feat(ql3): establish 3.0 incubation baseline

deploy/kubernetes/ql3-worker/credential-admin/kustomization.yaml

@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - service-account.yaml
+  - stage-role.yaml
+  - stage-role-binding.yaml
+  - target-role.yaml
+  - target-role-binding.yaml
+  - token-issuer-role.yaml
+  - token-issuer-role-binding.yaml

deploy/kubernetes/ql3-worker/credential-admin/service-account.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: ql3-worker-credential-admin
+  namespace: qinglong3-worker-credential-staging
+automountServiceAccountToken: false

deploy/kubernetes/ql3-worker/credential-admin/stage-role-binding.yaml

@@ -0,0 +1,13 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: ql3-worker-credential-stage-admin
+  namespace: qinglong3-worker-credential-staging
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: ql3-worker-credential-stage-admin
+subjects:
+  - kind: ServiceAccount
+    name: ql3-worker-credential-admin
+    namespace: qinglong3-worker-credential-staging

deploy/kubernetes/ql3-worker/credential-admin/stage-role.yaml

@@ -0,0 +1,15 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: ql3-worker-credential-stage-admin
+  namespace: qinglong3-worker-credential-staging
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+    verbs:
+      - get
+      - list
+      - create
+      - delete

deploy/kubernetes/ql3-worker/credential-admin/target-role-binding.yaml

@@ -0,0 +1,13 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: ql3-worker-credential-target-admin
+  namespace: qinglong3-worker
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: ql3-worker-credential-target-admin
+subjects:
+  - kind: ServiceAccount
+    name: ql3-worker-credential-admin
+    namespace: qinglong3-worker-credential-staging

deploy/kubernetes/ql3-worker/credential-admin/target-role.yaml

@@ -0,0 +1,24 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: ql3-worker-credential-target-admin
+  namespace: qinglong3-worker
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+    resourceNames:
+      - ql3-worker-credential
+    verbs:
+      - get
+      - update
+  - apiGroups:
+      - apps
+    resources:
+      - deployments
+    resourceNames:
+      - ql3-worker
+    verbs:
+      - get
+      - update

deploy/kubernetes/ql3-worker/credential-admin/token-issuer-role-binding.yaml

@@ -0,0 +1,13 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: ql3-worker-credential-token-issuer
+  namespace: qinglong3-worker-credential-staging
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: ql3-worker-credential-token-issuer
+subjects:
+  - apiGroup: rbac.authorization.k8s.io
+    kind: Group
+    name: qinglong:worker-credential-operators

deploy/kubernetes/ql3-worker/credential-admin/token-issuer-role.yaml

@@ -0,0 +1,14 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: ql3-worker-credential-token-issuer
+  namespace: qinglong3-worker-credential-staging
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - serviceaccounts/token
+    resourceNames:
+      - ql3-worker-credential-admin
+    verbs:
+      - create