# ── 沙箱 lane RBAC(k8s+kata;五动词)────────────────────────────────
apiVersion: v1
kind: ServiceAccount
metadata:
  name: sema-runner
  namespace: {{ .Values.sandbox.namespace }}
---
apiVersion: v1
kind: Secret
metadata:
  name: sema-runner-token
  namespace: {{ .Values.sandbox.namespace }}
  annotations:
    kubernetes.io/service-account.name: sema-runner
type: kubernetes.io/service-account-token
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: sema-runner
  namespace: {{ .Values.sandbox.namespace }}
rules:
  - apiGroups: [""]
    resources: [pods]
    verbs: [get, list, watch, create, delete]
  - apiGroups: [""]
    resources: [pods/exec, pods/attach]
    verbs: [create, get]
  - apiGroups: [""]
    resources: [pods/log]
    verbs: [get]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: sema-runner
  namespace: {{ .Values.sandbox.namespace }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: sema-runner
subjects:
  - kind: ServiceAccount
    name: sema-runner
    namespace: {{ .Values.sandbox.namespace }}