From 1413a651c89b512220bee77b57b18aae9ca99702 Mon Sep 17 00:00:00 2001 From: Manfred Schreiber Date: Thu, 17 Feb 2022 23:13:48 +0100 Subject: [PATCH] . --- flux/base/clusterroles/fluxcd-user.yaml | 11 +++++++++++ flux/base/clusterroles/kustomization.yaml | 4 ++++ .../k3d-develop/flux-system/kustomization.yaml | 3 ++- kubeconfigs/k3d-develop.yaml | 8 ++++---- local-k8s/local-k8s.sh | 1 + 5 files changed, 22 insertions(+), 5 deletions(-) create mode 100644 flux/base/clusterroles/fluxcd-user.yaml create mode 100644 flux/base/clusterroles/kustomization.yaml diff --git a/flux/base/clusterroles/fluxcd-user.yaml b/flux/base/clusterroles/fluxcd-user.yaml new file mode 100644 index 0000000..7cfdfa0 --- /dev/null +++ b/flux/base/clusterroles/fluxcd-user.yaml @@ -0,0 +1,11 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: fluxcd-edit + labels: + # Add these permissions to "edit" default role. + rbac.authorization.k8s.io/aggregate-to-edit: "true" +rules: +- apiGroups: ["helm.toolkit.fluxcd.io","kustomize.toolkit.fluxcd.io","notification.toolkit.fluxcd.io","source.toolkit.fluxcd.io"] + resources: ["*"] + verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] diff --git a/flux/base/clusterroles/kustomization.yaml b/flux/base/clusterroles/kustomization.yaml new file mode 100644 index 0000000..3494a41 --- /dev/null +++ b/flux/base/clusterroles/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- fluxcd-user.yaml \ No newline at end of file diff --git a/flux/clusters/k3d-develop/flux-system/kustomization.yaml b/flux/clusters/k3d-develop/flux-system/kustomization.yaml index 646f035..aa6af58 100644 --- a/flux/clusters/k3d-develop/flux-system/kustomization.yaml +++ b/flux/clusters/k3d-develop/flux-system/kustomization.yaml @@ -7,5 +7,6 @@ resources: - flux-components.yaml - flux-sync.yaml - local-git-secret.yaml + - ../../../base/clusterroles -namespace: flux-system \ No newline at end of file +namespace: flux-system diff --git a/kubeconfigs/k3d-develop.yaml b/kubeconfigs/k3d-develop.yaml index 31d8ade..82c936a 100644 --- a/kubeconfigs/k3d-develop.yaml +++ b/kubeconfigs/k3d-develop.yaml @@ -2,8 +2,8 @@ apiVersion: v1 clusters: - cluster: - certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJkakNDQVIyZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWpNU0V3SHdZRFZRUUREQmhyTTNNdGMyVnkKZG1WeUxXTmhRREUyTkRVeE16UTBORFF3SGhjTk1qSXdNakUzTWpFME56STBXaGNOTXpJd01qRTFNakUwTnpJMApXakFqTVNFd0h3WURWUVFEREJock0zTXRjMlZ5ZG1WeUxXTmhRREUyTkRVeE16UTBORFF3V1RBVEJnY3Foa2pPClBRSUJCZ2dxaGtqT1BRTUJCd05DQUFTblQrcDFZRXJ3UG9wUXJPMkZONklLZzZQRGdXQzJMekZ6cnEwT3FXck0KZzMzZVhlOUk2b1B0RURGL3FpckRJeDFDTXFvV3Q1ZHFSQzZxWGkwc0lUelpvMEl3UURBT0JnTlZIUThCQWY4RQpCQU1DQXFRd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFRmdRVWU3bVdtRGJPMGZYL3JjcHFlbEpoClJhVVNVbHN3Q2dZSUtvWkl6ajBFQXdJRFJ3QXdSQUlnSm9pMTdsNTRoY3RkV1F5Mk1GRERxcDJtU3ppSnViR0UKOVpJUldSMHg3Y2NDSUNGVW00M21PTjliZkhNQld4TTF6bDljNm9ObUIvU1ZTaUJUQitoaHZIS1UKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= - server: