public_git
/
postgres-operator
mirror of https://github.com/zalando/postgres-operator.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

decouple clusterrole name and serviceaccount name (#581) 

Decouple clusterrole name and service account name.
This commit is contained in:
Erik Inge Bolsø 2019-06-14 14:24:23 +02:00 committed by Jan Mussler
parent bbf28c4df7
commit 6fbfee3903
1 changed files with 5 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
pkg/controller/controller.go
View File

@ -197,25 +197,25 @@ func (c *Controller) initRoleBinding() {
// operator binds it to the cluster role with sufficient privileges // operator binds it to the cluster role with sufficient privileges
// we assume the role is created by the k8s administrator // we assume the role is created by the k8s administrator
if c.opConfig.PodServiceAccountRoleBindingDefinition == "" { if c.opConfig.PodServiceAccountRoleBindingDefinition == "" {
c.opConfig.PodServiceAccountRoleBindingDefinition = ` c.opConfig.PodServiceAccountRoleBindingDefinition = fmt.Sprintf(`
{ {
"apiVersion": "rbac.authorization.k8s.io/v1beta1", "apiVersion": "rbac.authorization.k8s.io/v1beta1",
"kind": "RoleBinding", "kind": "RoleBinding",
"metadata": { "metadata": {
"name": "zalando-postgres-operator" "name": "%s"
}, },
"roleRef": { "roleRef": {
"apiGroup": "rbac.authorization.k8s.io", "apiGroup": "rbac.authorization.k8s.io",
"kind": "ClusterRole", "kind": "ClusterRole",
"name": "zalando-postgres-operator" "name": "%s"
}, },
"subjects": [ "subjects": [
{ {
"kind": "ServiceAccount", "kind": "ServiceAccount",
"name": "operator" "name": "%s"
} }
] ]
}` }`, c.PodServiceAccount.Name, c.PodServiceAccount.Name, c.PodServiceAccount.Name)
} }
c.logger.Info("Parse role bindings") c.logger.Info("Parse role bindings")
// re-uses k8s internal parsing. See k8s client-go issue #193 for explanation // re-uses k8s internal parsing. See k8s client-go issue #193 for explanation
@ -230,9 +230,6 @@ func (c *Controller) initRoleBinding() {
default: default:
c.PodServiceAccountRoleBinding = obj.(*rbacv1beta1.RoleBinding) c.PodServiceAccountRoleBinding = obj.(*rbacv1beta1.RoleBinding)
c.PodServiceAccountRoleBinding.Namespace = "" c.PodServiceAccountRoleBinding.Namespace = ""
c.PodServiceAccountRoleBinding.ObjectMeta.Name = c.PodServiceAccount.Name
c.PodServiceAccountRoleBinding.RoleRef.Name = c.PodServiceAccount.Name
c.PodServiceAccountRoleBinding.Subjects[0].Name = c.PodServiceAccount.Name
c.logger.Info("successfully parsed") c.logger.Info("successfully parsed")
} }