mirrors/pikasTech-HWLAB
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: grant G14 reconciler scoped RBAC

Browse Source
This commit is contained in:
Codex
2026-05-25 13:28:28 +08:00
parent ed49b98486
commit 3b5f257410
1 changed files with 19 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/g14-gitops-render.mjs
+19 -4
View File
@@ -790,6 +790,21 @@ function tektonRbac() {
items: [
{ apiVersion: "v1", kind: "Namespace", metadata: { name: "hwlab-ci" } },
{ apiVersion: "v1", kind: "ServiceAccount", metadata: { name: "hwlab-tekton-runner", namespace: "hwlab-ci" } },
{
apiVersion: "rbac.authorization.k8s.io/v1",
kind: "Role",
metadata: { name: "hwlab-g14-control-plane-reconciler", namespace: "hwlab-dev" },
rules: [
{ apiGroups: ["rbac.authorization.k8s.io"], resources: ["roles", "rolebindings"], verbs: ["get", "patch", "create"] }
]
},
{
apiVersion: "rbac.authorization.k8s.io/v1",
kind: "RoleBinding",
metadata: { name: "hwlab-g14-control-plane-reconciler", namespace: "hwlab-dev" },
subjects: [{ kind: "ServiceAccount", name: "hwlab-tekton-runner", namespace: "hwlab-ci" }],
roleRef: { apiGroup: "rbac.authorization.k8s.io", kind: "Role", name: "hwlab-g14-control-plane-reconciler" }
},
{
apiVersion: "rbac.authorization.k8s.io/v1",
kind: "Role",
@@ -813,10 +828,10 @@ function tektonRbac() {
metadata: { name: "hwlab-tekton-pipelinerun-writer", namespace: "hwlab-ci" },
rules: [
{ apiGroups: ["tekton.dev"], resources: ["pipelineruns"], verbs: ["get", "list", "create"] },
{ apiGroups: ["tekton.dev"], resources: ["pipelines"], verbs: ["get", "patch"] },
{ apiGroups: ["batch"], resources: ["cronjobs"], verbs: ["get", "patch"] },
{ apiGroups: ["rbac.authorization.k8s.io"], resources: ["roles", "rolebindings"], verbs: ["get", "patch"] },
{ apiGroups: [""], resources: ["serviceaccounts"], verbs: ["get", "patch"] }
{ apiGroups: ["tekton.dev"], resources: ["pipelines"], verbs: ["get", "patch", "create"] },
{ apiGroups: ["batch"], resources: ["cronjobs"], verbs: ["get", "patch", "create"] },
{ apiGroups: ["rbac.authorization.k8s.io"], resources: ["roles", "rolebindings"], verbs: ["get", "patch", "create"] },
{ apiGroups: [""], resources: ["serviceaccounts"], verbs: ["get", "patch", "create"] }
]
},
{