Skip to content

Commit 7bb6458

Browse files
rmohrrmohr
authored
Merge pull request kubevirt#640 from gbenhaim/modify_manifests
Manifests: Modify RBAC
2 parents 98bfb8f + c8abbfa commit 7bb6458

File tree

7 files changed

+80
-23
lines changed

7 files changed

+80
-23
lines changed

‎manifests/dev/libvirt.yaml.in

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ spec:
1212
labels:
1313
kubevirt.io: libvirt
1414
spec:
15-
serviceAccountName: kubevirt-infra
15+
serviceAccountName: kubevirt-privileged
1616
hostNetwork: true
1717
hostPID: true
1818
hostIPC: true

‎manifests/dev/rbac.authorization.k8s.yaml.in

Lines changed: 24 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
apiVersion: rbac.authorization.k8s.io/v1beta1
22
kind: ClusterRole
33
metadata:
4-
name: kubevirt-infra
4+
name: kubevirt-controller
55
namespace: kube-system
66
labels:
77
kubevirt.io: ""
@@ -44,39 +44,39 @@ rules:
4444
apiVersion: v1
4545
kind: ServiceAccount
4646
metadata:
47-
name: kubevirt-infra
47+
name: kubevirt-controller
4848
namespace: kube-system
4949
labels:
5050
kubevirt.io: ""
5151
---
5252
apiVersion: v1
5353
kind: ServiceAccount
5454
metadata:
55-
name: kubevirt-admin
55+
name: kubevirt-privileged
5656
namespace: kube-system
5757
labels:
5858
kubevirt.io: ""
5959
---
6060
apiVersion: rbac.authorization.k8s.io/v1beta1
6161
kind: ClusterRoleBinding
6262
metadata:
63-
name: kubevirt-infra
63+
name: kubevirt-controller
6464
namespace: kube-system
6565
labels:
6666
kubevirt.io: ""
6767
roleRef:
6868
kind: ClusterRole
69-
name: kubevirt-infra
69+
name: kubevirt-controller
7070
apiGroup: rbac.authorization.k8s.io
7171
subjects:
7272
- kind: ServiceAccount
73-
name: kubevirt-infra
73+
name: kubevirt-controller
7474
namespace: kube-system
7575
---
7676
apiVersion: rbac.authorization.k8s.io/v1beta1
7777
kind: ClusterRoleBinding
7878
metadata:
79-
name: kubevirt-infra-cluster-admin
79+
name: kubevirt-controller-cluster-admin
8080
namespace: kube-system
8181
labels:
8282
kubevirt.io: ""
@@ -86,5 +86,21 @@ roleRef:
8686
apiGroup: rbac.authorization.k8s.io
8787
subjects:
8888
- kind: ServiceAccount
89-
name: kubevirt-infra
89+
name: kubevirt-controller
90+
namespace: kube-system
91+
---
92+
apiVersion: rbac.authorization.k8s.io/v1beta1
93+
kind: ClusterRoleBinding
94+
metadata:
95+
name: kubevirt-privileged-cluster-admin
96+
namespace: kube-system
97+
labels:
98+
kubevirt.io: ""
99+
roleRef:
100+
kind: ClusterRole
101+
name: cluster-admin
102+
apiGroup: rbac.authorization.k8s.io
103+
subjects:
104+
- kind: ServiceAccount
105+
name: kubevirt-privileged
90106
namespace: kube-system

‎manifests/dev/virt-controller.yaml.in

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ spec:
2626
labels:
2727
kubevirt.io: virt-controller
2828
spec:
29-
serviceAccountName: kubevirt-infra
29+
serviceAccountName: kubevirt-controller
3030
containers:
3131
- name: virt-controller
3232
image: {{ docker_prefix }}/virt-controller:{{ docker_tag }}

‎manifests/dev/virt-handler.yaml.in

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ spec:
1212
labels:
1313
kubevirt.io: virt-handler
1414
spec:
15-
serviceAccountName: kubevirt-infra
15+
serviceAccountName: kubevirt-privileged
1616
hostPID: true
1717
containers:
1818
- name: virt-handler

