Fix vsphere cloud_provider RBAC permissions
This commit is contained in:
parent
69a3c33ceb
commit
9a4aa4288c
2 changed files with 62 additions and 0 deletions
|
@ -75,6 +75,33 @@
|
||||||
- node_webhook_crb_manifest.changed
|
- node_webhook_crb_manifest.changed
|
||||||
tags: node-webhook
|
tags: node-webhook
|
||||||
|
|
||||||
|
- name: Write vsphere-cloud-provider ClusterRole manifest
|
||||||
|
template:
|
||||||
|
src: "vsphere-rbac.yml.j2"
|
||||||
|
dest: "{{ kube_config_dir }}/vsphere-rbac.yml"
|
||||||
|
register: vsphere_rbac_manifest
|
||||||
|
when:
|
||||||
|
- rbac_enabled
|
||||||
|
- cloud_provider is defined
|
||||||
|
- cloud_provider == 'vsphere'
|
||||||
|
- kube_version | version_compare('v1.9.0', '>=')
|
||||||
|
tags: vsphere
|
||||||
|
|
||||||
|
- name: Apply vsphere-cloud-provider ClusterRole
|
||||||
|
kube:
|
||||||
|
name: "system:vsphere-cloud-provider"
|
||||||
|
kubectl: "{{bin_dir}}/kubectl"
|
||||||
|
resource: "clusterrolebinding"
|
||||||
|
filename: "{{ kube_config_dir }}/vsphere-rbac.yml"
|
||||||
|
state: latest
|
||||||
|
when:
|
||||||
|
- rbac_enabled
|
||||||
|
- cloud_provider is defined
|
||||||
|
- cloud_provider == 'vsphere'
|
||||||
|
- vsphere_rbac_manifest.changed
|
||||||
|
- kube_version | version_compare('v1.9.0', '>=')
|
||||||
|
tags: vsphere
|
||||||
|
|
||||||
# This is not a cluster role, but should be run after kubeconfig is set on master
|
# This is not a cluster role, but should be run after kubeconfig is set on master
|
||||||
- name: Write kube system namespace manifest
|
- name: Write kube system namespace manifest
|
||||||
template:
|
template:
|
||||||
|
|
|
@ -0,0 +1,35 @@
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: system:vsphere-cloud-provider
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- nodes
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- events
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: system:vsphere-cloud-provider
|
||||||
|
roleRef:
|
||||||
|
kind: ClusterRole
|
||||||
|
name: system:vsphere-cloud-provider
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: vsphere-cloud-provider
|
||||||
|
namespace: kube-system
|
Loading…
Reference in a new issue