1 files changed, 181 insertions, 0 deletions
diff --git a/src/orchestration/cluster-setup-files/orchestration-sa.yaml b/src/orchestration/cluster-setup-files/orchestration-sa.yaml
new file mode 100644
index 0000000..5531431
--- /dev/null
+++ b/src/orchestration/cluster-setup-files/orchestration-sa.yaml
@@ -0,0 +1,181 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{orchestration_sa}}
+  namespace: default 
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{orchestration_sa}}-crb 
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: view 
+subjects:
+  - kind: ServiceAccount
+    name: {{orchestration_sa}} 
+    namespace: default 
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{orchestration_sa}}-rb 
+  namespace: {{ namespace }} 
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: edit 
+subjects:
+  - kind: ServiceAccount
+    name: {{orchestration_sa}} 
+    namespace: default 
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{crd_cluster_role}}-rb
+  namespace: {{ namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ crd_cluster_role }} 
+subjects:
+  - kind: ServiceAccount
+    name: {{orchestration_sa}} 
+    namespace: default 
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: configmap-role
+  namespace: {{ namespace }}
+rules:
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["*"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: configmap-rb
+  namespace: {{ namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: configmap-role
+subjects:
+  - kind: ServiceAccount
+    name: {{ orchestration_sa }} 
+    namespace: default 
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: service-role
+  namespace: {{ namespace }}
+rules:
+  - apiGroups: [""]
+    resources: ["services"]
+    verbs: ["*"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: service-rb
+  namespace: {{ namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: service-role
+subjects:
+  - kind: ServiceAccount
+    name: {{ orchestration_sa }}
+    namespace: default 
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: deployment-role 
+  namespace: {{ namespace }}
+rules:
+  - apiGroups: ["apps"]
+    resources: ["deployments"]
+    verbs: ["*"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: deployment-rb
+  namespace: {{ namespace }} 
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: deployment-role
+subjects:
+  - kind: ServiceAccount
+    name: {{ orchestration_sa }}
+    namespace: default 
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: secret-role
+  namespace: {{ namespace }}
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["*"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: secret-rb
+  namespace: {{ namespace }} 
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: secret-role
+subjects:
+  - kind: ServiceAccount
+    name: {{ orchestration_sa }}
+    namespace: default 
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: pvc-role 
+  namespace: {{ namespace }} 
+rules:
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims"]
+    verbs: ["*"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: pvc-rb 
+  namespace: {{ namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: pvc 
+subjects:
+  - kind: ServiceAccount
+    name: {{ orchestration_sa }}
+    namespace: default 
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: crd-rb-orch 
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: crd-view 
+subjects:
+  - kind: ServiceAccount
+    name: {{ orchestration_sa }}
+    namespace: default 
+---
+