feat: add ClusterRole for customer provisioning, register DOCR helm repo, remove stale test customer

manager/rbac.yaml

@@ -4,6 +4,7 @@ metadata:
   name: manager
   namespace: manager
 ---
+# pgbouncer config management
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
@@ -37,6 +38,7 @@ roleRef:
   apiGroup: rbac.authorization.k8s.io
   name: manager-pgbouncer
 ---
+# ArgoCD application management
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
@@ -60,3 +62,29 @@ roleRef:
   kind: Role
   apiGroup: rbac.authorization.k8s.io
   name: manager-argocd
+---
+# Cluster-wide: create/delete customer namespaces and manage secrets within them
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: manager-customer-provisioner
+rules:
+  - apiGroups: [""]
+    resources: ["namespaces"]
+    verbs: ["get", "create", "delete"]
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "create", "delete", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: manager-customer-provisioner
+subjects:
+  - kind: ServiceAccount
+    name: manager
+    namespace: manager
+roleRef:
+  kind: ClusterRole
+  apiGroup: rbac.authorization.k8s.io
+  name: manager-customer-provisioner