284313f908
Some checks are pending
Bidi Control Character Guard / bidi-control-guard (push) Waiting to run
Circular Dependency Check / Check for new circular dependencies (push) Waiting to run
Citus Migration Smoke / Combined migrations on single-node Citus (push) Waiting to run
E2E Fresh Install Tests / fresh-install-e2e (push) Waiting to run
ext-v2 guardrails / Run ext-v2 guard and ESLint (push) Waiting to run
Integration Tests / Check for relevant changes (push) Waiting to run
Integration Tests / ${{ (github.event_name == 'schedule' || github.event.inputs.suite == 'full') && 'Full integration suite' || 'Tier-1 integration subset' }} (push) Blocked by required conditions
Mobile checks / Mobile lint + typecheck (push) Waiting to run
Mobile checks / Mobile unit tests (push) Waiting to run
Mobile checks / Mobile dependency audit (report) (push) Waiting to run
Mobile checks / Mobile reproducibility checks (push) Waiting to run
Secrets guard (env backups) / Ensure no tracked env backup files (push) Waiting to run
Temporal Readiness / fast-readiness (push) Waiting to run
Temporal Readiness / docker-parity (push) Waiting to run
TypeScript Type Check / Nx affected typecheck (push) Waiting to run
Unit Tests / Skipped-test budget (push) Waiting to run
Unit Tests / Nx affected unit tests (push) Waiting to run
Unit Tests / Server unit coverage (informational) (push) Waiting to run
Validate Tenant Management Schema / Check for relevant changes (push) Waiting to run
Validate Tenant Management Schema / Validate Tenant Management Schema (push) Blocked by required conditions
EE Workflows Build Guard / ee-workflows-build-guard (push) Waiting to run
Excluded: .git, node_modules, secrets/, compose.env, assemblyscript tgz Source: /opt/alga-psa on psa.joliet.tech
69 lines
2.3 KiB
YAML
69 lines
2.3 KiB
YAML
{{- $replicationEnabled := default false .Values.portalDomain.secretReplicationEnabled -}}
|
|
{{- $gatewayNamespace := default "" .Values.portalDomain.gatewayNamespace -}}
|
|
{{- $certificateNamespace := default "" .Values.portalDomain.certificateNamespace -}}
|
|
{{- if and .Values.enabled $replicationEnabled }}
|
|
{{- if $gatewayNamespace }}
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: {{ include "temporal-worker.fullname" . }}-secret-sync
|
|
namespace: {{ $gatewayNamespace }}
|
|
labels:
|
|
{{- include "temporal-worker.labels" . | nindent 4 }}
|
|
app.kubernetes.io/component: temporal-worker
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["secrets"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: {{ include "temporal-worker.fullname" . }}-secret-sync
|
|
namespace: {{ $gatewayNamespace }}
|
|
labels:
|
|
{{- include "temporal-worker.labels" . | nindent 4 }}
|
|
app.kubernetes.io/component: temporal-worker
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: {{ include "temporal-worker.fullname" . }}-secret-sync
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: {{ include "temporal-worker.serviceAccountName" . }}
|
|
namespace: {{ include "temporal-worker.namespace" . }}
|
|
{{- end }}
|
|
{{- if and $certificateNamespace (ne $certificateNamespace $gatewayNamespace) }}
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: {{ include "temporal-worker.fullname" . }}-secret-reader
|
|
namespace: {{ $certificateNamespace }}
|
|
labels:
|
|
{{- include "temporal-worker.labels" . | nindent 4 }}
|
|
app.kubernetes.io/component: temporal-worker
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["secrets"]
|
|
verbs: ["get", "list", "watch"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: {{ include "temporal-worker.fullname" . }}-secret-reader
|
|
namespace: {{ $certificateNamespace }}
|
|
labels:
|
|
{{- include "temporal-worker.labels" . | nindent 4 }}
|
|
app.kubernetes.io/component: temporal-worker
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: {{ include "temporal-worker.fullname" . }}-secret-reader
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: {{ include "temporal-worker.serviceAccountName" . }}
|
|
namespace: {{ include "temporal-worker.namespace" . }}
|
|
{{- end }}
|
|
{{- end }}
|