Adding role, rolebindings, clusterrole for web

templates/web/clusterrole.yaml

@@ -0,0 +1,14 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "pecan.fullname" . }}-web
+  labels:
+    {{- include "pecan.labels" . | nindent 4 }}
+rules:
+- apiGroups: [""]
+  resources: ["persistentvolumes"]
+  verbs:
+  - get
+  - list
+  - watch
+  - update

templates/web/deployment.yaml

@@ -20,6 +20,8 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
     {{- end }}
+      serviceAccountName: {{ include "pecan.fullname" . }}-web
+      automountServiceAccountToken: false
       initContainers:
         - name: check-rabbitmq
           image: "{{ $.Values.image.checks }}"

templates/web/role.yaml

@@ -0,0 +1,21 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "pecan.fullname" . }}-web
+  labels:
+    {{- include "pecan.labels" . | nindent 4 }}
+rules:
+- apiGroups: [""]
+  resources: ["pods", "endpoints", "Services", "persistentvolumeclaims"]
+  verbs:
+  - list
+  - watch
+  - get
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - ingresses
+  verbs:
+  - list
+  - watch
+  - get

templates/web/rolebinding.yaml

@@ -0,0 +1,17 @@
+# We bind the role to the pecan-web service account.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "pecan.fullname" . }}-web
+  labels:
+    {{- include "pecan.labels" . | nindent 4 }}
+roleRef:
+- apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ include "pecan.fullname" . }}-web
+- apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "pecan.fullname" . }}-web
+subjects:
+- kind: ServiceAccount
+  name: {{ include "pecan.fullname" . }}-web