Installing VIP Authentication Hub, how to avoid deploying templates from the resource Role, RoleBinding and ServiceAccount?
Existing service accounts can be used to be passed in instead of setting Role, RoleBinding and ServiceAccount.
SSP (dataseed and scheduler pods) MUST run as a service account that is allowed to create secrets in the SSP namespace.
SSP chart is capable of automatically creating the required service account, Role, and RoleBinding. This requires that the operator that executes the deployment of the SSP chart has enough permissions to create the ServiceAccount, Role, RoleBinding, and Secret described below.
To get the chart to SKIP the creation of Role, RoleBinding and ServiceAccount, create the objects below before running the SSP helm deployment command.
Kubernetes (K8S) commands to create the required SA Token:
Create a Service Account
# cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: ServiceAccount
metadata:
name: ${RELEASENAME}-ssp-secrets-writer-sa
namespace: ${NAMESPACE}
automountServiceAccountToken: false
EOF
Create a Kubernetes Role (in the SSP namespace)
# cat <<EOF | kubectl apply -f -
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: ${RELEASENAME}-ssp-secrets-writer
namespace: ${NAMESPACE}
rules:
- apiGroups: [""]
resources: ["secrets"]
verbs: ["get", "watch", "list", "create", "update", "delete"]
EOF
Grant the Role to the Service account using a RoleBinding object:
# cat <<EOF | kubectl apply -f -
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: ${RELEASENAME}-ssp-secrets-sa
namespace: ${NAMESPACE}
subjects:
- kind: ServiceAccount
name: ${RELEASENAME}-ssp-secrets-writer-sa
namespace: ${NAMESPACE}
roleRef:
kind: Role
name: ${RELEASENAME}-ssp-secrets-writer
apiGroup: rbac.authorization.k8s.io
EOF
Create a ServiceAccount Token Secret (name: ${RELEASENAME}-ssp-sa-secret):
# cat <<EOF | kubectl apply -f -
# Secret for ServiceAccount for token
apiVersion: v1
kind: Secret
metadata:
name: ${RELEASENAME}-ssp-sa-secret
namespace: ${NAMESPACE}
annotations:
kubernetes.io/service-account.name: ${RELEASENAME}-ssp-secrets-writer-sa
type: kubernetes.io/service-account-token
EOF
During SSP's chart deployment, add the following parameter to SSP's helm deployment command:
--set ssp.global.existingDataseedSATokenSecret=<serviceAccountToken's secret name>
e.g.
--set ssp.global.existingDataseedSATokenSecret=${RELEASENAME}-ssp-sa-secret