Merge pull request #1210 from Nordix/furkat/use-individual-sa

⚠️ Use custom service accounts instead of default for controllers

config/default/aad-pod-identity-deployment.yaml

@@ -63,8 +63,8 @@ metadata:
     k8s-app: capz-aad-pod-id-nmi-binding
 subjects:
 - kind: ServiceAccount
-  name: default
-  namespace: capz-system
+  name: manager
+  namespace: system
 roleRef:
   kind: ClusterRole
   name: aad-pod-id-nmi-role
@@ -92,7 +92,7 @@ spec:
         component: nmi
         tier: node
     spec:
-      serviceAccountName: default
+      serviceAccountName: manager
       hostNetwork: true
       dnsPolicy: ClusterFirstWithHostNet
       volumes:

config/manager/manager.yaml

@@ -58,3 +58,4 @@ spec:
               fieldRef:
                 fieldPath: metadata.namespace      
       terminationGracePeriodSeconds: 10
+      serviceAccountName: manager

config/rbac/auth_proxy_role_binding.yaml

@@ -8,5 +8,5 @@ roleRef:
   name: proxy-role
 subjects:
 - kind: ServiceAccount
-  name: default
+  name: manager
   namespace: system

config/rbac/kustomization.yaml

@@ -3,6 +3,7 @@ kind: Kustomization
 resources:
   - role.yaml
   - role_binding.yaml
+  - service_account.yaml
   - leader_election_role.yaml
   - leader_election_role_binding.yaml
   - auth_proxy_client_clusterrole.yaml

config/rbac/leader_election_role_binding.yaml

@@ -8,5 +8,5 @@ roleRef:
   name: leader-election-role
 subjects:
 - kind: ServiceAccount
-  name: default
+  name: manager
   namespace: system

config/rbac/role_binding.yaml

@@ -8,5 +8,5 @@ roleRef:
   name: manager-role
 subjects:
 - kind: ServiceAccount
-  name: default
+  name: manager
   namespace: system

config/rbac/service_account.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: manager
+  namespace: system