diff --git a/config/200-role.yaml b/config/200-role.yaml deleted file mode 100644 index 6d05aa36b..000000000 --- a/config/200-role.yaml +++ /dev/null @@ -1,32 +0,0 @@ -# Copyright 2020 The Tekton Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# NOTE: when multi-tenant EventListener progresses, moving this Role -# to a ClusterRole is not the advisable path. Additional Roles that -# adds access to Secrets to the Namespaces managed by the multi-tenant -# EventListener is what should be done. While not as simple, it avoids -# giving access to K8S system level, cluster admin privileged level Secrets - -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: tekton-triggers-admin - namespace: tekton-pipelines - labels: - app.kubernetes.io/instance: default - app.kubernetes.io/part-of: tekton-triggers -rules: - - apiGroups: [""] - resources: ["secrets"] - verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] diff --git a/config/201-rolebinding.yaml b/config/201-rolebinding.yaml deleted file mode 100644 index 00d3faebb..000000000 --- a/config/201-rolebinding.yaml +++ /dev/null @@ -1,30 +0,0 @@ -# Copyright 2020 The Tekton Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: tekton-triggers-controller-admin - namespace: tekton-pipelines - labels: - app.kubernetes.io/instance: default - app.kubernetes.io/part-of: tekton-triggers -subjects: - - kind: ServiceAccount - name: tekton-triggers-controller - namespace: tekton-pipelines -roleRef: - kind: Role - name: tekton-triggers-admin - apiGroup: rbac.authorization.k8s.io diff --git a/examples/role-resources/clustertriggerbinding-roles/clusterrole.yaml b/examples/role-resources/clustertriggerbinding-roles/clusterrole.yaml index 45fb6c099..6227d103f 100644 --- a/examples/role-resources/clustertriggerbinding-roles/clusterrole.yaml +++ b/examples/role-resources/clustertriggerbinding-roles/clusterrole.yaml @@ -9,7 +9,7 @@ rules: verbs: ["get"] - apiGroups: [""] # secrets are only needed for Github/Gitlab interceptors - resources: ["configmaps", "secrets"] + resources: ["configmaps"] verbs: ["get", "list", "watch"] # Permissions to create resources in associated TriggerTemplates - apiGroups: ["tekton.dev"]