search

BCDevOps / platform-services-documize

Apache License 2.0
0 stars 0 forks source link

Add Prod Service Account Impersonation Configuration #15

Open j-pye opened 3 years ago

j-pye commented 3 years ago

Resolves #7

This still needs docs but I'll write those tomorrow...or is it later today.

This adds a service account in the prod environment, a rolebinding to give the service account Admin permissions in the prod namespace, a role that only enables impersonations of that specific service account, and a rolebinding to enable specific users to impersonate the service account.

Ex command:

oc --as system:serviceaccount:101ed4-prod:documize-admin auth can-i create pods
sbathgate commented 3 years ago

LGTM, this would be useful for the Registry too, no?