Limit access for apps releases

Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>

clusters/staging/tenants/podinfo.yaml

@@ -4,3 +4,29 @@ metadata:
   name: podinfo
   labels:
     toolkit.fluxcd.io/tenant: dev-team
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    toolkit.fluxcd.io/tenant: dev-team
+  name: flux
+  namespace: podinfo
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  labels:
+    toolkit.fluxcd.io/tenant: dev-team
+  name: flux
+  namespace: podinfo
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  # This binding limits the access to the namespace
+  # being a RoleBinding instead of a ClusterRoleBinding
+  name: cluster-admin
+subjects:
+  - kind: ServiceAccount
+    name: flux
+    namespace: podinfo

hub/staging.yaml

@@ -49,3 +49,6 @@ spec:
           value:
             secretRef:
               name: cluster-kubeconfig
+        - op: add
+          path: /spec/serviceAccountName
+          value: flux