readonly.yaml

yaml

  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: digitalocean:read-only
  rules:
  - apiGroups: [""]
    resources:
    - configmaps
    - endpoints
    - nodes
    - persistentvolumeclaims
    - persistentvolumes
    - pods
    - pods/log
    - pods/status
    - replicationcontrollers
    - replicationcontrollers/scale
    - serviceaccounts
    - services
    - services/status
    verbs: ["get", "list", "watch"]
  - apiGroups: ["apps"]
    resources:
    - daemonsets
    - deployments
    - deployments/scale
    - replicasets
    - replicasets/scale
    - statefulsets
    - statefulsets/scale
    verbs: ["get", "list", "watch"]
  - apiGroups: ["batch"]
    resources:
    - cronjobs
    - jobs
    verbs: ["get", "list", "watch"]
  - apiGroups: ["extensions"]
    resources:
    - daemonsets
    - deployments
    - deployments/scale
    - ingresses
    - replicasets
    - replicasets/scale
    verbs: ["get", "list", "watch"]
  - apiGroups: ["autoscaling"]
    resources:
    - horizontalpodautoscalers
    verbs: ["get", "list", "watch"]
  - apiGroups: ["networking.k8s.io"]
    resources:
    - ingresses
    - networkpolicies
    verbs: ["get", "list", "watch"]
  - apiGroups: ["policy"]
    resources:
    - poddisruptionbudgets
    verbs: ["get", "list", "watch"]
  - apiGroups: ["rbac.authorization.k8s.io"]
    resources:
    - clusterroles
    - clusterrolebindings
    - roles
    - rolebindings
    verbs: ["get", "list", "watch"]
  ---
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: digitalocean:read-only-binding
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: digitalocean:read-only
  subjects:
  - apiGroup: rbac.authorization.k8s.io
    kind: Group
    name: digitalocean:read-only-users