Add dedicated service accounts per controller

Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
pull/777/head
Stefan Prodan 4 years ago
parent c219eb2883
commit 1b581d6f51
No known key found for this signature in database
GPG Key ID: 3299AEB0E4085BAF

@ -0,0 +1,4 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: helm-controller

@ -3,6 +3,7 @@ kind: Kustomization
resources: resources:
- https://github.com/fluxcd/helm-controller/archive/v0.6.0.zip//helm-controller-0.6.0/config/crd - https://github.com/fluxcd/helm-controller/archive/v0.6.0.zip//helm-controller-0.6.0/config/crd
- https://github.com/fluxcd/helm-controller/archive/v0.6.0.zip//helm-controller-0.6.0/config/manager - https://github.com/fluxcd/helm-controller/archive/v0.6.0.zip//helm-controller-0.6.0/config/manager
- account.yaml
patchesJson6902: patchesJson6902:
- target: - target:
group: apps group: apps

@ -1,3 +1,6 @@
- op: add - op: add
path: /spec/template/spec/containers/0/args/0 path: /spec/template/spec/containers/0/args/0
value: --events-addr=http://notification-controller/ value: --events-addr=http://notification-controller/
- op: add
path: /spec/template/spec/serviceAccountName
value: helm-controller

@ -0,0 +1,4 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: image-automation-controller

@ -3,6 +3,7 @@ kind: Kustomization
resources: resources:
- https://github.com/fluxcd/image-automation-controller/archive/v0.4.0.zip//image-automation-controller-0.4.0/config/crd - https://github.com/fluxcd/image-automation-controller/archive/v0.4.0.zip//image-automation-controller-0.4.0/config/crd
- https://github.com/fluxcd/image-automation-controller/archive/v0.4.0.zip//image-automation-controller-0.4.0/config/manager - https://github.com/fluxcd/image-automation-controller/archive/v0.4.0.zip//image-automation-controller-0.4.0/config/manager
- account.yaml
patchesJson6902: patchesJson6902:
- target: - target:
group: apps group: apps

@ -1,3 +1,6 @@
- op: add - op: add
path: /spec/template/spec/containers/0/args/0 path: /spec/template/spec/containers/0/args/0
value: --events-addr=http://notification-controller/ value: --events-addr=http://notification-controller/
- op: add
path: /spec/template/spec/serviceAccountName
value: image-automation-controller

@ -0,0 +1,4 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: image-reflector-controller

@ -3,6 +3,7 @@ kind: Kustomization
resources: resources:
- https://github.com/fluxcd/image-reflector-controller/archive/v0.4.1.zip//image-reflector-controller-0.4.1/config/crd - https://github.com/fluxcd/image-reflector-controller/archive/v0.4.1.zip//image-reflector-controller-0.4.1/config/crd
- https://github.com/fluxcd/image-reflector-controller/archive/v0.4.1.zip//image-reflector-controller-0.4.1/config/manager - https://github.com/fluxcd/image-reflector-controller/archive/v0.4.1.zip//image-reflector-controller-0.4.1/config/manager
- account.yaml
patchesJson6902: patchesJson6902:
- target: - target:
group: apps group: apps

@ -1,3 +1,6 @@
- op: add - op: add
path: /spec/template/spec/containers/0/args/0 path: /spec/template/spec/containers/0/args/0
value: --events-addr=http://notification-controller/ value: --events-addr=http://notification-controller/
- op: add
path: /spec/template/spec/serviceAccountName
value: image-reflector-controller

@ -0,0 +1,4 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: kustomize-controller

@ -3,6 +3,7 @@ kind: Kustomization
resources: resources:
- https://github.com/fluxcd/kustomize-controller/archive/v0.7.0.zip//kustomize-controller-0.7.0/config/crd - https://github.com/fluxcd/kustomize-controller/archive/v0.7.0.zip//kustomize-controller-0.7.0/config/crd
- https://github.com/fluxcd/kustomize-controller/archive/v0.7.0.zip//kustomize-controller-0.7.0/config/manager - https://github.com/fluxcd/kustomize-controller/archive/v0.7.0.zip//kustomize-controller-0.7.0/config/manager
- account.yaml
patchesJson6902: patchesJson6902:
- target: - target:
group: apps group: apps

@ -1,3 +1,6 @@
- op: add - op: add
path: /spec/template/spec/containers/0/args/0 path: /spec/template/spec/containers/0/args/0
value: --events-addr=http://notification-controller/ value: --events-addr=http://notification-controller/
- op: add
path: /spec/template/spec/serviceAccountName
value: kustomize-controller

