Change Details

In https://phabricator.wikimedia.org/T364389#10174265, we discussed the need to be able to create a Role/RoleBinding/ServiceAccount granting a specific `Deployment` the ability to create/delete/list/etc Pods. Given the lack of permissions for the `deploy` user to manage `Role` resources, it was suggested by @JMeybohm that we should - create a ClusterRole in `admin_ng` with the associated permissions - create a ServiceAccount and a RoleBinding, linking the ServiceAccount to the ClusterRole, in the chart However, the `deploy` role does not have permissions to manage`RoleBinding` resources as well, making this impossible. I'm creating this ticket to gather feedback as to whether we should grant the `deploy` user permission to create/delete `RoleBinding` resources as well.

In https://phabricator.wikimedia.org/T364389#10174265, we discussed the need to be able to create a Role/RoleBinding/ServiceAccount granting a specific `Deployment` the ability to create/delete/list/etc Pods. Given the lack of permissions for the `deploy` user to manage `Role` resources, it was suggested by @JMeybohm that we should - create a ClusterRole in `admin_ng` with the associated permissions - create a ServiceAccount and a RoleBinding, linking the ServiceAccount to the ClusterRole, in the chart However, the `deploy` role does not have permissions to manage`RoleBinding` resources as well, making this impossible. I'm creating this ticket to gather feedback as to whether we should grant the `deploy` user permission to create/delete `RoleBinding` (and maybe `Role` resources as well.

In https://phabricator.wikimedia.org/T364389#10174265, we discussed the need to be able to create a Role/RoleBinding/ServiceAccount granting a specific `Deployment` the ability to create/delete/list/etc Pods. Given the lack of permissions for the `deploy` user to manage `Role` resources, it was suggested by @JMeybohm that we should - create a ClusterRole in `admin_ng` with the associated permissions - create a ServiceAccount and a RoleBinding, linking the ServiceAccount to the ClusterRole, in the chart However, the `deploy` role does not have permissions to manage`RoleBinding` resources as well, making this impossible. I'm creating this ticket to gather feedback as to whether we should grant the `deploy` user permission to create/delete `RoleBinding` (and maybe `Role` resources as well.