Use kustomize for example manifest#221
Conversation
k8s-ci-robot
added
release-note
k8s-ci-robot
added
approved
| - list | ||
| - watch | ||
| - update | ||
| - watch |
There was a problem hiding this comment.
No change, just reordered.
| - list | ||
| - watch | ||
| - update | ||
| - watch |
There was a problem hiding this comment.
No change, just reordered.
| - list | ||
| - patch | ||
| - update | ||
| - watch |
There was a problem hiding this comment.
The cloud node controllers do not need create node or delete node.
| - watch | ||
| - apiGroups: | ||
| - "" | ||
| resourceNames: |
There was a problem hiding this comment.
Only allow service account creation for the cloud controller resource names.
| - list | ||
| - patch | ||
| - update | ||
| - watch |
There was a problem hiding this comment.
I don't think list is possible with subresources, and I'm not sure about watch but we definitely don't do it.
docs/getting_started.md
Outdated
| 1. Deploy the cloud-controller-manager to your cluster: | ||
| `kubectl apply -f https://raw.githubusercontent.com/kubernetes/cloud-provider-aws/master/manifests/aws-cloud-controller-manager-daemonset.yaml` | ||
| 1. Apply the kustomize configuration: | ||
| `kubectl apply -k ./manifests/base` |
There was a problem hiding this comment.
this assumes you cloned it though compared to above ones
There was a problem hiding this comment.
Correct. I thought it was a reasonable to require customers to clone the repo if we end up doing kustomize, but there are ways around it--kustomize supports some kinds of remote builds, i.e: kustomize build "github.com/kubernetes-sigs/kustomize/examples/multibases/dev/?ref=v1.0.6" is given as an example.
There was a problem hiding this comment.
Its actually pretty cool, try this: kustomize build 'github.com/nckturner/cloud-provider-aws/manifests/base/?ref=use-kustomize-to-reduce-permissions'. I'll update the build command.
nckturner
force-pushed
the
use-kustomize-to-reduce-permissions
branch
from
786944d to
941cd81
Compare
- reduce permissions on default manifest for use with --use-service-account-credentials=true - still give a "superset" configuration overlay for when this flag is disabled.
nckturner
force-pushed
the
use-kustomize-to-reduce-permissions
branch
from
941cd81 to
064d63b
Compare
|
/lgtm |
k8s-ci-robot
added
the
lgtm
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: nckturner, wongma7 The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
3 participants
What type of PR is this?
/kind cleanup
What this PR does / why we need it:
--use-service-account-credentials=truein base manifest.--use-service-account-credentials=true.--configure-cloud-routes=false.Which issue(s) this PR fixes:
Fixes #
Special notes for your reviewer:
Does this PR introduce a user-facing change?: