Add cluster role and binding for viewing ClusterWorkloadResourceMappi…

…ng for any authenticated subject (#1175)

Signed-off-by: Pavel Macík <[email protected]>

config/rbac/clusterworkloadresourcemappings_viewer_role.yaml

@@ -0,0 +1,16 @@
+# permissions for end users to view bindablekinds.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    rbac.authorization.k8s.io/aggregate-to-view: "true"
+  name: clusterworkloadresourcemappings-viewer-role
+rules:
+- apiGroups:
+  - servicebinding.io
+  resources:
+  - clusterworkloadresourcemappings
+  verbs:
+  - get
+  - list
+  - watch

config/rbac/clusterworkloadresourcemappings_viewer_rolebinding.yaml

@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: clusterworkloadresourcemappings-viewer-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: service-binding-clusterworkloadresourcemappings-viewer-role
+subjects:
+  - kind: Group
+    name: system:authenticated
+    apiGroup: rbac.authorization.k8s.io

config/rbac/kustomization.yaml

@@ -8,6 +8,8 @@ resources:
 - servicebinding_viewer_role.yaml
 - bindablekinds_viewer_role.yaml
 - bindablekinds_viewer_rolebinding.yaml
+- clusterworkloadresourcemappings_viewer_role.yaml
+- clusterworkloadresourcemappings_viewer_rolebinding.yaml
 - servicebinding_controller_role.yaml
 - servicebinding_controller_rolebinding.yaml
 # operators supproted out of the box