130 lines
3.2 KiB
Terraform
130 lines
3.2 KiB
Terraform
resource "kubernetes_service_account" "operator_service_account" {
|
|
metadata {
|
|
name = "operator"
|
|
namespace = "default"
|
|
}
|
|
}
|
|
|
|
resource "kubernetes_cluster_role" "operator_maintenance_role" {
|
|
metadata {
|
|
name = "operator-maintenance-role"
|
|
}
|
|
|
|
# Allow managing Pods (create, delete, exec, restart)
|
|
rule {
|
|
api_groups = [""]
|
|
resources = ["pods"]
|
|
verbs = ["get", "list", "watch", "create", "delete", "patch", "update", "exec"]
|
|
}
|
|
|
|
rule {
|
|
api_groups = [""]
|
|
resources = ["replicationcontrollers"]
|
|
verbs = ["get", "list"]
|
|
}
|
|
|
|
rule {
|
|
api_groups = ["autoscaling"]
|
|
resources = ["horizontalpodautoscalers"]
|
|
verbs = ["get", "list", "watch"]
|
|
}
|
|
|
|
rule {
|
|
api_groups = ["apps"]
|
|
resources = ["deployments", "replicasets", "statefulsets", "daemonsets"]
|
|
verbs = ["get", "list", "watch"]
|
|
}
|
|
|
|
rule {
|
|
api_groups = ["batch"]
|
|
resources = ["cronjobs"]
|
|
verbs = ["get", "list", "watch"]
|
|
}
|
|
|
|
rule {
|
|
api_groups = ["batch"]
|
|
resources = ["jobs"]
|
|
verbs = ["get", "list", "watch", "create", "delete", "patch", "update"]
|
|
}
|
|
|
|
# Allow reading Pod logs
|
|
rule {
|
|
api_groups = [""]
|
|
resources = ["pods/log"]
|
|
verbs = ["get", "list"]
|
|
}
|
|
|
|
# Allow managing Pod eviction for draining nodes, etc.
|
|
rule {
|
|
api_groups = ["policy"]
|
|
resources = ["pods/eviction"]
|
|
verbs = ["create"]
|
|
}
|
|
|
|
# Allow reading Namespaces (usually required for multi-namespace tools)
|
|
rule {
|
|
api_groups = [""]
|
|
resources = ["namespaces"]
|
|
verbs = ["get", "list", "watch"]
|
|
}
|
|
|
|
# Allow reading and managing PodDisruptionBudgets (useful for draining nodes)
|
|
rule {
|
|
api_groups = ["policy"]
|
|
resources = ["poddisruptionbudgets"]
|
|
verbs = ["get", "list", "watch", "patch", "update"]
|
|
}
|
|
|
|
# Allow managing Nodes (e.g., for cordoning, draining)
|
|
rule {
|
|
api_groups = [""]
|
|
resources = ["nodes"]
|
|
verbs = ["get", "list", "patch", "update"]
|
|
}
|
|
|
|
# Allow reading PersistentVolumeClaims (PVCs) but not PersistentVolumes
|
|
rule {
|
|
api_groups = [""]
|
|
resources = ["persistentvolumeclaims"]
|
|
verbs = ["get", "list", "watch"]
|
|
}
|
|
|
|
# Allow listing and getting services and endpoints (but not updating)
|
|
rule {
|
|
api_groups = [""]
|
|
resources = ["services", "endpoints"]
|
|
verbs = ["get", "list", "watch"]
|
|
}
|
|
}
|
|
|
|
resource "kubernetes_cluster_role_binding" "operator_maintenance_binding" {
|
|
metadata {
|
|
name = "operator-maintenance-binding"
|
|
}
|
|
|
|
role_ref {
|
|
kind = "ClusterRole"
|
|
name = kubernetes_cluster_role.operator_maintenance_role.metadata[0].name
|
|
api_group = "rbac.authorization.k8s.io"
|
|
}
|
|
|
|
subject {
|
|
kind = "ServiceAccount"
|
|
namespace = "default"
|
|
name = kubernetes_service_account.operator_service_account.metadata[0].name
|
|
}
|
|
}
|
|
|
|
resource "kubernetes_secret" "operator_access_token" {
|
|
metadata {
|
|
annotations = {
|
|
"kubernetes.io/service-account.name" = kubernetes_service_account.operator_service_account.metadata[0].name
|
|
}
|
|
name = "operator-token"
|
|
namespace = "default"
|
|
}
|
|
|
|
type = "kubernetes.io/service-account-token"
|
|
wait_for_service_account_token = true
|
|
}
|