chore: allow to read licenses and secrets

mesosphere · Sep 4, 2023 · ab1b448 · ab1b448
1 parent b05a7df
commit ab1b448
Showing 1 changed file with 30 additions and 0 deletions.
diff --git a/services/ai-navigator-app/0.1.0/ai-navigator-app.yaml b/services/ai-navigator-app/0.1.0/ai-navigator-app.yaml
@@ -1,3 +1,32 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: ai-navigator-app
+  namespace: ${releaseNamespace}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: ai-navigator-app
+  namespace: ${releaseNamespace}
+rules:
+  - apiGroups: ["kommander.mesosphere.io", ""]
+    resources: ["licenses", "secrets"]
+    verbs: ["get", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: ai-navigator-app
+  namespace: ${releaseNamespace}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: ai-navigator-app
+subjects:
+  - kind: ServiceAccount
+    name: ai-navigator-app
+    namespace: ${releaseNamespace}
 ---
 apiVersion: v1
 kind: ConfigMap
@@ -26,6 +55,7 @@ spec:
       labels:
         app: ai-navigator-app
     spec:
+      serviceAccountName: ai-navigator-app
       containers:
         - name: ai-navigator-app
           image: mesosphere/ai-navigator-app:development # TODO: Version