rbac.yaml

#
# admin
#
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: wego-admin-cluster-role
roleRef:
  kind: ClusterRole
  name: wego-admin-cluster-role  # created by default.
  apiGroup: rbac.authorization.k8s.io
subjects:
  - kind: User
    name: admin@test.invalid
    apiGroup: rbac.authorization.k8s.io
---
#
# readonly
#
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: wego-readonly-cluster-role
roleRef:
  kind: ClusterRole
  name: wego-readonly-role
  apiGroup: rbac.authorization.k8s.io
subjects:
  - kind: User
    name: ro@test.invalid
    apiGroup: rbac.authorization.k8s.io
---
#
# namespace admin
#
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: wego-admin-apps-rolebinding
  namespace: apps
subjects:
  - kind: User
    name: admin-apps@test.invalid
    apiGroup: rbac.authorization.k8s.io
roleRef:
  # Use the cluster role to set rules, just bind them in the team-a namespace
  kind: ClusterRole
  name: wego-admin-cluster-role
  apiGroup: rbac.authorization.k8s.io

---
#
# namespace readonly
#
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: wego-ro-apps-rolebinding
  namespace: apps
roleRef:
  kind: ClusterRole
  name: wego-readonly-role
  apiGroup: rbac.authorization.k8s.io
subjects:
  - kind: User
    name: ro-apps@test.invalid
    apiGroup: rbac.authorization.k8s.io