# Runs the annotate-vcf workflow pods and the Pub/Sub EventSource. Bound to the rarelens-pipeline
# Google service account through Workload Identity (annotation added by the gcp overlay).
apiVersion: v1
kind: ServiceAccount
metadata: { name: rarelens-pipeline }
---
# Argo's executor reports step outputs through WorkflowTaskResults.
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata: { name: argo-executor }
rules:
  - apiGroups: [argoproj.io]
    resources: [workflowtaskresults]
    verbs: [create, patch]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata: { name: rarelens-pipeline-argo-executor }
roleRef: { apiGroup: rbac.authorization.k8s.io, kind: Role, name: argo-executor }
subjects: [{ kind: ServiceAccount, name: rarelens-pipeline }]
---
apiVersion: v1
kind: ServiceAccount
metadata: { name: argo-events-sensor }
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata: { name: workflow-submitter }
rules:
  - apiGroups: [argoproj.io]
    resources: [workflows]
    verbs: [create]
  - apiGroups: [argoproj.io]
    resources: [workflowtemplates]
    verbs: [get, list]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata: { name: argo-events-sensor-workflow-submitter }
roleRef: { apiGroup: rbac.authorization.k8s.io, kind: Role, name: workflow-submitter }
subjects: [{ kind: ServiceAccount, name: argo-events-sensor }]