++

apps/processing/base/kustomization.yaml

@@ -4,6 +4,7 @@ kind: Kustomization
 namespace: processing
 resources:
   - namespace.yaml
+  - rbac.yaml
   - api.yaml
   - engine-low.yaml
   - engine.yaml

apps/processing/base/rbac.yaml

@@ -0,0 +1,33 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: processing-jobs
+  namespace: processing
+rules:
+  - apiGroups:
+      - batch
+    resources:
+      - jobs
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: processing-jobs
+  namespace: processing
+subjects:
+  - kind: ServiceAccount
+    name: processing-vault
+    namespace: processing
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: processing-jobs