project-request-template.yaml

apiVersion: template.openshift.io/v1
kind: Template
metadata:
  name: project-request
  namespace: openshift-config
objects:
- apiVersion: v1
  kind: LimitRange
  metadata:
    name: ${PROJECT_NAME}-core-resource-limits
    namespace: ${PROJECT_NAME}
  spec:
    limits:
    - default:
        cpu: 500m
        memory: 1.5Gi
      defaultRequest:
        cpu: 50m
        memory: 256Mi
      max:
        cpu: 4
        memory: 6Gi
      type: Container
    - max:
        cpu: 4
        memory: 12Gi
      type: Pod
- apiVersion: networking.k8s.io/v1
  kind: NetworkPolicy
  metadata:
    name: allow-from-all-namespaces
  spec:
    ingress:
    - from:
      - namespaceSelector: {}
    podSelector: {}
- apiVersion: networking.k8s.io/v1
  kind: NetworkPolicy
  metadata:
    name: allow-from-ingress-namespace
  spec:
    ingress:
    - from:
      - namespaceSelector:
          matchLabels:
            network-policy: global
    podSelector: null
- apiVersion: project.openshift.io/v1
  kind: Project
  metadata:
    annotations:
      openshift.io/description: ${PROJECT_DESCRIPTION}
      openshift.io/display-name: ${PROJECT_DISPLAYNAME}
      openshift.io/requester: ${PROJECT_REQUESTING_USER}
    name: ${PROJECT_NAME}
  spec: {}
  status: {}
- apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    annotations:
      openshift.io/description: Allows all pods in this namespace to pull images from
        this namespace.  It is auto-managed by a controller; remove subjects to disable.
    name: system:image-pullers
    namespace: ${PROJECT_NAME}
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: system:image-puller
  subjects:
  - apiGroup: rbac.authorization.k8s.io
    kind: Group
    name: system:serviceaccounts:${PROJECT_NAME}
- apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    annotations:
      openshift.io/description: Allows builds in this namespace to push images to
        this namespace.  It is auto-managed by a controller; remove subjects to disable.
    name: system:image-builders
    namespace: ${PROJECT_NAME}
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: system:image-builder
  subjects:
  - kind: ServiceAccount
    name: builder
    namespace: ${PROJECT_NAME}
- apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    annotations:
      openshift.io/description: Allows deploymentconfigs in this namespace to rollout
        pods in this namespace.  It is auto-managed by a controller; remove subjects
        to disable.
    name: system:deployers
    namespace: ${PROJECT_NAME}
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: system:deployer
  subjects:
  - kind: ServiceAccount
    name: deployer
    namespace: ${PROJECT_NAME}
- apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    name: admin
    namespace: ${PROJECT_NAME}
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: admin
  subjects:
  - apiGroup: rbac.authorization.k8s.io
    kind: User
    name: ${PROJECT_ADMIN_USER}
parameters:
- name: PROJECT_NAME
- name: PROJECT_DISPLAYNAME
- name: PROJECT_DESCRIPTION
- name: PROJECT_ADMIN_USER
- name: PROJECT_REQUESTING_USER