Add ServiceAccounts for kube-scheduler and kube-apiserver, remove default #99
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Require all components in kube-system define their own ServiceAccount, the default kube-system ServiceAccount is no longer bound.
kube-scheduler
ServiceAccount and ClusterRoleBindingkube-scheduler
from using thekube-system
default service account (with cluster-admin) to using a kube-scheduler ServiceAccount bound to the builtinsystem:kube-scheduler
andsystem:volume-scheduler
(required for StorageClass) ClusterRoleskube-apiserver
ServiceAccount and ClusterRoleBindingkube-apiserver
from using the kube-system default service account (with cluster-admin) to using a kube-apiserver ServiceAccount bound the the cluster-admin ClusterRole (as before)default-sa
ClusterRoleBinding that allowed kube-apiserver and kube-scheduler (or other 3rd-party components added to kube-system) to use thekube-system
default
ServiceAccount for cluster-admin