unkinben
edbb62cca4
Deploys the bind-operator control plane on its own so it can be verified before any DNS clusters are created. The three BIND tiers follow as separate PRs. - add apps/base/bind-system: operator Deployment (image v0.1.1), RBAC, namespace, and CRDs pulled from the operator repo by raw URL - add au-syd1 bind-system overlay - register all four bind apps in the platform ApplicationSet (the DNS overlays are instantiated only once their dirs land in later PRs) - add binddns-* namespaces to the platform AppProject destinations - add schemas/bind.unkin.net/*.json so kubeconform validates the CRs
47 lines
1.2 KiB
YAML
47 lines
1.2 KiB
YAML
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: bind-operator
|
|
namespace: bind-system
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: bind-operator
|
|
rules:
|
|
- apiGroups: ["bind.unkin.net"]
|
|
resources: ["*"]
|
|
verbs: ["*"]
|
|
- apiGroups: [""]
|
|
resources: ["services", "configmaps", "secrets"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
|
- apiGroups: [""]
|
|
resources: ["pods"]
|
|
verbs: ["get", "list", "watch"]
|
|
- apiGroups: [""]
|
|
resources: ["pods/exec"]
|
|
verbs: ["create", "get"]
|
|
- apiGroups: ["apps"]
|
|
resources: ["statefulsets"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
|
- apiGroups: [""]
|
|
resources: ["events"]
|
|
verbs: ["create", "patch"]
|
|
- apiGroups: ["coordination.k8s.io"]
|
|
resources: ["leases"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: bind-operator
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: bind-operator
|
|
namespace: bind-system
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: bind-operator
|