Skip to content

Commit a90b1c3

Browse files
author
Oscar Llamas
committed
chore: Remove RBAC resources from default Kustomization
1 parent a06718b commit a90b1c3

File tree

2 files changed

+361
-1
lines changed

2 files changed

+361
-1
lines changed

‎config/default/kustomization.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ namePrefix: workload-operator-
1616

1717
resources:
1818
# - ../crd
19-
- ../rbac
19+
# - ../rbac
2020
- ../manager
2121
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
2222
# crd/kustomization.yaml

‎result.yaml‎

Lines changed: 360 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,360 @@
1+
apiVersion: v1
2+
kind: Namespace
3+
metadata:
4+
labels:
5+
app.kubernetes.io/managed-by: kustomize
6+
app.kubernetes.io/name: workload-operator
7+
control-plane: controller-manager
8+
name: workload-operator-system
9+
---
10+
apiVersion: v1
11+
kind: ServiceAccount
12+
metadata:
13+
labels:
14+
app.kubernetes.io/managed-by: kustomize
15+
app.kubernetes.io/name: workload-operator
16+
name: workload-operator-controller-manager
17+
namespace: workload-operator-system
18+
---
19+
apiVersion: rbac.authorization.k8s.io/v1
20+
kind: Role
21+
metadata:
22+
labels:
23+
app.kubernetes.io/managed-by: kustomize
24+
app.kubernetes.io/name: workload-operator
25+
name: workload-operator-leader-election-role
26+
namespace: workload-operator-system
27+
rules:
28+
- apiGroups:
29+
- ""
30+
resources:
31+
- configmaps
32+
verbs:
33+
- get
34+
- list
35+
- watch
36+
- create
37+
- update
38+
- patch
39+
- delete
40+
- apiGroups:
41+
- coordination.k8s.io
42+
resources:
43+
- leases
44+
verbs:
45+
- get
46+
- list
47+
- watch
48+
- create
49+
- update
50+
- patch
51+
- delete
52+
- apiGroups:
53+
- ""
54+
resources:
55+
- events
56+
verbs:
57+
- create
58+
- patch
59+
---
60+
apiVersion: rbac.authorization.k8s.io/v1
61+
kind: ClusterRole
62+
metadata:
63+
name: workload-operator-manager-role
64+
rules:
65+
- apiGroups:
66+
- compute.datumapis.com
67+
resources:
68+
- workloaddeployments
69+
- workloads
70+
verbs:
71+
- create
72+
- delete
73+
- get
74+
- list
75+
- patch
76+
- update
77+
- watch
78+
- apiGroups:
79+
- compute.datumapis.com
80+
resources:
81+
- workloaddeployments/finalizers
82+
- workloads/finalizers
83+
verbs:
84+
- update
85+
- apiGroups:
86+
- compute.datumapis.com
87+
resources:
88+
- workloaddeployments/status
89+
- workloads/status
90+
verbs:
91+
- get
92+
- patch
93+
- update
94+
---
95+
apiVersion: rbac.authorization.k8s.io/v1
96+
kind: ClusterRole
97+
metadata:
98+
name: workload-operator-metrics-auth-role
99+
rules:
100+
- apiGroups:
101+
- authentication.k8s.io
102+
resources:
103+
- tokenreviews
104+
verbs:
105+
- create
106+
- apiGroups:
107+
- authorization.k8s.io
108+
resources:
109+
- subjectaccessreviews
110+
verbs:
111+
- create
112+
---
113+
apiVersion: rbac.authorization.k8s.io/v1
114+
kind: ClusterRole
115+
metadata:
116+
name: workload-operator-metrics-reader
117+
rules:
118+
- nonResourceURLs:
119+
- /metrics
120+
verbs:
121+
- get
122+
---
123+
apiVersion: rbac.authorization.k8s.io/v1
124+
kind: ClusterRole
125+
metadata:
126+
labels:
127+
app.kubernetes.io/managed-by: kustomize
128+
app.kubernetes.io/name: workload-operator
129+
name: workload-operator-workload-editor-role
130+
rules:
131+
- apiGroups:
132+
- compute.datumapis.com
133+
resources:
134+
- workloads
135+
verbs:
136+
- create
137+
- delete
138+
- get
139+
- list
140+
- patch
141+
- update
142+
- watch
143+
- apiGroups:
144+
- compute.datumapis.com
145+
resources:
146+
- workloads/status
147+
verbs:
148+
- get
149+
---
150+
apiVersion: rbac.authorization.k8s.io/v1
151+
kind: ClusterRole
152+
metadata:
153+
labels:
154+
app.kubernetes.io/managed-by: kustomize
155+
app.kubernetes.io/name: workload-operator
156+
name: workload-operator-workload-viewer-role
157+
rules:
158+
- apiGroups:
159+
- compute.datumapis.com
160+
resources:
161+
- workloads
162+
verbs:
163+
- get
164+
- list
165+
- watch
166+
- apiGroups:
167+
- compute.datumapis.com
168+
resources:
169+
- workloads/status
170+
verbs:
171+
- get
172+
---
173+
apiVersion: rbac.authorization.k8s.io/v1
174+
kind: ClusterRole
175+
metadata:
176+
labels:
177+
app.kubernetes.io/managed-by: kustomize
178+
app.kubernetes.io/name: workload-operator
179+
name: workload-operator-workloaddeployment-editor-role
180+
rules:
181+
- apiGroups:
182+
- compute.datumapis.com
183+
resources:
184+
- workloaddeployments
185+
verbs:
186+
- create
