@@ -72,7 +72,38 @@ Namespace Scope Operator runs in `ibm-common-services` namespace with namespace
72
72
73
73
When the `NamespaceScope` CR is created/updated, it will:
74
74
75
- * Generate a ConfigMap with key `namespaces` and value is the comma separated `namespaceMembers`
75
+ 1. Create role/rolebinding with service accounts from the pods who have label selector `restartLabels`
76
+
77
+ ```
78
+ apiVersion: rbac.authorization.k8s.io/v1
79
+ kind: Role
80
+ metadata:
81
+ name: namespacescope-managed-role-from-NS-CR
82
+ namespace: FROM_namespaceMembers
83
+ rules:
84
+ - apiGroups:
85
+ - '*'
86
+ resources:
87
+ - '*'
88
+ verbs:
89
+ - '*'
90
+ ---
91
+ kind: RoleBinding
92
+ apiVersion: rbac.authorization.k8s.io/v1
93
+ metadata:
94
+ name: namespacescope-managed-role-from-NS-CR
95
+ namespace: FROM_namespaceMembers
96
+ subjects:
97
+ - kind: ServiceAccount
98
+ name: GET_FROM_PODS_WHO_HAVE_restartLabels
99
+ namespace: ibm-common-services
100
+ roleRef:
101
+ kind: Role
102
+ name: namespacescope-managed-role-from-NS-CR
103
+ apiGroup: rbac.authorization.k8s.io
104
+ ```
105
+
106
+ 2. Generate a ConfigMap with key `namespaces` and value is the comma separated `namespaceMembers`
76
107
77
108
```
78
109
apiVersion: v1
@@ -83,7 +114,8 @@ When the `NamespaceScope` CR is created/updated, it will:
83
114
data:
84
115
namespaces: default,cp4i
85
116
```
86
- * Restart the pods with label selector `restartLabels`
117
+
118
+ 3. Restart the pods with label selector `restartLabels`
87
119
88
120
```
89
121
apiVersion: apps/v1
@@ -104,37 +136,6 @@ When the `NamespaceScope` CR is created/updated, it will:
104
136
...
105
137
```
106
138
107
- * Create role/rolebinding with service accounts from the pods who have label selector `restartLabels`
108
-
109
- ```
110
- apiVersion: rbac.authorization.k8s.io/v1
111
- kind: Role
112
- metadata:
113
- name: namespacescope-managed-role-from-NS
114
- namespace: FROM_namespaceMembers
115
- rules:
116
- - apiGroups:
117
- - '*'
118
- resources:
119
- - '*'
120
- verbs:
121
- - '*'
122
- ---
123
- kind: RoleBinding
124
- apiVersion: rbac.authorization.k8s.io/v1
125
- metadata:
126
- name: namespacescope-managed-role-from-NS
127
- namespace: FROM_namespaceMembers
128
- subjects:
129
- - kind: ServiceAccount
130
- name: GET_FROM_PODS_WHO_HAVE_restartLabels
131
- namespace: ibm-common-services
132
- roleRef:
133
- kind: Role
134
- name: namespacescope-managed-role-from-NS
135
- apiGroup: rbac.authorization.k8s.io
136
- ```
137
-
138
139
139
140
## How to manually deploy it
140
141
0 commit comments