user_access: all users to have replicaset access (#158)

* user_access: all users to have replicaset access

to check rollout status for deployments, permission to list replicaset
is needed

* typo: fix missing semicolon for sql statement

* fixup! typo: fix missing semicolon for sql statement

Author: davidcheung

db-ops/job-create-db-postgres.yml.tpl

@@ -11,7 +11,8 @@ metadata:
 type: Opaque
 stringData: 
   create-user.sql: |
-    DROP USER $DB_APP_USERNAME
+    REVOKE ALL PRIVILEGES ON DATABASE $DB_NAME FROM $DB_APP_USERNAME;
+    DROP USER $DB_APP_USERNAME;
     CREATE USER $DB_APP_USERNAME WITH ENCRYPTED PASSWORD '$DB_APP_PASSWORD';
     GRANT ALL PRIVILEGES ON DATABASE $DB_NAME TO $DB_APP_USERNAME;
   RDS_MASTER_PASSWORD: $MASTER_RDS_PASSWORD

templates/terraform/environments/prod/user_access.tf

@@ -172,7 +172,7 @@ locals {
       }, {
       verbs      = ["get", "list", "watch"]
       api_groups = ["*"]
-      resources = ["deployments", "configmaps", "pods", "pods/log", "pods/status", "jobs", "cronjobs", "services",
+      resources = ["deployments", "configmaps", "pods", "pods/log", "pods/status", "jobs", "cronjobs", "services", "replicasets",
         "daemonsets", "endpoints", "namespaces", "events", "ingresses", "horizontalpodautoscalers", "horizontalpodautoscalers/status"
       ]
     }
@@ -186,7 +186,7 @@ locals {
       resources = ["deployments", "configmaps", "pods", "pods/exec", "pods/log", "pods/status", "pods/portforward",
         "jobs", "cronjobs", "secrets", "services", "daemonsets", "endpoints", "namespaces", "events", "ingresses",
         "horizontalpodautoscalers", "horizontalpodautoscalers/status",
-        "poddisruptionbudgets"
+        "poddisruptionbudgets", "replicasets"
       ]
     }
   ]
@@ -199,7 +199,7 @@ locals {
       resources = ["deployments", "configmaps", "pods", "pods/log", "pods/status",
         "jobs", "cronjobs", "services", "daemonsets", "endpoints", "namespaces", "events", "ingresses",
         "horizontalpodautoscalers", "horizontalpodautoscalers/status",
-        "poddisruptionbudgets"
+        "poddisruptionbudgets", "replicasets"
       ]
     },
     {

templates/terraform/environments/stage/user_access.tf

@@ -172,7 +172,7 @@ locals {
       }, {
       verbs      = ["get", "list", "watch"]
       api_groups = ["*"]
-      resources = ["deployments", "configmaps", "pods", "pods/log", "pods/status", "jobs", "cronjobs", "services",
+      resources = ["deployments", "configmaps", "pods", "pods/log", "pods/status", "jobs", "cronjobs", "services", "replicasets",
         "daemonsets", "endpoints", "namespaces", "events", "ingresses", "horizontalpodautoscalers", "horizontalpodautoscalers/status"
       ]
     }
@@ -186,7 +186,7 @@ locals {
       resources = ["deployments", "configmaps", "pods", "pods/exec", "pods/log", "pods/status", "pods/portforward",
         "jobs", "cronjobs", "secrets", "services", "daemonsets", "endpoints", "namespaces", "events", "ingresses",
         "horizontalpodautoscalers", "horizontalpodautoscalers/status",
-        "poddisruptionbudgets"
+        "poddisruptionbudgets", "replicasets"
       ]
     }
   ]
@@ -199,7 +199,7 @@ locals {
       resources = ["deployments", "configmaps", "pods", "pods/log", "pods/status",
         "jobs", "cronjobs", "services", "daemonsets", "endpoints", "namespaces", "events", "ingresses",
         "horizontalpodautoscalers", "horizontalpodautoscalers/status",
-        "poddisruptionbudgets"
+        "poddisruptionbudgets", "replicasets"
       ]
     },
     {