[RBAC] Adjust system:kube-dns rules for configmaps
Without additional rules we are getting the following error in
contrainer:
E0205 09:11:38.505998 1 dns.go:183] Error getting initial
ConfigMap: configmaps "kube-dns" is forbidden: User
"system:serviceaccount:kube-system:kube-dns" cannot get configmaps in
the namespace "kube-system", starting with default values
We doesn't have configmap for kubedns atm, but this patch will save
some time for those who will create configmap for any other purposes.
Change-Id: I1c0cafab735059cb66cd892b9ecfceb29469fd44
diff --git a/kubernetes/files/kube-addons/dns/kubedns-clusterrole.yaml b/kubernetes/files/kube-addons/dns/kubedns-clusterrole.yaml
new file mode 100644
index 0000000..e977571
--- /dev/null
+++ b/kubernetes/files/kube-addons/dns/kubedns-clusterrole.yaml
@@ -0,0 +1,25 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+ labels:
+ addonmanager.kubernetes.io/mode: Reconcile
+ kubernetes.io/bootstrapping: rbac-defaults
+ name: "system:kube-dns"
+rules:
+- apiGroups:
+ - ""
+ resources:
+ - endpoints
+ - services
+ verbs:
+ - list
+ - watch
+- apiGroups:
+ - ""
+ resources:
+ - configmaps
+ verbs:
+ - get
+ - list
+ - watch
diff --git a/kubernetes/master/kube-addons.sls b/kubernetes/master/kube-addons.sls
index 43d81d9..81cb768 100644
--- a/kubernetes/master/kube-addons.sls
+++ b/kubernetes/master/kube-addons.sls
@@ -198,6 +198,14 @@
- dir_mode: 755
- makedirs: True
+/etc/kubernetes/addons/dns/kubedns-clusterrole.yaml:
+ file.managed:
+ - source: salt://kubernetes/files/kube-addons/dns/kubedns-clusterrole.yaml
+ - template: jinja
+ - group: root
+ - dir_mode: 755
+ - makedirs: True
+
{% endif %}
{% endif %}