<commit_before>{{- if .Values.rbacEnable }}
apiVersion: v1
kind: List
items:

### API Server ###

# TODO: if this is just for namespace lifecycle admission, move to a generic role
# the role for the apiserver 
- apiVersion: {{template "rbacApiVersion" . }}
  kind: ClusterRole
  metadata:
    name: "servicecatalog.k8s.io:apiserver"
  # this rule defined on the role for specifically the
  # namespace-lifecycle admission-controller
  rules:
  - apiGroups: [""]
    resources: ["namespaces"]
    verbs:     ["get", "list", "watch"]
# API-server service-account gets its own role
- apiVersion: {{template "rbacApiVersion" . }}
  kind: ClusterRoleBinding
  metadata:
    name: "servicecatalog.k8s.io:apiserver"
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: "servicecatalog.k8s.io:apiserver"
  subjects:
  - apiGroup: ""
    kind: ServiceAccount
    name: "{{ .Values.apiserver.serviceAccount }}"
    namespace: "{{ .Release.Namespace }}"
# apiserver gets the auth-delegator role to delegate auth decisions to
# the core apiserver
- apiVersion: {{template "rbacApiVersion" . }}
  kind: ClusterRoleBinding
  metadata:
    name: "servicecatalog.k8s.io:apiserver-auth-delegator"
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: system:auth-delegator
  subjects:
  - apiGroup: ""
    kind: ServiceAccount
    name: "{{ .Values.apiserver.serviceAccount }}"
    namespace: "{{ .Release.Namespace }}"
# apiserver gets the ability to read authentication. This allows it to
# read the specific configmap that has the requestheader-* entries to
# enable api aggregation
- apiVersion: {{template "rbacApiVersion" . }}
  kind: RoleBinding
  metadata:
    name: "servicecatalog.k8s.io:apiserver-authentication-reader"
    namespace: kube-system
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: Role
    name: extension-apiserver-authentication-reader
  subjects:
  - apiGroup: ""
    kind: ServiceAccount
    name: "{{ .Values.apiserver.serviceAccount }}"
    namespace: "{{ .Release.Namespace }}"

### Controller-Manager ###

# controller-manager role defines what access the service-catalog
# controller-manager needs to manage the resources of the
# service-catalog
- apiVersion: {{template "rbacApiVersion" . }}
  kind: ClusterRole
  metadata:
    name: "servicecatalog.k8s.io:controller-manager"
  rules:
  - apiGroups: [""]
    resources: ["events"]
    verbs:     ["create","patch","update"]
  # TODO: do not grant global access, limit to particular secrets referenced from servicebindings
  - apiGroups: [""]
    resources: ["secrets"]
    verbs:     ["get","create","delete"]
  - apiGroups: [""]
    resources: ["namespaces"]
    verbs:     ["get","list","watch"]
  # access to our service-catalog types
  - apiGroups: ["servicecatalog.k8s.io"]
    resources: ["clusterserviceclasses"]
    verbs:     ["get","list","watch","create","patch","update","delete"]
  - apiGroups: ["servicecatalog.k8s.io"]
    resources: ["clusterserviceplans"]
    verbs:     ["get","list","watch","create","patch","update","delete"]
  - apiGroups: ["servicecatalog.k8s.io"]
    resources: ["clusterservicebrokers","serviceinstances","servicebindings"]
    verbs:     ["get","list","watch"]
  - apiGroups: ["servicecatalog.k8s.io"]
    resources: ["clusterservicebrokers/status","serviceinstances/status","serviceinstances/reference","servicebindings/status"]
    verbs:     ["update"]
# give the controller-manager service account access to whats defined in its role.
- apiVersion: {{template "rbacApiVersion" . }}
  kind: ClusterRoleBinding
  metadata:
    name: "servicecatalog.k8s.io:controller-manager"
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: "servicecatalog.k8s.io:controller-manager"
  subjects:
  - apiGroup: ""
    kind: ServiceAccount
    name: "{{ .Values.controllerManager.serviceAccount }}"
    namespace: "{{ .Release.Namespace }}"

# This gives create/update access to an endpoint in kube-system for leader election
# TODO: use an object other than endpoints, and in the same namespace as the service catalog, not in kube-system
- apiVersion: {{template "rbacApiVersion" . }}
  kind: Role
  metadata:
    name: "servicecatalog.k8s.io:leader-locking-controller-manager"
    namespace: kube-system
  rules:
  - apiGroups: [""]
    resources: ["endpoints"]
    verbs:     ["create"]
  - apiGroups:     [""]
    resources:     ["endpoints"]
    resourceNames: ["service-catalog-controller-manager"]
    verbs:         ["get","update"]
- apiVersion: {{template "rbacApiVersion" . }}
  kind: RoleBinding
  metadata:
    name: service-catalog-controller-manager
    namespace: kube-system
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: Role
    name: "servicecatalog.k8s.io:leader-locking-controller-manager"
  subjects:
  - apiGroup: ""
    kind: ServiceAccount
    name: "{{ .Values.controllerManager.serviceAccount }}"
    namespace: "{{ .Release.Namespace }}"
{{end}}
<commit_msg>Grant controller abilit to update service/plan status (#1532)<commit_after>{{- if .Values.rbacEnable }}
apiVersion: v1
kind: List
items:

