feat: rename talos folder
This commit is contained in:
parent
ccac941e0a
commit
d33bc4b36b
3 changed files with 0 additions and 0 deletions
|
|
@ -1,86 +0,0 @@
|
|||
# Service Account
|
||||
|
||||
Lets create a service account for ci/cd activities in a new namespace.
|
||||
|
||||
## Namespace
|
||||
|
||||
```yaml
|
||||
cat <<EOF | kubectl apply -f -
|
||||
---
|
||||
apiVersion: "v1"
|
||||
kind: "Namespace"
|
||||
metadata:
|
||||
name: "my-namespace"
|
||||
EOF
|
||||
```
|
||||
|
||||
## ServiceAccount
|
||||
|
||||
```yaml
|
||||
cat <<EOF | kubectl apply -f -
|
||||
---
|
||||
apiVersion: "v1"
|
||||
kind: "ServiceAccount"
|
||||
metadata:
|
||||
name: "buzz"
|
||||
namespace: "my-namespace"
|
||||
EOF
|
||||
```
|
||||
|
||||
## Role
|
||||
|
||||
```yaml
|
||||
cat <<EOF | kubectl apply -f -
|
||||
---
|
||||
apiVersion: "rbac.authorization.k8s.io/v1"
|
||||
kind: "Role"
|
||||
metadata:
|
||||
namespace: "my-namespace"
|
||||
name: "buzz-role"
|
||||
rules:
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
- apiGroups: [""]
|
||||
resources: ["services", "configmaps", "secrets"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
- apiGroups: ["networking.k8s.io"]
|
||||
resources: ["ingresses"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
EOF
|
||||
```
|
||||
|
||||
## RoleBinding
|
||||
|
||||
```yaml
|
||||
cat <<EOF | kubectl apply -f -
|
||||
---
|
||||
apiVersion: "rbac.authorization.k8s.io/v1"
|
||||
kind: "RoleBinding"
|
||||
metadata:
|
||||
name: "buzz-binding"
|
||||
namespace: "my-namespace"
|
||||
subjects:
|
||||
- kind: "ServiceAccount"
|
||||
name: "buzz"
|
||||
namespace: "my-namespace"
|
||||
roleRef:
|
||||
kind: "Role"
|
||||
name: "buzz-role"
|
||||
apiGroup: "rbac.authorization.k8s.io"
|
||||
EOF
|
||||
```
|
||||
|
||||
## Token and KubeConfig (OmnI)
|
||||
|
||||
Get the token for the user.
|
||||
|
||||
```shell
|
||||
kubectl create token buzz -n my-namespace
|
||||
```
|
||||
|
||||
When using OmnI you can get the service account details (kubeconfig) using the following command;
|
||||
|
||||
```shell
|
||||
omnictl kubeconfig --service-account -c <cluster-name> --user buzz /tmp/buzz-kubeconfig.yaml
|
||||
```
|
||||
Loading…
Add table
Add a link
Reference in a new issue