Add sysadmin-readonly group to openshift

Signed-off-by: Vít Smolík <me@smoliicek.cz>

roles/openshift/cluster/templates/sysadmin-readonly-group.yml.j2

@@ -0,0 +1,9 @@
+---
+kind: Group
+apiVersion: user.openshift.io/v1
+metadata:
+  name: "sysadmin-readonly"
+users:
+{% for item in cluster_appowners %}
+- "{{ item }}"
+{% endfor %}

roles/openshift/cluster/templates/sysadmin-readonly-role.yml.j2

@@ -0,0 +1,32 @@
+---
+kind: Role
+apiVersion: user.openshift.io/v1
+metadata:
+  name: "sysadmin-openshift"
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - endpoints
+  - persistentvolumeclaims
+  - persistentvolumeclaims/status
+  - pods
+  - replicationcontrollers
+  - replicationcontrollers/scale
+  - serviceaccounts
+  - services
+  - services/status
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  resourceNames: 
+  - SAFE_CONFIGMAPS, REPLACE THIS
+  verbs:
+  - get
+  - list
+  - watch

roles/openshift/cluster/templates/sysadmin-readonly-rolebinding.yml.j2

@@ -0,0 +1,13 @@
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: "sysadmin-readonly"
+subjects:
+  - kind: Group
+    apiGroup: rbac.authorization.k8s.io
+    name: "sysadmin-readonly"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: cluster-readonly