Add Kubernetes RBAC support #591
Conversation
| kind: ServiceAccount | ||
| metadata: | ||
| name: flannel | ||
| namespace: kube-system |
There was a problem hiding this comment.
rather than hardcoding the kube-system namespace and duplicating the config/pod spec from the main example, I would include the service account in the core kubernetes yml example (without the namespace), make the core example use a bespoke service account, limit this file to the clusterrole with the required permissions, and document the kubectl command to grant the clusterrole to the flannel service account in the desired namespace
There was a problem hiding this comment.
Ahh yes. Will fix now.
|
@liggitt updated. Is this what you had in mind? |
| @@ -42,6 +69,7 @@ spec: | |||
| hostNetwork: true | |||
| nodeSelector: | |||
| beta.kubernetes.io/arch: amd64 | |||
| serviceAccount: flannel | |||
There was a problem hiding this comment.
serviceAccountName is the non-deprecated field
andrewrynhard
force-pushed
the
rbac
branch
3 times, most recently
from
b0f90ba
to
97acf0c
Compare
|
Looks good to me |
| # $ kubectl create --namespace kube-system -f kube-flannel.yml | ||
| --- | ||
| kind: ClusterRole | ||
| apiVersion: rbac.authorization.k8s.io/v1alpha1 |
There was a problem hiding this comment.
might want to switch this to v1beta1 for longevity
There was a problem hiding this comment.
yep, fixing now
|
LGTM - merging |
This PR adds RBAC support.
@liggitt