41 lines
1.4 KiB
YAML
41 lines
1.4 KiB
YAML
|
# RBAC for the signing-service's K8s TokenReview path (DEV-609).
|
||
|
|
#
|
||
|
|
# The signing-service verifies the caller's workload identity by handing the
|
||
|
|
# `X-Workload-Token` header to the Kubernetes API server as a TokenReview.
|
||
|
|
# That requires create on `tokenreviews.authentication.k8s.io`, which is
|
||
|
|
# NOT part of any default role, so we grant it via a dedicated ClusterRole.
|
||
|
|
#
|
||
|
|
# The ClusterRole is intentionally narrow: `tokenreviews` + `subjectaccessreviews`
|
||
|
|
# so the service can also diagnose "the token authenticated as X, is X allowed
|
||
|
|
# Y?" patterns in Phase 2 without a second RBAC update.
|
||
|
|
---
|
||
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
||
|
|
kind: ClusterRole
|
||
|
|
metadata:
|
||
|
|
name: signing-service-tokenreview
|
||
|
|
labels:
|
||
|
|
app.kubernetes.io/name: signing-service
|
||
|
|
app.kubernetes.io/part-of: proofedmesh
|
||
|
|
app.kubernetes.io/component: trust-core
|
||
|
|
rules:
|
||
|
|
- apiGroups: ["authentication.k8s.io"]
|
||
|
|
resources: ["tokenreviews"]
|
||
|
|
verbs: ["create"]
|
||
|
|
---
|
||
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
||
|
|
kind: ClusterRoleBinding
|
||
|
|
metadata:
|
||
|
|
name: signing-service-tokenreview
|
||
|
|
labels:
|
||
|
|
app.kubernetes.io/name: signing-service
|
||
|
|
app.kubernetes.io/part-of: proofedmesh
|
||
|
|
app.kubernetes.io/component: trust-core
|
||
|
|
roleRef:
|
||
|
|
apiGroup: rbac.authorization.k8s.io
|
||
|
|
kind: ClusterRole
|
||
|
|
name: signing-service-tokenreview
|
||
|
|
subjects:
|
||
|
|
- kind: ServiceAccount
|
||
|
|
name: signing-service
|
||
|
|
namespace: agent-trust
|