[
https://issues.apache.org/jira/browse/AIRFLOW-2740?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16545467#comment-16545467
]
Ravi Kotecha commented on AIRFLOW-2740:
---------------------------------------
you could use ours as a template:
[https://github.com/ministryofjustice/analytics-platform-helm-charts/blob/8c589c7ec11409fad0ad34f221441abe3bd6255e/charts/airflow-k8s/templates/service-account.yml]
> Kubernetes RBAC policy required
> -------------------------------
>
> Key: AIRFLOW-2740
> URL: https://issues.apache.org/jira/browse/AIRFLOW-2740
> Project: Apache Airflow
> Issue Type: Bug
> Reporter: Jon Davies
> Priority: Major
>
> The Airflow Executor needs to ship with an example policy, something like:
> {code:java}
> kind: Role
> apiVersion: rbac.authorization.k8s.io/v1
> metadata:
> name: pod-reader
> rules:
> - apiGroups: [""] # "" indicates the core API group
> resources: ["pods"]
> verbs: ["create", "delete", "get", "watch", "list"]
> ---
> # This role binding allows "default" to read pods
> kind: RoleBinding
> apiVersion: rbac.authorization.k8s.io/v1
> metadata:
> name: read-pods
> subjects:
> - kind: ServiceAccount
> name: default # Name is case sensitive
> roleRef:
> kind: Role #this must be Role or ClusterRole
> name: pod-reader # this must match the name of the Role or ClusterRole you
> wish to bind to
> apiGroup: rbac.authorization.k8s.io
> {code}
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
