Generic Sensu Namespace RBAC Configuration

namespace-RBAC-setup.yaml

---
type: Namespace
api_version: core/v2
metadata: {}
spec:
  name: <<namespace>>
---
type: Role
api_version: core/v2
metadata:
  name: <<namespace>>-admin
  namespace: <<namespace>>
spec:
  rules:
  - resource_names: null
    resources:
    - '*'
    verbs:
    - '*'
---
type: Role
api_version: core/v2
metadata:
  name: <<namespace>>-operator
  namespace: <<namespace>>
spec:
  rules:
  - resource_names: null
    resources:
    - assets
    - checks
    - entities
    - events
    - extensions
    - filters
    - handlers
    - hooks
    - mutators
    - silenced
    verbs:
    - '*'
  - resource_names: null
    resources:
    - rolebindings
    - roles
    verbs:
    - get
    - list
---
type: Role
api_version: core/v2
metadata:
  name: <<namespace>>-viewer
  namespace: <<namespace>>
spec:
  rules:
  - resource_names: null
    resources:
    - '*'
    verbs:
    - get
    - list
---
type: RoleBinding
api_version: core/v2
metadata:
  name: ldap:<<namespace>>-admins
  namespace: <<namespace>>
spec:
  role_ref:
    name: <<namespace>>-admin
    type: Role
  subjects:
  - name: ldap:<<namespace>>-admins
    type: Group
  - name: <<namespace>>-admins
    type: Group
---
type: RoleBinding
api_version: core/v2
metadata:
  name: ldap:<<namespace>>-operators
  namespace: <<namespace>>
spec:
  role_ref:
    name: <<namespace>>-operator
    type: Role
  subjects:
  - name: ldap:<<namespace>>-operators
    type: Group
  - name: <<namespace>>-operators
    type: Group
---
type: RoleBinding
api_version: core/v2
metadata:
  name: ldap:<<namespace>>-viewers
  namespace: <<namespace>>
spec:
  role_ref:
    name: <<namespace>>-viewer
    type: Role
  subjects:
  - name: ldap:<<namespace>>-viewers
    type: Group
  - name: <<namespace>>-viewers
    type: Group