docs-simoncor-net/docs/talos/service_account.md

Service Account

Lets create a service account for ci/cd activities in a new namespace.

Namespace

cat <<EOF | kubectl apply -f -
---
apiVersion: "v1"
kind: "Namespace"
metadata:
  name: "my-namespace"
EOF

ServiceAccount

cat <<EOF | kubectl apply -f -
---
apiVersion: "v1"
kind: "ServiceAccount"
metadata:
  name: "buzz"
  namespace: "my-namespace"
EOF

Role

cat <<EOF | kubectl apply -f -
---
apiVersion: "rbac.authorization.k8s.io/v1"
kind: "Role"
metadata:
  namespace: "my-namespace"
  name: "buzz-role"
rules:
- apiGroups: ["apps"]
  resources: ["deployments"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
- apiGroups: [""]
  resources: ["services", "configmaps", "secrets"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
- apiGroups: ["networking.k8s.io"]
  resources: ["ingresses"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
EOF

RoleBinding

cat <<EOF | kubectl apply -f -
---
apiVersion: "rbac.authorization.k8s.io/v1"
kind: "RoleBinding"
metadata:
  name: "buzz-binding"
  namespace: "my-namespace"
subjects:
- kind: "ServiceAccount"
  name: "buzz"
  namespace: "my-namespace"
roleRef:
  kind: "Role"
  name: "buzz-role"
  apiGroup: "rbac.authorization.k8s.io"
EOF

Token and KubeConfig (OmnI)

Get the token for the user.

kubectl create token buzz -n my-namespace

When using OmnI you can get the service account details (kubeconfig) using the following command;

omnictl kubeconfig --service-account -c <cluster-name> --user buzz /tmp/buzz-kubeconfig.yaml