diff --git a/examples/rbac.yaml b/examples/rbac.yaml index 0e78be93b..20a9c07b6 100644 --- a/examples/rbac.yaml +++ b/examples/rbac.yaml @@ -4,31 +4,6 @@ metadata: name: tekton-triggers-example-sa --- apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: tekton-triggers-example-minimal -rules: -# EventListeners need to be able to fetch all namespaced resources -- apiGroups: ["triggers.tekton.dev"] - resources: ["eventlisteners", "triggerbindings", "triggertemplates", "triggers"] - verbs: ["get", "list", "watch"] -- apiGroups: [""] -# configmaps is needed for updating logging config - resources: ["configmaps"] - verbs: ["get", "list", "watch"] -# Permissions to create resources in associated TriggerTemplates -- apiGroups: ["tekton.dev"] - resources: ["pipelineruns", "pipelineresources", "taskruns"] - verbs: ["create"] -- apiGroups: [""] - resources: ["serviceaccounts"] - verbs: ["impersonate"] -- apiGroups: ["policy"] - resources: ["podsecuritypolicies"] - resourceNames: ["tekton-triggers"] - verbs: ["use"] ---- -apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: tekton-triggers-example-binding @@ -37,18 +12,8 @@ subjects: name: tekton-triggers-example-sa roleRef: apiGroup: rbac.authorization.k8s.io - kind: Role - name: tekton-triggers-example-minimal ---- -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: tekton-triggers-example-clusterrole -rules: -# EventListeners need to be able to fetch any clustertriggerbindings, and clusterinterceptors -- apiGroups: ["triggers.tekton.dev"] - resources: ["clustertriggerbindings", "clusterinterceptors"] - verbs: ["get", "list", "watch"] + kind: ClusterRole + name: tekton-triggers-eventlistener-roles --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -61,4 +26,4 @@ subjects: roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole - name: tekton-triggers-example-clusterrole + name: tekton-triggers-eventlistener-clusterroles