os.yaml

kind: List
apiVersion: v1
items:
- kind: ServiceAccount
  apiVersion: v1
  metadata:
    name: privileged-builder
    namespace: ci

- kind: Role
  apiVersion: authorization.openshift.io/v1
  metadata:
    name: privileged-builder
    namespace: ci
  rules:
  - resources:
    - securitycontextconstraints
    apiGroups:
    - security.openshift.io
    verbs:
    - use
    resourceNames:
    - privileged
- kind: RoleBinding
  apiVersion: authorization.openshift.io/v1
  metadata:
    name: privileged-builder
    namespace: ci
  subjects:
  - kind: ServiceAccount
    name: privileged-builder
    namespace: ci
  roleRef:
    name: privileged-builder

- kind: Role
  apiVersion: authorization.openshift.io/v1
  metadata:
    name: privileged-builder-push
    namespace: openshift
  rules:
  - resources:
    - imagestreams/layers
    apiGroups:
    - ""
    - image.openshift.io
    verbs:
    - get
    - update
    resourceNames:
    - os
- kind: RoleBinding
  apiVersion: authorization.openshift.io/v1
  metadata:
    name: privileged-builder-push
    namespace: openshift
  subjects:
  - kind: ServiceAccount
    name: privileged-builder
    namespace: ci
  roleRef:
    name: privileged-builder-push
    namespace: openshift