Seperates manager.yaml into patches

kubeproxy/config/manager/kustomization.yaml

@@ -6,3 +6,6 @@ images:
 - name: controller
   newName: controller
   newTag: latest
+patchesStrategicMerge:
+- patches/apiserver_endpoint.patch.yaml
+- patches/tolerations_controlplane.patch.yaml

kubeproxy/config/manager/manager.yaml

@@ -31,11 +31,6 @@ spec:
         image: controller:latest
         imagePullPolicy: IfNotPresent
         name: manager
-        env:
-          - name: KUBERNETES_SERVICE_HOST
-            value: "172.17.0.2"
-          - name: KUBERNETES_SERVICE_PORT
-            value: "6443"
         resources:
           limits:
             cpu: 100m
@@ -44,10 +39,3 @@ spec:
             cpu: 100m
             memory: 20Mi
       terminationGracePeriodSeconds: 10
-      tolerations:
-      - key: "node.kubernetes.io/not-ready"
-        operator: "Exists"
-        effect: "NoSchedule"
-      - key: "node-role.kubernetes.io/master"
-        operator: "Exists"
-        effect: "NoSchedule"

kubeproxy/config/manager/patches/apiserver_endpoint.patch.yaml

@@ -0,0 +1,15 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: controller-manager
+  namespace: system
+spec:
+  template:
+    spec:
+      containers:
+      - name: manager
+        env:
+          - name: KUBERNETES_SERVICE_HOST
+            value: "172.17.0.2"
+          - name: KUBERNETES_SERVICE_PORT
+            value: "6443"

kubeproxy/config/manager/patches/tolerations_controlplane.patch.yaml

@@ -0,0 +1,15 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: controller-manager
+  namespace: system
+spec:
+  template:
+    spec:
+      tolerations:
+      - key: "node.kubernetes.io/not-ready"
+        operator: "Exists"
+        effect: "NoSchedule"
+      - key: "node-role.kubernetes.io/master"
+        operator: "Exists"
+        effect: "NoSchedule"

kubeproxy/config/rbac/auth_proxy_role.yaml

@@ -11,24 +11,3 @@ rules:
   resources:
   - subjectaccessreviews
   verbs: ["create"]
-- apiGroups: [""]
-  resources: ["*"]
-  verbs: ["list", "get", "watch"]
-- apiGroups: [""]
-  resources: ["events", "serviceaccounts"]
-  verbs: ["create", "patch", "update"]
-- apiGroups: ["apps", "extensions"]
-  resources: ["daemonsets"]
-  verbs: ["get", "watch", "list", "create", "patch"]
-- apiGroups: ["rbac.authorization.k8s.io"]
-  resources: ["clusterrolebindings"]
-  verbs: ["get", "watch", "list", "create"]
-- apiGroups: ["app.k8s.io"]
-  resources: ["applications"]
-  verbs: ["get", "watch", "list", "create", "patch"]
-- apiGroups: ["discovery.k8s.io"]
-  resources: ["endpointslices"]
-  verbs: ["list", "watch"]
-- apiGroups: ["events.k8s.io"]
-  resources: ["events"]
-  verbs: ["create", "patch", "update"]