unkinben
4b8f9313c8
First of a 4-PR split of the bind rollout (was #216). Deploys just the operator control plane so it can be verified before any DNS clusters exist. ## Why Roll out incrementally: operator + CRDs first, then each BIND tier as its own PR. ## Changes - `apps/base/bind-system`: operator Deployment (`git.unkin.net/unkin/bind-operator:v0.1.1`), RBAC, namespace; CRDs pulled from the operator repo by raw URL (`config/crd/install.yaml` @ v0.1.1) - au-syd1 `bind-system` overlay - register all four bind apps in `argocd/applicationsets/platform.yaml` (DNS overlays instantiate only when their dirs land in the follow-up PRs) - add `binddns-*` namespaces to `argocd/projects/platform.yaml` - add `schemas/bind.unkin.net/*.json` for kubeconform ## Deploy impact Operator pod + CRDs only. No DNS services yet — the operator is idle until BindClusters exist. ## Follow-ups (merge after this) binddns-auth, binddns-resolver, binddns-externaldns — one PR each. Reviewed-on: #219 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
47 lines
1.2 KiB
YAML
47 lines
1.2 KiB
YAML
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: bind-operator
|
|
namespace: bind-system
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: bind-operator
|
|
rules:
|
|
- apiGroups: ["bind.unkin.net"]
|
|
resources: ["*"]
|
|
verbs: ["*"]
|
|
- apiGroups: [""]
|
|
resources: ["services", "configmaps", "secrets"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
|
- apiGroups: [""]
|
|
resources: ["pods"]
|
|
verbs: ["get", "list", "watch"]
|
|
- apiGroups: [""]
|
|
resources: ["pods/exec"]
|
|
verbs: ["create", "get"]
|
|
- apiGroups: ["apps"]
|
|
resources: ["statefulsets"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
|
- apiGroups: [""]
|
|
resources: ["events"]
|
|
verbs: ["create", "patch"]
|
|
- apiGroups: ["coordination.k8s.io"]
|
|
resources: ["leases"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: bind-operator
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: bind-operator
|
|
namespace: bind-system
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: bind-operator
|