https://0.0.0.0:57182 + certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJkekNDQVIyZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWpNU0V3SHdZRFZRUUREQmhyTTNNdGMyVnkKZG1WeUxXTmhRREUyTkRVeE16VTFOREV3SGhjTk1qSXdNakUzTWpJd05UUXhXaGNOTXpJd01qRTFNakl3TlRReApXakFqTVNFd0h3WURWUVFEREJock0zTXRjMlZ5ZG1WeUxXTmhRREUyTkRVeE16VTFOREV3V1RBVEJnY3Foa2pPClBRSUJCZ2dxaGtqT1BRTUJCd05DQUFUdldzbjlFU0VtUC9IU1daamp0UXA3R25GWDlqMVNCMHBhZkx0dHBZSG0KTjhZbEpIU1ViMGJicmZqUzd0am5HWTF4RHV1aVlMQm9keDZtY1ZHM0pqZWlvMEl3UURBT0JnTlZIUThCQWY4RQpCQU1DQXFRd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFRmdRVW9XdmJEVTcrUjF1UlVqWW1EOWU1Cis4cllPOVV3Q2dZSUtvWkl6ajBFQXdJRFNBQXdSUUlnQ3paelVBRGFjSVFnVmZFV2Ywc3Foc29xc25sRzE4bVEKRGxGSS85VThVOXdDSVFEMnFGVk1mQUdWeEZQVEdNaFZEYzJtVjExbHJqMFQ2SStKVCtETnVmelVlQT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K + server: https://0.0.0.0:57999 name: k3d-develop contexts: - context: @@ -16,5 +16,5 @@ preferences: {} users: - name: admin@k3d-develop user: - client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrVENDQVRlZ0F3SUJBZ0lJS3pTWlM4ZkVUaEF3Q2dZSUtvWkl6ajBFQXdJd0l6RWhNQjhHQTFVRUF3d1kKYXpOekxXTnNhV1Z1ZEMxallVQXhOalExTVRNME5EUTBNQjRYRFRJeU1ESXhOekl4TkRjeU5Gb1hEVEl6TURJeApOekl4TkRjeU5Gb3dNREVYTUJVR0ExVUVDaE1PYzNsemRHVnRPbTFoYzNSbGNuTXhGVEFUQmdOVkJBTVRESE41CmMzUmxiVHBoWkcxcGJqQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJKUFpzYmN5R0pLNTRSbWcKaEpaYURIZUhDTXkrUkJWYTBOVWhaU1RQL3FzRWw2YWIwZjdpVXhKVEtUWGdHUGhrTGhkZVY1eFBSckl5L01JUQo0c0k2cmlhalNEQkdNQTRHQTFVZER3RUIvd1FFQXdJRm9EQVRCZ05WSFNVRUREQUtCZ2dyQmdFRkJRY0RBakFmCkJnTlZIU01FR0RBV2dCUWI4OTRLVEFSNnE0dy9VTmFldFRHNGh4aDNQakFLQmdncWhrak9QUVFEQWdOSUFEQkYKQWlBUi8rY2tXOEFWUzVoeFpybWxQNXBhd0hZS0FaeHFLbHZESTFyS25JSVNtZ0loQUpIenRIeFZ6QkdmcU5QZQpsZVhiaS83ZmV5L09jYThLMWdJTTZ6YnVrbXZ1Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJkekNDQVIyZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWpNU0V3SHdZRFZRUUREQmhyTTNNdFkyeHAKWlc1MExXTmhRREUyTkRVeE16UTBORFF3SGhjTk1qSXdNakUzTWpFME56STBXaGNOTXpJd01qRTFNakUwTnpJMApXakFqTVNFd0h3WURWUVFEREJock0zTXRZMnhwWlc1MExXTmhRREUyTkRVeE16UTBORFF3V1RBVEJnY3Foa2pPClBRSUJCZ2dxaGtqT1BRTUJCd05DQUFTeTMyUU80Mk50UktMMVVMTVFjdlJQOTUvSHRzVnhYaTB3R1oyOVMxYTcKWDRSc1hlemNPTnJSRWNNUGM5anBFc0ZWZG8wYUdsRmhLM1B3cngyL3BlMVNvMEl3UURBT0JnTlZIUThCQWY4RQpCQU1DQXFRd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFRmdRVUcvUGVDa3dFZXF1TVAxRFduclV4CnVJY1lkejR3Q2dZSUtvWkl6ajBFQXdJRFNBQXdSUUloQVBvMFlFK3A2Q1Q2cDBvN3VvMGtadzl5TTFCZ25mYTcKbExtUmxHNHRSRHpZQWlBUDZvcmpaQURtZCtaV2JjZ1dWUDV6Z2RxUlJhY3p3eFlMWkhqZlJBS3dHdz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K - client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUVseGU3MHJUVEd3M3JxK0xjVS9XMmlpcCtYakpYd29LRVpBY1dEVlcwZnpvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFazlteHR6SVlrcm5oR2FDRWxsb01kNGNJekw1RUZWclExU0ZsSk0vK3F3U1hwcHZSL3VKVApFbE1wTmVBWStHUXVGMTVYbkU5R3NqTDh3aERpd2pxdUpnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= + client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrakNDQVRlZ0F3SUJBZ0lJQjlDWkxvMGhGRWN3Q2dZSUtvWkl6ajBFQXdJd0l6RWhNQjhHQTFVRUF3d1kKYXpOekxXTnNhV1Z1ZEMxallVQXhOalExTVRNMU5UUXhNQjRYRFRJeU1ESXhOekl5TURVME1Wb1hEVEl6TURJeApOekl5TURVME1Wb3dNREVYTUJVR0ExVUVDaE1PYzNsemRHVnRPbTFoYzNSbGNuTXhGVEFUQmdOVkJBTVRESE41CmMzUmxiVHBoWkcxcGJqQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJGbEpvaDUyalR3SzlnbGsKeW0zdldOdHpnU0lGem1IaFRuYmxycWFmaTh0dWYySzVkSnpSYnRmNTJXU1h4am00VlBIeVBDUEFIZjF5U3NmcwpXcWRmMGZ1alNEQkdNQTRHQTFVZER3RUIvd1FFQXdJRm9EQVRCZ05WSFNVRUREQUtCZ2dyQmdFRkJRY0RBakFmCkJnTlZIU01FR0RBV2dCU0JmQnpJNVRxWWYrUTRuS0xoN2dCMEVoZkl4VEFLQmdncWhrak9QUVFEQWdOSkFEQkcKQWlFQXNjeVIvVTlCSHBWOU0zRFRoR3RSZlcxSjBFSHZ1K09Td1VYYnpvSVNKQ0lDSVFDU0RXZ0c2Mjc4WlFmVgpvbVZWc25lU2hSbERQa3dtRFo4RXhoSmJaVUhNSlE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQpNSUlCZURDQ0FSMmdBd0lCQWdJQkFEQUtCZ2dxaGtqT1BRUURBakFqTVNFd0h3WURWUVFEREJock0zTXRZMnhwClpXNTBMV05oUURFMk5EVXhNelUxTkRFd0hoY05Nakl3TWpFM01qSXdOVFF4V2hjTk16SXdNakUxTWpJd05UUXgKV2pBak1TRXdId1lEVlFRRERCaHJNM010WTJ4cFpXNTBMV05oUURFMk5EVXhNelUxTkRFd1dUQVRCZ2NxaGtqTwpQUUlCQmdncWhrak9QUU1CQndOQ0FBUVY3dm54Y09YVGNTbTA5UW5NOWpuTmNuRkFWdk4rb25xOWkyMFF4UFdhCndHSkhKSmJickVrYTRvKzVERmFUbXhydGgxeE1Ob08wK0FMWHlKclg1WDM2bzBJd1FEQU9CZ05WSFE4QkFmOEUKQkFNQ0FxUXdEd1lEVlIwVEFRSC9CQVV3QXdFQi96QWRCZ05WSFE0RUZnUVVnWHdjeU9VNm1IL2tPSnlpNGU0QQpkQklYeU1Vd0NnWUlLb1pJemowRUF3SURTUUF3UmdJaEFOc2pDWWVrYURzWSs1QmpDZ08rUUVCa21GRWJIY1RGCkdScHAxcitSaWl0RUFpRUFyZnp0alM4MU9RWC8rZHhDcGVYaFkzUk5POHlSRmVaa2NETUZxdEVhWmMwPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== + client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU9lV1hSZmlucVFuNVFGUHk1ajEvYTlZMVhIWnpOaDgvZUdsZEh4VDBkQTJvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFV1VtaUhuYU5QQXIyQ1dUS2JlOVkyM09CSWdYT1llRk9kdVd1cHArTHkyNS9Zcmwwbk5GdQoxL25aWkpmR09iaFU4Zkk4SThBZC9YSkt4K3hhcDEvUit3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= diff --git a/local-k8s/local-k8s.sh b/local-k8s/local-k8s.sh index 5e12837..467a574 100755 --- a/local-k8s/local-k8s.sh +++ b/local-k8s/local-k8s.sh @@ -95,6 +95,7 @@ clean() { rm $WORKDIR/local-git/PUBLIC_KEY rm $FLUXDIR/.sops.yaml rm $CLUSTERDIR/flux-system/local-git-secret.yaml + ssh-keygen -R "[localhost]:2222" } start() {