RBAC configuration required for the Tanzu RabbitMQ package installation
To install your Tanzu RabbitMQ package, you must have permissions to create cluster-scope objects on any namespace. To create such objects, you must use or create a service account.
For example to create CustomResourceDefinition
objects, you must have a service account.
The following example code creates a service account called tanzu-rabbitmq
in the default namespace. The ClusterRole
and ClusterRoleBinding
objects are created in this namespace. These objects include all the permissions that are required to create any objects that are required by Tanzu RabbitMQ.
You can also access the example code in this serviceaccount.yml file:
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: tanzu-rabbitmq-crd-install
rules:
- apiGroups:
- admissionregistration.k8s.io
resources:
- validatingwebhookconfigurations
- mutatingwebhookconfigurations
verbs:
- "*"
- apiGroups:
- apiextensions.k8s.io
resources:
- customresourcedefinitions
verbs:
- "*"
- apiGroups:
- apps
resources:
- deployments
verbs:
- "*"
- apiGroups:
- cert-manager.io
resources:
- certificates
- issuers
verbs:
- "*"
- apiGroups:
- ""
resources:
- configmaps
- namespaces
- secrets
- serviceaccounts
- services
verbs:
- "*"
- apiGroups:
- rbac.authorization.k8s.io
resources:
- clusterrolebindings
- clusterroles
- rolebindings
- roles
verbs:
- "*"
- apiGroups:
- coordination.k8s.io
resources:
- leases
verbs:
- "*"
- apiGroups:
- ""
resources:
- events
verbs:
- create
- get
- patch
- apiGroups:
- ""
resources:
- endpoints
verbs:
- get
- list
- watch
- apiGroups:
- ""
resources:
- persistentvolumeclaims
verbs:
- create
- get
- list
- update
- watch
- apiGroups:
- ""
resources:
- pods
verbs:
- get
- list
- update
- watch
- apiGroups:
- ""
resources:
- pods/exec
verbs:
- create
- apiGroups:
- apps
resources:
- statefulsets
verbs:
- create
- delete
- get
- list
- update
- watch
- apiGroups:
- rabbitmq.com
- rabbitmq.tanzu.vmware.com
resources:
- "*"
verbs:
- "*"
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: tanzu-rabbitmq
namespace: default
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: tanzu-rabbitmq-crd-install-binding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: tanzu-rabbitmq-crd-install
subjects:
- kind: ServiceAccount
name: tanzu-rabbitmq
namespace: default
Content feedback and comments