187+
- delete
188+
- get
189+
- list
190+
- patch
191+
- update
192+
- watch
193+
- apiGroups:
194+
- compute.datumapis.com
195+
resources:
196+
- workloaddeployments/status
197+
verbs:
198+
- get
199+
---
200+
apiVersion: rbac.authorization.k8s.io/v1
201+
kind: ClusterRole
202+
metadata:
203+
labels:
204+
app.kubernetes.io/managed-by: kustomize
205+
app.kubernetes.io/name: workload-operator
206+
name: workload-operator-workloaddeployment-viewer-role
207+
rules:
208+
- apiGroups:
209+
- compute.datumapis.com
210+
resources:
211+
- workloaddeployments
212+
verbs:
213+
- get
214+
- list
215+
- watch
216+
- apiGroups:
217+
- compute.datumapis.com
218+
resources:
219+
- workloaddeployments/status
220+
verbs:
221+
- get
222+
---
223+
apiVersion: rbac.authorization.k8s.io/v1
224+
kind: RoleBinding
225+
metadata:
226+
labels:
227+
app.kubernetes.io/managed-by: kustomize
228+
app.kubernetes.io/name: workload-operator
229+
name: workload-operator-leader-election-rolebinding
230+
namespace: workload-operator-system
231+
roleRef:
232+
apiGroup: rbac.authorization.k8s.io
233+
kind: Role
234+
name: workload-operator-leader-election-role
235+
subjects:
236+
- kind: ServiceAccount
237+
name: workload-operator-controller-manager
238+
namespace: workload-operator-system
239+
---
240+
apiVersion: rbac.authorization.k8s.io/v1
241+
kind: ClusterRoleBinding
242+
metadata:
243+
labels:
244+
app.kubernetes.io/managed-by: kustomize
245+
app.kubernetes.io/name: workload-operator
246+
name: workload-operator-manager-rolebinding
247+
roleRef:
248+
apiGroup: rbac.authorization.k8s.io
249+
kind: ClusterRole
250+
name: workload-operator-manager-role
251+
subjects:
252+
- kind: ServiceAccount
253+
name: workload-operator-controller-manager
254+
namespace: workload-operator-system
255+
---
256+
apiVersion: rbac.authorization.k8s.io/v1
257+
kind: ClusterRoleBinding
258+
metadata:
259+
name: workload-operator-metrics-auth-rolebinding
260+
roleRef:
261+
apiGroup: rbac.authorization.k8s.io
262+
kind: ClusterRole
263+
name: workload-operator-metrics-auth-role
264+
subjects:
265+
- kind: ServiceAccount
266+
name: workload-operator-controller-manager
267+
namespace: workload-operator-system
268+
---
269+
apiVersion: v1
270+
kind: Service
271+
metadata:
272+
labels:
273+
app.kubernetes.io/managed-by: kustomize
274+
app.kubernetes.io/name: workload-operator
275+
control-plane: controller-manager
276+
name: workload-operator-controller-manager-metrics-service
277+
namespace: workload-operator-system
278+
spec:
279+
ports:
280+
- name: https
281+
port: 8443
282+
protocol: TCP
283+
targetPort: 8443
284+
selector:
285+
control-plane: controller-manager
286+
---
287+
apiVersion: v1
288+
kind: Service
289+
metadata:
290+
labels:
291+
app.kubernetes.io/managed-by: kustomize
292+
app.kubernetes.io/name: workload-operator
293+
name: workload-operator-webhook-service
294+
namespace: workload-operator-system
295+
spec:
296+
ports:
297+
- port: 443
298+
protocol: TCP
299+
targetPort: 9443
300+
selector:
301+
control-plane: controller-manager
302+
---
303+
apiVersion: apps/v1
304+
kind: Deployment
305+
metadata:
306+
labels:
307+
app.kubernetes.io/managed-by: kustomize
308+
app.kubernetes.io/name: workload-operator
309+
control-plane: controller-manager
310+
name: workload-operator-controller-manager
311+
namespace: workload-operator-system
312+
spec:
313+
replicas: 1
314+
selector:
315+
matchLabels:
316+
control-plane: controller-manager
317+
template:
318+
metadata:
319+
annotations:
320+
kubectl.kubernetes.io/default-container: manager
321+
labels:
322+
control-plane: controller-manager
323+
spec:
324+
containers:
325+
- args:
326+
- --metrics-bind-address=:8443
327+
- --leader-elect
328+
- --health-probe-bind-address=:8081
329+
command:
330+
- /manager
331+
image: example.com/datum-workload-operator:v0.0.1
332+
livenessProbe:
333+
httpGet:
334+
path: /healthz
335+
port: 8081
336+
initialDelaySeconds: 15
337+
periodSeconds: 20
338+
name: manager
339+
readinessProbe:
340+
httpGet:
341+
path: /readyz
342+
port: 8081
343+
initialDelaySeconds: 5
344+
periodSeconds: 10
345+
resources:
346+
limits:
347+
cpu: 500m
348+
memory: 128Mi
349+
requests:
350+
cpu: 10m
351+
memory: 64Mi
352+
securityContext:
353+
allowPrivilegeEscalation: false
354+
capabilities:
355+
drop:
356+
- ALL
357+
securityContext:
358+
runAsNonRoot: true
359+
serviceAccountName: workload-operator-controller-manager
360+
terminationGracePeriodSeconds: 10

0 commit comments

Comments
 (0)