bubua12/auto-config-controller repository overview

# 创建专门的 ServiceAccount，放在devops下
apiVersion: v1
kind: ServiceAccount
metadata:
  name: syncplant-controller-sa
  namespace: devops
---
# 创建 ClusterRole 因为操作跨 namespace 的 deployment/service/pod
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: syncplant-controller-cr
rules:
  - apiGroups: [ "apps" ]
    resources: [ "deployments" ]
    verbs: [ "get", "list", "watch", "update", "patch" ]

  - apiGroups: [ "" ]
    resources: [ "services", "pods" ]
    verbs: [ "get", "list", "watch", "create", "update", "patch" ]
---
# 使用 ClusterRoleBinding，把权限只绑定到这个 SA（安全）
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: syncplant-controller-crb
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: syncplant-controller-cr
subjects:
  - kind: ServiceAccount
    name: syncplant-controller-sa
    namespace: devops   # Controller 所在的 namespace
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: syncplant-svc-controller
  namespace: devops
spec:
  replicas: 1
  selector:
    matchLabels:
      app: syncplant-svc-controller
  template:
    metadata:
      labels:
        app: syncplant-svc-controller
    spec:
      serviceAccountName: syncplant-controller-sa
      containers:
        - name: controller
          image: bubua12/auto-config-controller:latest
          imagePullPolicy: IfNotPresent