Merge "Replace deprecatedPublicIPs with externalIPs for Heapster."
diff --git a/kubernetes/files/kube-addons/helm/helm-role.yml b/kubernetes/files/kube-addons/helm/helm-role.yml
new file mode 100644
index 0000000..455a482
--- /dev/null
+++ b/kubernetes/files/kube-addons/helm/helm-role.yml
@@ -0,0 +1,14 @@
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+ labels:
+ addonmanager.kubernetes.io/mode: Reconcile
+ name: tiller
+roleRef:
+ apiGroup: rbac.authorization.k8s.io
+ kind: ClusterRole
+ name: cluster-admin
+subjects:
+ - kind: ServiceAccount
+ name: tiller
+ namespace: kube-system
diff --git a/kubernetes/files/kube-addons/helm/helm-serviceaccount.yml b/kubernetes/files/kube-addons/helm/helm-serviceaccount.yml
new file mode 100644
index 0000000..caa22ff
--- /dev/null
+++ b/kubernetes/files/kube-addons/helm/helm-serviceaccount.yml
@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ labels:
+ addonmanager.kubernetes.io/mode: Reconcile
+ name: tiller
+ namespace: kube-system
diff --git a/kubernetes/files/kube-addons/helm/helm-tiller-deploy.yml b/kubernetes/files/kube-addons/helm/helm-tiller-deploy.yml
index 4c87aa8..cfbb823 100644
--- a/kubernetes/files/kube-addons/helm/helm-tiller-deploy.yml
+++ b/kubernetes/files/kube-addons/helm/helm-tiller-deploy.yml
@@ -1,4 +1,5 @@
{%- from "kubernetes/map.jinja" import common with context -%}
+{%- from "kubernetes/map.jinja" import master with context -%}
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
@@ -21,6 +22,9 @@
app: helm
name: tiller
spec:
+ {%- if 'RBAC' in master.auth.get('mode', "") %}
+ serviceAccountName: tiller
+ {%- endif %}
tolerations:
- key: node-role.kubernetes.io/master
effect: NoSchedule
diff --git a/kubernetes/master/kube-addons.sls b/kubernetes/master/kube-addons.sls
index 3682b43..a6773df 100644
--- a/kubernetes/master/kube-addons.sls
+++ b/kubernetes/master/kube-addons.sls
@@ -60,6 +60,26 @@
- dir_mode: 755
- makedirs: True
+{%- if 'RBAC' in master.auth.get('mode', "") %}
+
+/etc/kubernetes/addons/helm/helm-role.yml:
+ file.managed:
+ - source: salt://kubernetes/files/kube-addons/helm/helm-role.yml
+ - template: jinja
+ - group: root
+ - dir_mode: 755
+ - makedirs: True
+
+/etc/kubernetes/addons/helm/helm-serviceaccount.yml:
+ file.managed:
+ - source: salt://kubernetes/files/kube-addons/helm/helm-serviceaccount.yml
+ - template: jinja
+ - group: root
+ - dir_mode: 755
+ - makedirs: True
+
+{%- endif %}
+
{% endif %}
{%- if common.addons.storageclass is defined %}