER_SA_NS - runner SA namespace (default: gitea-runner)
|
|
# ============================================
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: traefik-middleware-manager
|
|
namespace: ${NAMESPACE}
|
|
labels:
|
|
app: switchboard
|
|
rules:
|
|
- apiGroups: ["traefik.io"]
|
|
resources: ["middlewares"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: gitea-runner-traefik-middleware
|
|
namespace: ${NAMESPACE}
|
|
labels:
|
|
app: switchboard
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: gitea-runner-sa
|
|
namespace: ${RUNNER_SA_NS:-gitea-runner}
|
|
roleRef:
|
|
kind: Role
|
|
name: traefik-middleware-manager
|
|
apiGroup: rbac.authorization.k8s.io
|