mercedes-benz / namespace-provisioner Goto Github PK
View Code? Open in Web Editor NEWA Kubernetes operator creating K8s resources by annotating namespaces
License: MIT License
A Kubernetes operator creating K8s resources by annotating namespaces
License: MIT License
The provided task deploy-local
fails when trying to deploy the namespace provisioner into minikube with running k8s version 1.16, because the used apiVersion
extensions/v1beta1
for Deployment
is not served by default in k8s 1.16.
Hi,
I was following the README file to set up the namespace provisioner in minikube. The step that required me to supply my own kube config didn't work quite as expected, since minkube hardcodes path to certificates and private key to host paths, rather than supplying them as base64-encoded '-data'. Additionally, I wasn't sure about adding user account data to a service made any sense. So, I found out there's something called ServiceAccount, which was made exactly for these purposes.
I modified the installation as follows:
apiVersion: v1
kind: ServiceAccount
metadata:
name: namespace-provisioner
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: namespace-provisioner
rules:
- apiGroups: ["", "batch", "extensions", "apps", "rbac.authorization.k8s.io", "networking.k8s.io"]
resources: ["*"]
verbs: ["*"]
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: namespace-provisioner
namespace: default
subjects:
- kind: ServiceAccount
name: namespace-provisioner
namespace: default
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: namespace-provisioner
apiVersion: apps/v1
kind: Deployment
metadata:
name: namespace-provisioner-deployment
labels:
app: namespace-provisioner
spec:
replicas: 1
selector:
matchLabels:
app: namespace-provisioner
template:
metadata:
labels:
app: namespace-provisioner
spec:
serviceAccountName: namespace-provisioner
containers:
- name: namespace-provisioner
...
apiVersion: v1
clusters:
- cluster:
certificate-authority: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
server: https://kubernetes.default.svc
name: default
contexts:
- context:
cluster: default
user: default
name: default
current-context: default
kind: Config
preferences: {}
users:
- name: default
user:
tokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
There are two things here that could be improved. First one is obviously cluster role, which is way too permissive, and should be restricted to what the namespace-provisioner can/should manage.
Second one is obviously providing hardcoded .kube/config from outside, when it can be placed inside docker image, or not used at all, and use the kubernetes API with service accounts, as intended.
When looking at the Docker image that is created using task docker:build
it shows a size of approx. 80 MB although the Alpine base image's size is approx. 5 MB and the namespace-provisioner executable's size is approx. 37 MB.
When taking a detailed look at the layers of the image it can be noticed that there are 2 layers with exactly the same size and approx. the size of the namespace-provisioner's executable. Maybe there's something wrong with the Docker image creation.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.