### API Server ###

# TODO: if this is just for namespace lifecycle admission, move to a generic role
# the role for the apiserver 
- apiVersion: {{template "rbacApiVersion" . }}
  kind: ClusterRole
  metadata:
    name: "servicecatalog.k8s.io:apiserver"
  # this rule defined on the role for specifically the
  # namespace-lifecycle admission-controller
  rules:
  - apiGroups: [""]
    resources: ["namespaces"]
    verbs:     ["get", "list", "watch"]
# API-server service-account gets its own role
- apiVersion: {{template "rbacApiVersion" . }}
  kind: ClusterRoleBinding
  metadata:
    name: "servicecatalog.k8s.io:apiserver"
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: "servicecatalog.k8s.io:apiserver"
  subjects:
  - apiGroup: ""
    kind: ServiceAccount
    name: "{{ .Values.apiserver.serviceAccount }}"
    namespace: "{{ .Release.Namespace }}"
# apiserver gets the auth-delegator role to delegate auth decisions to
# the core apiserver
- apiVersion: {{template "rbacApiVersion" . }}
  kind: ClusterRoleBinding
  metadata:
    name: "servicecatalog.k8s.io:apiserver-auth-delegator"
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: system:auth-delegator
  subjects:
  - apiGroup: ""
    kind: ServiceAccount
    name: "{{ .Values.apiserver.serviceAccount }}"
    namespace: "{{ .Release.Namespace }}"
# apiserver gets the ability to read authentication. This allows it to
# read the specific configmap that has the requestheader-* entries to
# enable api aggregation
- apiVersion: {{template "rbacApiVersion" . }}
  kind: RoleBinding
  metadata:
    name: "servicecatalog.k8s.io:apiserver-authentication-reader"
    namespace: kube-system
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: Role
    name: extension-apiserver-authentication-reader
  subjects:
  - apiGroup: ""
    kind: ServiceAccount
    name: "{{ .Values.apiserver.serviceAccount }}"
    namespace: "{{ .Release.Namespace }}"

### Controller-Manager ###

# controller-manager role defines what access the service-catalog
# controller-manager needs to manage the resources of the
# service-catalog
- apiVersion: {{template "rbacApiVersion" . }}
  kind: ClusterRole
  metadata:
    name: "servicecatalog.k8s.io:controller-manager"
  rules:
  - apiGroups: [""]
    resources: ["events"]
    verbs:     ["create","patch","update"]
  # TODO: do not grant global access, limit to particular secrets referenced from servicebindings
  - apiGroups: [""]
    resources: ["secrets"]
    verbs:     ["get","create","delete"]
  - apiGroups: [""]
    resources: ["namespaces"]
    verbs:     ["get","list","watch"]
  # access to our service-catalog types
  - apiGroups: ["servicecatalog.k8s.io"]
    resources: ["clusterserviceclasses"]
    verbs:     ["get","list","watch","create","patch","update","delete"]
  - apiGroups: ["servicecatalog.k8s.io"]
    resources: ["clusterserviceplans"]
    verbs:     ["get","list","watch","create","patch","update","delete"]
  - apiGroups: ["servicecatalog.k8s.io"]
    resources: ["clusterservicebrokers","serviceinstances","servicebindings"]
    verbs:     ["get","list","watch"]
  - apiGroups: ["servicecatalog.k8s.io"]
    resources: ["clusterservicebrokers/status","clusterserviceclasses/status","clusterserviceplans/status","serviceinstances/status","serviceinstances/reference","servicebindings/status"]
    verbs:     ["update"]
# give the controller-manager service account access to whats defined in its role.
- apiVersion: {{template "rbacApiVersion" . }}
  kind: ClusterRoleBinding
  metadata:
    name: "servicecatalog.k8s.io:controller-manager"
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: "servicecatalog.k8s.io:controller-manager"
  subjects:
  - apiGroup: ""
    kind: ServiceAccount
    name: "{{ .Values.controllerManager.serviceAccount }}"
    namespace: "{{ .Release.Namespace }}"

# This gives create/update access to an endpoint in kube-system for leader election
# TODO: use an object other than endpoints, and in the same namespace as the service catalog, not in kube-system
- apiVersion: {{template "rbacApiVersion" . }}
  kind: Role
  metadata:
    name: "servicecatalog.k8s.io:leader-locking-controller-manager"
    namespace: kube-system
  rules:
  - apiGroups: [""]
    resources: ["endpoints"]
    verbs:     ["create"]
  - apiGroups:     [""]
    resources:     ["endpoints"]
    resourceNames: ["service-catalog-controller-manager"]
    verbs:         ["get","update"]
- apiVersion: {{template "rbacApiVersion" . }}
  kind: RoleBinding
  metadata:
    name: service-catalog-controller-manager
    namespace: kube-system
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: Role
    name: "servicecatalog.k8s.io:leader-locking-controller-manager"
  subjects:
  - apiGroup: ""
    kind: ServiceAccount
    name: "{{ .Values.controllerManager.serviceAccount }}"
    namespace: "{{ .Release.Namespace }}"
{{end}}

{'fraction_non_alphanumeric': 0.1342693296420803, 'fraction_numerical': 0.004350405378683014, 'mean_word_length': 3.9656357388316152, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '800545', 'n_tokens_mistral': 3098, 'n_tokens_neox': 3073, 'n_words': 743}