resources.yaml

apiVersion: v1
kind: Namespace
metadata:
  name: kubeflow-extension
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: role-for-kubeflow-extension
rules:
  - apiGroups: [""] # "" indicates the core API group
    resources: ["namespaces"]
    verbs: ["get", "watch", "list"]
  - apiGroups: ["kubeflow.org"]
    resources: ["profiles"]
    verbs: ["get", "list"]
  - apiGroups: ["networking.istio.io"]
    resources: ["envoyfilters"]
    verbs: ["get", "list", "create"]
  - apiGroups: ["rbac.istio.io"]
    resources: ["servicerolebindings"]
    verbs: ["create", "get", "list", "delete"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: kubeflow-extension-default-rolebinding
roleRef:
  kind: ClusterRole
  name: role-for-kubeflow-extension
  apiGroup: rbac.authorization.k8s.io
subjects:
  - kind: ServiceAccount
    apiGroup: ""
    name: default
    namespace: kubeflow-extension
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: rb-all-sa_ns-kubeflow-extension
  namespace: kubeflow-extension
roleRef:
  kind: ClusterRole
  name: psp:vmware-system-privileged
  apiGroup: rbac.authorization.k8s.io
subjects:
  - kind: ServiceAccount
    apiGroup: ""
    name: default
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    rbac.authorization.kubeflow.org/aggregate-to-kubeflow-edit: "true"
  name: kubeflow-argo-access
rules:
  - apiGroups:
      - argoproj.io
    resources:
      - 'workflows'
    verbs:
      - get