DPTP-4755: Add several ServiceAccounts to core-ci

clusters/core-ci/assets/admin_ci-images-mirror.yaml

@@ -0,0 +1,45 @@
+kind: ServiceAccount
+apiVersion: v1
+metadata:
+  name: ci-images-mirror
+  namespace: ci
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: ci-images-mirror
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: ci-images-mirror
+subjects:
+- kind: ServiceAccount
+  name: ci-images-mirror
+  namespace: ci
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: ci-images-mirror
+rules:
+- apiGroups:
+  - image.openshift.io
+  resources:
+  - '*'
+  verbs:
+  - list
+  - watch
+- apiGroups:
+  - "coordination.k8s.io"
+  resources:
+  - leases
+  verbs:
+  - create
+  - get
+  - update
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create

clusters/core-ci/assets/admin_promotion-quay-tagger.yaml

@@ -0,0 +1,40 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: promotion-quay-tagger
+  namespace: ci
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: imagestream-tagger
+rules:
+- apiGroups:
+  - image.openshift.io
+  resources:
+  - imagestreamtags
+  - imagestreams
+  verbs:
+  - create
+  - update
+  - get
+- apiGroups:
+  - ""
+  resources:
+  - namespaces
+  verbs:
+  - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: promotion-quay-tagger
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: imagestream-tagger
+subjects:
+- kind: ServiceAccount
+  name: promotion-quay-tagger
+  namespace: ci

clusters/core-ci/assets/pj-rehearse.yaml

@@ -0,0 +1,51 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: pj-rehearse
+  namespace: ci
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: pj-rehearse
+  namespace: ci
+rules:
+- apiGroups:
+  - prow.k8s.io
+  resources:
+  - prowjobs
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+- apiGroups:
+  - ci.openshift.io
+  resources:
+  - testimagestreamtagimports
+  verbs:
+  - create
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  verbs:
+  - get
+  - create
+  - update
+  - delete
+  - deletecollection
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: pj-rehearse
+  namespace: ci
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: pj-rehearse
+subjects:
+- kind: ServiceAccount
+  name: pj-rehearse

core-services/ci-secret-generator/_config.yaml

@@ -46,6 +46,7 @@
   params:
     cluster:
     - app.ci
+    - core-ci
     service_account:
     - deck
     - sinker