feat: create service account specific rbac rules (#17)

* feat: create service account specific rbac rules

* run terraform fmt to pass checks

service-account.tf

@@ -1,25 +1,64 @@
+resource "kubernetes_service_account" "users" {
+  count = length(var.service_accounts)
 
-locals {
-  pull_secret_keys = keys(var.image_pull_secrets)
+  metadata {
+    name      = lookup(var.service_accounts[count.index], "name", "default")
+    namespace = kubernetes_namespace.namespace.metadata.0.name
+  }
+
+  dynamic "image_pull_secret" {
+    for_each = lookup(var.service_accounts[count.index], "image_pull_secrets", [])
+
+    content {
+      name = image_pull_secret.key
+    }
+  }
 }
 
-resource "kubernetes_service_account" "namespace" {
-  count = var.enabled_rbac_binding ? 1 : 0
+resource "kubernetes_role" "service_accounts" {
+  count = length(var.service_accounts)
 
   metadata {
-    name      = "${module.label.id}-apps"
+    name      = lookup(var.service_accounts[count.index], "name", "default")
     namespace = kubernetes_namespace.namespace.metadata.0.name
   }
 
-  dynamic "image_pull_secret" {
-    for_each = var.image_pull_secrets
+  dynamic "rule" {
+    for_each = lookup(var.service_accounts[count.index], "rules", [])
 
     content {
-      name = image_pull_secret.key
+      api_groups = rule.value.api_groups
+      resources  = rule.value.resources
+      verbs      = rule.value.verbs
     }
   }
 }
 
+resource "kubernetes_role_binding" "sa_binding" {
+  count = length(var.service_accounts)
+
+  metadata {
+    name      = lookup(var.service_accounts[count.index], "name", "default")
+    namespace = kubernetes_namespace.namespace.metadata.0.name
+  }
+
+  role_ref {
+    name      = element(kubernetes_role.service_accounts.*.metadata.0.name, count.index)
+    api_group = "rbac.authorization.k8s.io"
+    kind      = "Role"
+  }
+
+  subject {
+    kind      = "ServiceAccount"
+    name      = element(kubernetes_service_account.users.*.metadata.0.name, count.index)
+    namespace = kubernetes_namespace.namespace.metadata.0.name
+  }
+}
+
+locals {
+  pull_secret_keys = keys(var.image_pull_secrets)
+}
+
 resource "kubernetes_secret" "image_pull" {
   count = length(local.pull_secret_keys)
   type  = "kubernetes.io/dockerconfigjson"

variables.tf

@@ -97,6 +97,16 @@ variable "max_node_ports" {
   description = "Maximum amount of services with type NodePort"
 }
 
+variable "service_accounts" {
+  type = list(object({
+    name               = string
+    rules              = any # [{api_groups=[""],resources=["pod"],verbs=["get", "list"]}]
+    image_pull_secrets = list(string)
+  }))
+  default     = []
+  description = "Creates additional service accounts with a dedicated RBAC role"
+}
+
 variable "enable_network_policies" {
   type        = bool
   default     = true