From c78634f5052fb47a1ad3900304be23248475ace6 Mon Sep 17 00:00:00 2001 From: Kristin Barkardottir Date: Thu, 13 Feb 2020 08:53:03 +0000 Subject: [PATCH 1/2] Create vault serviceaccount and keep all resources in a separate vault namespace. Upgrade manifests for kubernetes v16+ --- example/deployment.yaml | 6 +++++- example/etcd-operator-deploy.yaml | 7 ++++++- example/rbac-template.yaml | 15 +++++++++++---- 3 files changed, 22 insertions(+), 6 deletions(-) diff --git a/example/deployment.yaml b/example/deployment.yaml index 8cc239a..f2c6967 100644 --- a/example/deployment.yaml +++ b/example/deployment.yaml @@ -1,14 +1,18 @@ -apiVersion: extensions/v1beta1 +apiVersion: apps/v1 kind: Deployment metadata: name: vault-operator spec: + selector: + matchLabels: + name: vault-operator replicas: 1 template: metadata: labels: name: vault-operator spec: + serviceAccountName: vault containers: - name: vault-operator image: quay.io/coreos/vault-operator:latest diff --git a/example/etcd-operator-deploy.yaml b/example/etcd-operator-deploy.yaml index 68cf6d5..0ff0f84 100644 --- a/example/etcd-operator-deploy.yaml +++ b/example/etcd-operator-deploy.yaml @@ -1,16 +1,21 @@ -apiVersion: extensions/v1beta1 +apiVersion: apps/v1 kind: Deployment metadata: name: etcd-operator + namespace: vault labels: name: etcd-operator spec: + selector: + matchLabels: + name: etcd-operator replicas: 1 template: metadata: labels: name: etcd-operator spec: + serviceAccountName: vault containers: - name: etcd-operator image: quay.io/coreos/etcd-operator:v0.8.3 diff --git a/example/rbac-template.yaml b/example/rbac-template.yaml index e4f9764..e7451ab 100644 --- a/example/rbac-template.yaml +++ b/example/rbac-template.yaml @@ -1,7 +1,14 @@ +kind: ServiceAccount +apiVersion: v1 +metadata: + name: vault + namespace: vault +--- kind: Role apiVersion: rbac.authorization.k8s.io/v1beta1 metadata: name: vault-operator-role + namespace: vault rules: - apiGroups: - etcd.database.coreos.com @@ -24,7 +31,7 @@ rules: verbs: - "*" - apiGroups: - - "" # "" indicates the core API group + - "" resources: - pods - services @@ -43,15 +50,15 @@ rules: - "*" --- - kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1beta1 metadata: name: vault-operator-rolebinding + namespace: vault subjects: - kind: ServiceAccount - name: - namespace: + name: vault + namespace: vault roleRef: kind: Role name: vault-operator-role From ea549738b92b9ddb3737699516c2eda1bbe55061 Mon Sep 17 00:00:00 2001 From: Kristin Barkardottir Date: Thu, 13 Feb 2020 09:10:59 +0000 Subject: [PATCH 2/2] add namespace to deployment --- example/deployment.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/example/deployment.yaml b/example/deployment.yaml index f2c6967..f655e80 100644 --- a/example/deployment.yaml +++ b/example/deployment.yaml @@ -2,6 +2,7 @@ apiVersion: apps/v1 kind: Deployment metadata: name: vault-operator + namespace: vault spec: selector: matchLabels: