feat(rbac): use real ServiceAccount instead of default

Closes kubernetes-sigs#518
cwrau · May 7, 2024 · 7b21533 · 7b21533
1 parent 22b3a28
commit 7b21533
Show file tree

Hide file tree

Showing 6 changed files with 12 additions and 2 deletions.
diff --git a/config/manager/manager.yaml b/config/manager/manager.yaml
@@ -15,6 +15,8 @@ spec:
       labels:
         control-plane: controller-manager
     spec:
+      serviceAccountName: manager
+      automountServiceAccountToken: true
       containers:
       - command:
         - /manager

diff --git a/config/rbac/kustomization.yaml b/config/rbac/kustomization.yaml
@@ -3,3 +3,4 @@ resources:
 - role_binding.yaml
 - leader_election_role.yaml
 - leader_election_role_binding.yaml
+- service_account.yaml
diff --git a/config/rbac/leader_election_role_binding.yaml b/config/rbac/leader_election_role_binding.yaml
@@ -8,5 +8,5 @@ roleRef:
   name: leader-election-role
 subjects:
 - kind: ServiceAccount
-  name: default
+  name: manager
   namespace: system
diff --git a/config/rbac/role_binding.yaml b/config/rbac/role_binding.yaml
@@ -8,5 +8,5 @@ roleRef:
   name: manager-role
 subjects:
 - kind: ServiceAccount
-  name: default
+  name: manager
   namespace: system
diff --git a/config/rbac/service_account.yaml b/config/rbac/service_account.yaml
@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: manager
+  namespace: system
diff --git a/hack/charts/cluster-api-operator/templates/deployment.yaml b/hack/charts/cluster-api-operator/templates/deployment.yaml
@@ -47,6 +47,8 @@ spec:
       {{- toYaml . | nindent 8 }}
       {{- end }}
     spec:
+      serviceAccountName: capi-operator-manager
+      automountServiceAccountToken: true
       {{- with .Values.securityContext }}
       securityContext:
       {{- toYaml . | nindent 8 }}