epostnikof/kubespray
1
0
Fork 0
mirror of https://github.com/kubernetes-sigs/kubespray.git synced 2026-03-08 02:58:29 +03:00
Code Issues Packages Projects Releases Wiki Activity

run calico-policy-controller with proper sa/role/rolebinding

Browse Source
This commit is contained in:
jwfang
2017-07-04 20:03:55 +08:00
parent fd01377f12
commit c9734b6d7b
5 changed files with 63 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
roles/kubernetes-apps/policy_controller/calico/templates/calico-policy-controller-clusterrole.yml Normal file
View File

@@ -0,0 +1,16 @@
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: calico-policy-controller
namespace: {{ system_namespace }}
rules:
- apiGroups:
- ""
- extensions
resources:
- pods
- namespaces
- networkpolicies
verbs:
- watch
- list

12
roles/kubernetes-apps/policy_controller/calico/templates/calico-policy-controller-clusterrolebinding.yml Normal file
View File

@@ -0,0 +1,12 @@
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: calico-policy-controller
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: calico-policy-controller
subjects:
- kind: ServiceAccount
name: calico-policy-controller
namespace: {{ system_namespace }}

7
roles/kubernetes-apps/policy_controller/calico/templates/calico-policy-controller-sa.yml Normal file
View File

@@ -0,0 +1,7 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: calico-policy-controller
namespace: {{ system_namespace }}
labels:
kubernetes.io/cluster-service: "true"

3
roles/kubernetes-apps/policy_controller/calico/templates/calico-policy-controller.yml.j2
View File

@@ -60,3 +60,6 @@ spec:
- hostPath:
path: {{ calico_cert_dir }}
name: etcd-certs
{% if rbac_enabled %}
serviceAccountName: calico-policy-controller
{% endif %}