Use custom service accounts instead of default for controllers

kubernetes-sigs · Mar 10, 2021 · eceb123 · eceb123
1 parent 451d034
commit eceb123
Show file tree

Hide file tree

Showing 7 changed files with 12 additions and 5 deletions.
diff --git a/config/default/aad-pod-identity-deployment.yaml b/config/default/aad-pod-identity-deployment.yaml
@@ -63,7 +63,7 @@ metadata:
     k8s-app: capz-aad-pod-id-nmi-binding
 subjects:
 - kind: ServiceAccount
-  name: default
+  name: manager
   namespace: capz-system
 roleRef:
   kind: ClusterRole
@@ -92,7 +92,7 @@ spec:
         component: nmi
         tier: node
     spec:
-      serviceAccountName: default
+      serviceAccountName: manager
       hostNetwork: true
       dnsPolicy: ClusterFirstWithHostNet
       volumes:

diff --git a/config/manager/manager.yaml b/config/manager/manager.yaml
@@ -58,3 +58,4 @@ spec:
               fieldRef:
                 fieldPath: metadata.namespace      
       terminationGracePeriodSeconds: 10
+      serviceAccountName: manager
diff --git a/config/rbac/auth_proxy_role_binding.yaml b/config/rbac/auth_proxy_role_binding.yaml
@@ -8,5 +8,5 @@ roleRef:
   name: proxy-role
 subjects:
 - kind: ServiceAccount
-  name: default
+  name: manager
   namespace: system
diff --git a/config/rbac/kustomization.yaml b/config/rbac/kustomization.yaml
@@ -3,6 +3,7 @@ kind: Kustomization
 resources:
   - role.yaml
   - role_binding.yaml
+  - service_account.yaml
   - leader_election_role.yaml
   - leader_election_role_binding.yaml
   - auth_proxy_client_clusterrole.yaml

diff --git a/config/rbac/leader_election_role_binding.yaml b/config/rbac/leader_election_role_binding.yaml
@@ -8,5 +8,5 @@ roleRef:
   name: leader-election-role
 subjects:
 - kind: ServiceAccount
-  name: default
+  name: manager
   namespace: system
diff --git a/config/rbac/role_binding.yaml b/config/rbac/role_binding.yaml
@@ -8,5 +8,5 @@ roleRef:
   name: manager-role
 subjects:
 - kind: ServiceAccount
-  name: default
+  name: manager
   namespace: system
diff --git a/config/rbac/service_account.yaml b/config/rbac/service_account.yaml
@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: manager
+  namespace: system