‎manifests/release/kubevirt.yaml.in

Lines changed: 27 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
apiVersion: rbac.authorization.k8s.io/v1beta1
33
kind: ClusterRole
44
metadata:
5-
name: kubevirt-infra
5+
name: kubevirt-controller
66
namespace: kube-system
77
labels:
88
kubevirt.io: ""
@@ -45,39 +45,39 @@ rules:
4545
apiVersion: v1
4646
kind: ServiceAccount
4747
metadata:
48-
name: kubevirt-infra
48+
name: kubevirt-controller
4949
namespace: kube-system
5050
labels:
5151
kubevirt.io: ""
5252
---
5353
apiVersion: v1
5454
kind: ServiceAccount
5555
metadata:
56-
name: kubevirt-admin
56+
name: kubevirt-privileged
5757
namespace: kube-system
5858
labels:
5959
kubevirt.io: ""
6060
---
6161
apiVersion: rbac.authorization.k8s.io/v1beta1
6262
kind: ClusterRoleBinding
6363
metadata:
64-
name: kubevirt-infra
64+
name: kubevirt-controller
6565
namespace: kube-system
6666
labels:
6767
kubevirt.io: ""
6868
roleRef:
6969
kind: ClusterRole
70-
name: kubevirt-infra
70+
name: kubevirt-controller
7171
apiGroup: rbac.authorization.k8s.io
7272
subjects:
7373
- kind: ServiceAccount
74-
name: kubevirt-infra
74+
name: kubevirt-controller
7575
namespace: kube-system
7676
---
7777
apiVersion: rbac.authorization.k8s.io/v1beta1
7878
kind: ClusterRoleBinding
7979
metadata:
80-
name: kubevirt-infra-cluster-admin
80+
name: kubevirt-controller-cluster-admin
8181
namespace: kube-system
8282
labels:
8383
kubevirt.io: ""
@@ -87,7 +87,23 @@ roleRef:
8787
apiGroup: rbac.authorization.k8s.io
8888
subjects:
8989
- kind: ServiceAccount
90-
name: kubevirt-infra
90+
name: kubevirt-controller
91+
namespace: kube-system
92+
---
93+
apiVersion: rbac.authorization.k8s.io/v1beta1
94+
kind: ClusterRoleBinding
95+
metadata:
96+
name: kubevirt-privileged-cluster-admin
97+
namespace: kube-system
98+
labels:
99+
kubevirt.io: ""
100+
roleRef:
101+
kind: ClusterRole
102+
name: cluster-admin
103+
apiGroup: rbac.authorization.k8s.io
104+
subjects:
105+
- kind: ServiceAccount
106+
name: kubevirt-privileged
91107
namespace: kube-system
92108
---
93109
# custom resource definitions
@@ -157,7 +173,7 @@ spec:
157173
labels:
158174
kubevirt.io: virt-controller
159175
spec:
160-
serviceAccountName: kubevirt-infra
176+
serviceAccountName: kubevirt-controller
161177
containers:
162178
- name: virt-controller
163179
image: {{ docker_prefix }}/virt-controller:{{ docker_tag }}
@@ -205,7 +221,7 @@ spec:
205221
labels:
206222
kubevirt.io: virt-handler
207223
spec:
208-
serviceAccountName: kubevirt-infra
224+
serviceAccountName: kubevirt-privileged
209225
hostPID: true
210226
containers:
211227
- name: virt-handler
@@ -262,7 +278,7 @@ spec:
262278
labels:
263279
kubevirt.io: libvirt
264280
spec:
265-
serviceAccountName: kubevirt-infra
281+
serviceAccountName: kubevirt-privileged
266282
hostNetwork: true
267283
hostPID: true
268284
hostIPC: true

‎manifests/testing/iscsi-demo-target.yaml.in

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
---
12
apiVersion: v1
23
kind: PersistentVolumeClaim
34
metadata:
@@ -132,7 +133,7 @@ spec:
132133
kubevirt.io: iscsi-demo-target
133134
name: iscsi-demo-target-tgtd
134135
spec:
135-
serviceAccountName: kubevirt-infra
136+
serviceAccountName: kubevirt-testing
136137
containers:
137138
- name: target
138139
image: {{ docker_prefix }}/iscsi-demo-target-tgtd:{{ docker_tag }}

‎manifests/testing/rbac-for-testing.yaml.in

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
---
2+
apiVersion: v1
3+
kind: ServiceAccount
4+
metadata:
5+
name: kubevirt-testing
6+
namespace: kube-system
7+
labels:
8+
kubevirt.io: ""
9+
---
10+
apiVersion: rbac.authorization.k8s.io/v1beta1
11+
kind: ClusterRoleBinding
12+
metadata:
13+
name: kubevirt-testing-cluster-admin
14+
namespace: kube-system
15+
labels:
16+
kubevirt.io: ""
17+
roleRef:
18+
kind: ClusterRole
19+
name: cluster-admin
20+
apiGroup: rbac.authorization.k8s.io
21+
subjects:
22+
- kind: ServiceAccount
23+
name: kubevirt-testing
24+
namespace: kube-system

0 commit comments

Comments
 (0)