move stage-editor stuff to ontime-operator

infrastructure/ontime-operator/cluster-role-binding.yaml

@@ -0,0 +1,34 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: edit-namespaces
+rules:
+- apiGroups: [""]
+  resources: ["namespaces"]
+  verbs: ["create", "get", "list", "watch", "update", "patch", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: edit-stages-clusterrolebinding
+subjects:
+- kind: ServiceAccount
+  name: stage-editor
+  namespace: ontime-operator-system
+roleRef:
+  kind: ClusterRole
+  name: ontime-operator-stage-editor-role
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: edit-namespaces-clusterrolebinding
+subjects:
+- kind: ServiceAccount
+  name: stage-editor
+  namespace: ontime-operator-system
+roleRef:
+  kind: ClusterRole
+  name: edit-namespaces
+  apiGroup: rbac.authorization.k8s.io

infrastructure/ontime-operator/kustomization.yaml

@@ -1,4 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-    - ./deploy.yaml
+    - ./deploy.yaml
+    - ./namepsace-prefix-policy.yaml
+    - ./service-account.yaml

infrastructure/ontime-operator/namespace-prefix-policy.yaml

@@ -0,0 +1,32 @@
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicy
+metadata:
+  name: "force-ns-prefix-for-stage-editor"
+spec:
+  failurePolicy: Fail
+  matchConstraints:
+    resourceRules:
+    - apiGroups:   [""]
+      apiVersions: ["v1"]
+      operations:  ["CREATE", "UPDATE"]
+      resources:   ["namespaces"]
+  matchConditions:
+    - name: 'only-stage-editor'
+      expression: "request.userInfo.username == 'system:serviceaccount:ontime-operator-system:stage-editor'"
+  validations:
+    - expression: "object.metadata.name.startsWith('team-')"
+      message: "All namespaces managed by stage-editor must start with 'team-'"
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicyBinding
+metadata:
+  name: "force-ns-prefix-for-stage-editor-binding"
+spec:
+  policyName: "force-ns-prefix-for-stage-editor"
+  validationActions: [Deny]
+  matchResources:
+    resourceRules:
+    - apiGroups:   [""]
+      apiVersions: ["v1"]
+      operations:  ["CREATE", "UPDATE"]
+      resources:   ["namespaces"]

infrastructure/ontime-operator/service-account.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: stage-editor
+  namespace: ontime-operator-system