@ -0,0 +1,4 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: notification-controller

@ -3,3 +3,11 @@ kind: Kustomization
resources: resources:
- https://github.com/fluxcd/notification-controller/archive/v0.7.0.zip//notification-controller-0.7.0/config/crd - https://github.com/fluxcd/notification-controller/archive/v0.7.0.zip//notification-controller-0.7.0/config/crd
- https://github.com/fluxcd/notification-controller/archive/v0.7.0.zip//notification-controller-0.7.0/config/manager - https://github.com/fluxcd/notification-controller/archive/v0.7.0.zip//notification-controller-0.7.0/config/manager
- account.yaml
patchesJson6902:
- target:
group: apps
version: v1
kind: Deployment
name: notification-controller
path: patch.yaml

@ -0,0 +1,3 @@
- op: add
path: /spec/template/spec/serviceAccountName
value: notification-controller

@ -0,0 +1,4 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: source-controller

@ -3,6 +3,7 @@ kind: Kustomization
resources: resources:
- https://github.com/fluxcd/source-controller/archive/v0.7.0.zip//source-controller-0.7.0/config/crd - https://github.com/fluxcd/source-controller/archive/v0.7.0.zip//source-controller-0.7.0/config/crd
- https://github.com/fluxcd/source-controller/archive/v0.7.0.zip//source-controller-0.7.0/config/manager - https://github.com/fluxcd/source-controller/archive/v0.7.0.zip//source-controller-0.7.0/config/manager
- account.yaml
patchesJson6902: patchesJson6902:
- target: - target:
group: apps group: apps

@ -1,3 +1,6 @@
- op: add - op: add
path: /spec/template/spec/containers/0/args/0 path: /spec/template/spec/containers/0/args/0
value: --events-addr=http://notification-controller/ value: --events-addr=http://notification-controller/
- op: add
path: /spec/template/spec/serviceAccountName
value: source-controller

@ -1,5 +1,5 @@
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
kind: Role kind: ClusterRole
metadata: metadata:
name: crd-controller name: crd-controller
rules: rules:
@ -15,12 +15,17 @@ rules:
- apiGroups: ['notification.toolkit.fluxcd.io'] - apiGroups: ['notification.toolkit.fluxcd.io']
resources: ['*'] resources: ['*']
verbs: ['*'] verbs: ['*']
- apiGroups: ['image.toolkit.fluxcd.io']
resources: ['*']
verbs: ['*']
- apiGroups: - apiGroups:
- "" - ""
resources: resources:
- configmaps - secrets
- configmaps/status verbs:
verbs: ['*'] - get
- list
- watch
- apiGroups: - apiGroups:
- "" - ""
resources: resources:
@ -28,6 +33,19 @@ rules:
verbs: verbs:
- create - create
- patch - patch
- apiGroups:
- ""
resources:
- configmaps
- configmaps/status
verbs:
- get
- list
- watch
- create
- update
- patch
- delete
- apiGroups: - apiGroups:
- "coordination.k8s.io" - "coordination.k8s.io"
resources: resources:
@ -42,14 +60,23 @@ rules:
- delete - delete
--- ---
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding kind: ClusterRoleBinding
metadata: metadata:
name: crd-controller name: crd-controller
roleRef: roleRef:
apiGroup: rbac.authorization.k8s.io apiGroup: rbac.authorization.k8s.io
kind: Role kind: ClusterRole
name: crd-controller name: crd-controller
subjects: subjects:
- kind: ServiceAccount - kind: ServiceAccount
name: default name: kustomize-controller
namespace: system - kind: ServiceAccount
name: helm-controller
- kind: ServiceAccount
name: source-controller
- kind: ServiceAccount
name: notification-controller
- kind: ServiceAccount
name: image-reflector-controller
- kind: ServiceAccount
name: image-automation-controller

@ -1,5 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1 apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization kind: Kustomization
resources: resources:
- role.yaml - controller.yaml
- cluster-role.yaml - reconciler.yaml

@ -8,5 +8,6 @@ roleRef:
name: cluster-admin name: cluster-admin
subjects: subjects:
- kind: ServiceAccount - kind: ServiceAccount
name: default name: kustomize-controller
namespace: system - kind: ServiceAccount
name: helm-controller
Loading…
Cancel
Save