Move new daemonset on top of the main one to see what happens with k8…

…s 1.5

prog/weave-kube/weave-daemonset.yaml

@@ -1,3 +1,49 @@
+#
+# WARNING: This YAML file applies to Kubernetes at HEAD (currently around v1.6.0-alpha.2)
+#
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1beta1
+metadata:
+  name: weave-net
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - namespaces
+  - nodes
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - extensions
+  resources:
+  - networkpolicies
+  verbs:
+  - get
+  - list
+  - watch
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: weave-net
+  namespace: kube-system
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1beta1
+metadata:
+  name: weave-net
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: weave-net
+subjects:
+- kind: ServiceAccount
+  name: weave-net
+  namespace: kube-system
+---
 apiVersion: extensions/v1beta1
 kind: DaemonSet
 metadata:
@@ -9,6 +55,7 @@ spec:
       labels:
         name: weave-net
       annotations:
+        # TODO: Move this field to the Tolerations property of PodSpec once it's possible
         scheduler.alpha.kubernetes.io/tolerations: |
           [
             {
@@ -58,6 +105,10 @@ spec:
           securityContext:
             privileged: true
       restartPolicy: Always
+      serviceAccountName: weave-net
+      securityContext:
+        seLinuxOptions:
+          type: spc_t
       volumes:
         - name: weavedb
           emptyDir: {}