From adb08191022b859f24a76fa45c394207f8d40608 Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <daniel@infisical.com>
Date: Fri, 6 Dec 2024 02:06:35 +0400
Subject: [PATCH] Added RBAC

---
 .../rbac/infisicalpushsecret_editor_role.yaml | 27 +++++++++++++++++++
 .../rbac/infisicalpushsecret_viewer_role.yaml | 23 ++++++++++++++++
 2 files changed, 50 insertions(+)
 create mode 100644 k8-operator/config/rbac/infisicalpushsecret_editor_role.yaml
 create mode 100644 k8-operator/config/rbac/infisicalpushsecret_viewer_role.yaml

diff --git a/k8-operator/config/rbac/infisicalpushsecret_editor_role.yaml b/k8-operator/config/rbac/infisicalpushsecret_editor_role.yaml
new file mode 100644
index 000000000..9344e17c5
--- /dev/null
+++ b/k8-operator/config/rbac/infisicalpushsecret_editor_role.yaml
@@ -0,0 +1,27 @@
+# permissions for end users to edit infisicalpushsecrets.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/name: k8-operator
+    app.kubernetes.io/managed-by: kustomize
+  name: infisicalpushsecret-editor-role
+rules:
+  - apiGroups:
+      - secrets.infisical.com
+    resources:
+      - infisicalpushsecrets
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+  - apiGroups:
+      - secrets.infisical.com
+    resources:
+      - infisicalpushsecrets/status
+    verbs:
+      - get
diff --git a/k8-operator/config/rbac/infisicalpushsecret_viewer_role.yaml b/k8-operator/config/rbac/infisicalpushsecret_viewer_role.yaml
new file mode 100644
index 000000000..ff4df91cc
--- /dev/null
+++ b/k8-operator/config/rbac/infisicalpushsecret_viewer_role.yaml
@@ -0,0 +1,23 @@
+# permissions for end users to view infisicalpushsecrets.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/name: k8-operator
+    app.kubernetes.io/managed-by: kustomize
+  name: infisicalpushsecret-viewer-role
+rules:
+  - apiGroups:
+      - secrets.infisical.com
+    resources:
+      - infisicalpushsecrets
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - secrets.infisical.com
+    resources:
+      - infisicalpushsecrets/status
+    verbs:
+      - get