Add RBAC support
Adds a ServiceAccount, ClusterRole, and ClusterRoleBinding to the conduit install output that allows the Conduit controller read access to the k8s API.
I have tested this on RBAC-enabled minikube and minikube without RBAC.
@@ -19,6 +19,43 @@ apiVersion: v1
metadata:
name: {{.Namespace}}
+### Service Account ###
+---
+kind: ServiceAccount
+apiVersion: v1
+metadata:
+ name: conduit-controller
+ namespace: conduit
+
+### RBAC ###
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1beta1
+metadata:
+ name: conduit-controller
+rules:
+- apiGroups: ["extensions"]
+ resources: ["deployments", "replicasets"]
+ verbs: ["list", "get", "watch"]
+- apiGroups: [""]
+ resources: ["pods", "endpoints", "services"]
+ verbs: ["list", "get", "watch"]
+
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1beta1
+metadata:
+ name: conduit-controller
+ namespace: conduit
+roleRef:
+ apiGroup: rbac.authorization.k8s.io
+ kind: ClusterRole
+ name: conduit-controller
+subjects:
+- kind: ServiceAccount
+ name: conduit-controller
+ namespace: conduit
+
### Controller ###
---
kind: Service
@@ -81,6 +118,7 @@ spec:
annotations:
conduit.io/created-by: "{{.CliVersion}}"
spec:
+ serviceAccount: conduit-controller
containers:
- name: public-api
ports:
