apiVersion: v1
kind: ServiceAccount
metadata:
  name: besu-validator
  namespace: besu-network
  labels:
    app: besu
    component: validator
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: besu-sentry
  namespace: besu-network
  labels:
    app: besu
    component: sentry
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: besu-rpc
  namespace: besu-network
  labels:
    app: besu
    component: rpc
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: oracle-publisher
  namespace: besu-network
  labels:
    app: oracle-publisher
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: rpc-gateway
  namespace: besu-network
  labels:
    app: rpc-gateway
---
# Role for reading secrets from Azure Key Vault
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: keyvault-reader
  namespace: besu-network
rules:
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get", "list"]
---
# RoleBinding for validators
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: validator-keyvault-reader
  namespace: besu-network
subjects:
  - kind: ServiceAccount
    name: besu-validator
    namespace: besu-network
roleRef:
  kind: Role
  name: keyvault-reader
  apiGroup: rbac.authorization.k8s.io
---
# RoleBinding for oracle publisher
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: oracle-keyvault-reader
  namespace: besu-network
subjects:
  - kind: ServiceAccount
    name: oracle-publisher
    namespace: besu-network
roleRef:
  kind: Role
  name: keyvault-reader
  apiGroup: rbac.authorization.k8s.io

