Squashed 'acm-hub-bootstrap/' content from commit aea23ee

git-subtree-dir: acm-hub-bootstrap
git-subtree-split: aea23ee88fafd5cab0e2d9189f872159c5f16b8e

components/policies/gitops/base/manifests/gitops-subscription/base/cluster-admin-rolebinding.yaml

@@ -0,0 +1,12 @@
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: argocd-application-controller-cluster-admin
+subjects:
+  - kind: ServiceAccount
+    name: openshift-gitops-argocd-application-controller
+    namespace: openshift-gitops
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin

components/policies/gitops/base/manifests/gitops-subscription/base/gitops-controller-rbac.yaml

@@ -0,0 +1,39 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  annotations:
+    rbac.authorization.kubernetes.io/autoupdate: "true"
+  name: gitops-controller
+aggregationRule:
+  clusterRoleSelectors:
+  - matchLabels:
+      gitops/aggregate-to-controller: "true"
+rules: []
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: gitops-controller-admin
+  labels:
+    gitops/aggregate-to-controller: "true"
+aggregationRule:
+  clusterRoleSelectors:
+  - matchLabels:
+      rbac.authorization.k8s.io/aggregate-to-admin: "true"
+rules: []
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: gitops-controller-view
+  labels:
+    gitops/aggregate-to-controller: "true"
+rules:
+- apiGroups:
+  - '*'
+  resources:
+  - '*'
+  verbs:
+  - get
+  - list
+  - watch

components/policies/gitops/base/manifests/gitops-subscription/base/gitops-server-rbac.yaml

@@ -0,0 +1,53 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: gitops-server
+rules:
+- verbs:
+    - get
+    - patch
+    - delete
+  apiGroups:
+    - '*'
+  resources:
+    - '*'
+- verbs:
+    - create
+    - get
+    - list
+    - watch
+    - update
+    - patch
+    - delete
+  apiGroups:
+    - ''
+  resources:
+    - secrets
+    - configmaps
+- verbs:
+    - create
+    - get
+    - list
+    - watch
+    - update
+    - delete
+    - patch
+  apiGroups:
+    - argoproj.io
+  resources:
+    - applications
+    - appprojects
+    - applicationsets
+- verbs:
+    - create
+    - list
+  apiGroups:
+    - ''
+  resources:
+    - events
+- apiGroups:
+  - ""
+  resources:
+  - pods/exec
+  verbs:
+  - create

components/policies/gitops/base/manifests/gitops-subscription/base/kustomization.yaml

@@ -0,0 +1,8 @@
+resources:
+- sub-namespace.yaml
+- sub-operatorgroup.yaml
+- subscription.yaml
+- namespace.yaml
+- gitops-controller-rbac.yaml
+- gitops-server-rbac.yaml
+- cluster-admin-rolebinding.yaml

components/policies/gitops/base/manifests/gitops-subscription/base/namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    openshift.io/cluster-monitoring: "true"
+  name: openshift-gitops

components/policies/gitops/base/manifests/gitops-subscription/base/sub-namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    openshift.io/cluster-monitoring: "true"
+  name: openshift-gitops-operator

components/policies/gitops/base/manifests/gitops-subscription/base/sub-operatorgroup.yaml

@@ -0,0 +1,7 @@
+apiVersion: operators.coreos.com/v1
+kind: OperatorGroup
+metadata:
+  name: gitops-operators
+  namespace: openshift-gitops-operator
+spec:
+  upgradeStrategy: Default

components/policies/gitops/base/manifests/gitops-subscription/base/subscription.yaml

@@ -0,0 +1,19 @@
+apiVersion: operators.coreos.com/v1alpha1
+kind: Subscription
+metadata:
+  name: openshift-gitops-operator
+  namespace: openshift-gitops-operator
+spec:
+  config:
+    env:
+    - name: ARGOCD_CLUSTER_CONFIG_NAMESPACES
+      value: openshift-gitops, gitops
+    - name: CONTROLLER_CLUSTER_ROLE
+      value: gitops-controller
+    - name: SERVER_CLUSTER_ROLE
+      value: gitops-server
+  channel: gitops-1.15
+  installPlanApproval: Automatic
+  name: openshift-gitops-operator
+  source: redhat-operators
+  sourceNamespace: openshift-marketplace