allow machine-api-controllers to access configmaps in openshift-config-managed
To support custom CA bundles for AWS, the machine-api-controllers need
access to the kube-cloud-config ConfigMap in the openshift-config-managed
namespace.
@@ -24,6 +24,7 @@ metadata:
annotations:
include.release.openshift.io/self-managed-high-availability: "true"
automountServiceAccountToken: false
+
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
@@ -42,6 +43,24 @@ rules:
- list
- watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+ name: machine-api-controllers
+ namespace: openshift-config-managed
+ annotations:
+ include.release.openshift.io/self-managed-high-availability: "true"
+rules:
+- apiGroups:
+ - ""
+ resources:
+ - configmaps
+ verbs:
+ - get
+ - list
+ - watch
+
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
@@ -417,6 +436,23 @@ subjects:
name: machine-api-controllers
namespace: openshift-machine-api
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+ name: machine-api-controllers
+ namespace: openshift-config-managed
+ annotations:
+ include.release.openshift.io/self-managed-high-availability: "true"
+roleRef:
+ apiGroup: rbac.authorization.k8s.io
+ kind: Role
+ name: machine-api-controllers
+subjects:
+- kind: ServiceAccount
+ name: machine-api-controllers
+ namespace: openshift-machine-api
+
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
