✨ feat: initial prototype

k8s/rbac/dev-rbac.yaml

@@ -0,0 +1,48 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: minikura-dev
+  namespace: minikura
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: minikura-dev-role
+rules:
+  - apiGroups: [""]
+    resources: ["services", "pods", "nodes"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["pods/log"]
+    verbs: ["get", "list"]
+  - apiGroups: ["apps"]
+    resources: ["deployments", "statefulsets"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["networking.k8s.io"]
+    resources: ["ingresses"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["minikura.kirameki.cafe"]
+    resources: ["minecraftservers", "reverseproxyservers"]
+    verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: minikura-dev-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: minikura-dev-role
+subjects:
+  - kind: ServiceAccount
+    name: minikura-dev
+    namespace: minikura
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: minikura-dev-token
+  namespace: minikura
+  annotations:
+    kubernetes.io/service-account.name: minikura-dev
+type: kubernetes.io/service-account-token

k8s/rbac/operator-rbac.yaml

@@ -0,0 +1,55 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: minikura-operator
+  namespace: minikura
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: minikura-operator-role
+rules:
+  - apiGroups: [""]
+    resources: ["services", "pods", "persistentvolumeclaims", "configmaps"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: [""]
+    resources: ["pods/log"]
+    verbs: ["get", "list"]
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["get", "list"]
+  - apiGroups: ["apps"]
+    resources: ["deployments", "statefulsets"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: ["networking.k8s.io"]
+    resources: ["ingresses"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: ["apiextensions.k8s.io"]
+    resources: ["customresourcedefinitions"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: ["minikura.kirameki.cafe"]
+    resources: ["minecraftservers", "reverseproxyservers"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: minikura-operator-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: minikura-operator-role
+subjects:
+  - kind: ServiceAccount
+    name: minikura-operator
+    namespace: minikura
+---
+# Secret to hold the service account token
+apiVersion: v1
+kind: Secret
+metadata:
+  name: minikura-operator-token
+  namespace: minikura
+  annotations:
+    kubernetes.io/service-account.name: minikura-operator
+type: kubernetes.io/service-account-token