kubesaw-admins.yaml

clusters:
  host:
    api: https://api.dummy-host.openshiftapps.com:6443
  members:
  - api: https://api.dummy-m1.openshiftapps.com:6443
    name: member-1
  - api: https://api.dummy-m2.openshiftapps.com:6443
    name: member-2
  - api: https://api.dummy-m3.openshiftapps.com:6443
    name: member-3
    separateKustomizeComponent: true

defaultServiceAccountsNamespace:
  host: host-sre-namespace
  member: member-sre-namespace

serviceAccounts:

- name: first-admin
  host:
    roleBindings:
    - namespace: toolchain-host-operator
      roles:
      - restart-deployment
      - approve-user
      - view-secrets
      - deactivate-user
      - ban-user
      - promote-user
      - disable-user
      - retarget-user
      - gdpr-delete
      - create-social-event
      - add-space-users
      clusterRoles:
      - view
  member:
    roleBindings:
    - namespace: toolchain-member-operator
      roles:
      - restart-deployment
      - view-secrets
      clusterRoles:
      - view

- name: second-admin
  host:
    roleBindings:
    - namespace: toolchain-host-operator
      roles:
      - approve-user
      - view-secrets
      - deactivate-user
      - ban-user
      - promote-user
      - disable-user
      - retarget-user
      - gdpr-delete
      - restart-deployment
      - create-social-event
      - add-space-users
      clusterRoles:
      - view
  member:
    roleBindings:
    - namespace: toolchain-member-operator
      roles:
      - restart-deployment
      - view-secrets
      clusterRoles:
      - view

- name: viewer
  host:
    roleBindings:
    - namespace: toolchain-host-operator
      clusterRoles:
      - view
  member:
    roleBindings:
    - namespace: toolchain-member-operator
      clusterRoles:
      - view

users:
- name: standard-user-admin
  id:
  - 123456
  - abc1234
  groups:
  - crtadmin-users-view
  - inspect-pods
  host:
    roleBindings:
    - namespace: toolchain-host-operator
      roles:
      - edit-secrets
      clusterRoles:
      - view
    - namespace: openshift-customer-monitoring
      clusterRoles:
      - view
    - namespace: openshift-logging
      clusterRoles:
      - view
  member:
    roleBindings:
    - namespace: toolchain-member-operator
      roles:
      - edit-secrets
      clusterRoles:
      - view
    - namespace: crw
      roles:
      - view-secrets
      clusterRoles:
      - view
    - namespace: openshift-logging
      clusterRoles:
      - view

- name: standard-user-viewer
  id:
  - 987654
  groups:
  - crtadmin-users-view
  - kubesaw-team
  host:
    roleBindings:
    - namespace: toolchain-host-operator
      clusterRoles:
      - view
  member:
    roleBindings:
    - namespace: toolchain-member-operator
      clusterRoles:
      - view

- name: other-component-admin
  id:
  - 561234287
  - f:528d:some-admin
  member:
    roleBindings:
    - namespace: some-component
      clusterRoles:
      - edit
      - approve-operator-update # needs to be created separately
    clusterRoleBindings:
      clusterRoles:
      - list-operators-group # needs to be created separately

- name: other-component-viewer
  id:
  - 5412345
  member:
    roleBindings:
    - namespace: first-component
      clusterRoles:
      - view
    - namespace: second-component
      clusterRoles:
      - view

- name: user-in-all-clusters
  id:
  - 1234567890
  allClusters: true

- name: editor-not-included-in-member-3
  id:
  - 5412345
  selector:
    skipMembers:
    - member-3
  member:
    roleBindings:
    - namespace: first-component
      clusterRoles:
      - edit
    - namespace: second-component
      clusterRoles:
      - edit