Usando kustomize , me gustaría establecer un campo de espacio de namespace para todos mis objetos.
Aquí está mi kustomization.yaml :
apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization patchesJson6902: - patch: |- - op: replace path: /kind value: RoleBinding target: group: rbac.authorization.k8s.io kind: ClusterRoleBinding name: manager-rolebinding version: v1 resources: - role_binding.yaml namespace: <NAMESPACE> Aquí está mi archivo de recursos: role_binding.yaml :
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: manager-rolebinding roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: manager-role subjects: - kind: ServiceAccount name: controller-manager namespace: system --- apiVersion: apps/v1 kind: Deployment metadata: name: controller-manager namespace: system spec: selector: matchLabels: control-plane: controller-manager replicas: 1 template: metadata: labels: control-plane: controller-manager spec: containers: - command: - /manager args: - --enable-leader-election image: controller:latest name: manager Y kustomize la salida:
$ kustomize build apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: manager-rolebinding roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: manager-role subjects: - kind: ServiceAccount name: controller-manager namespace: system --- apiVersion: apps/v1 kind: Deployment metadata: name: controller-manager namespace: <NAMESPACE> spec: replicas: 1 selector: matchLabels: control-plane: controller-manager template: metadata: labels: control-plane: controller-manager spec: containers: - args: - --enable-leader-election command: - /manager image: controller:latest name: manager ¿Cómo puedo parchear el campo de namespace de nombres en RoleBinding y establecerlo en <NAMESPACE> ? En el ejemplo anterior, funciona perfectamente para el recurso de Deployment , pero no para RoleBinding .
Aquí hay una solución que resuelve el problema, usando kustomize-v4.0.5 :
cat <<EOF > kustomization.yaml apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization patchesJson6902: - patch: |- - op: replace path: /kind value: RoleBinding - op: add path: /metadata/namespace value: <NAMESPACE> target: group: rbac.authorization.k8s.io kind: ClusterRoleBinding name: manager-rolebinding version: v1 resources: - role_binding.yaml - service_account.yaml namespace: <NAMESPACE> EOF cat <<EOF > role_binding.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: manager-rolebinding roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: manager-role subjects: - kind: ServiceAccount name: controller-manager namespace: system --- apiVersion: apps/v1 kind: Deployment metadata: name: controller-manager namespace: system spec: selector: matchLabels: control-plane: controller-manager replicas: 1 template: metadata: labels: control-plane: controller-manager spec: containers: - command: - /manager args: - --enable-leader-election image: controller:latest name: manager EOF cat <<EOF > service_account.yaml apiVersion: v1 kind: ServiceAccount metadata: name: controller-manager namespace: system EOF Agregar el recurso ServiceAccount y el campo Namespace en el recurso RoleBinding permite establecer correctamente el campo de subject en RoleBinding .
Mirando directamente desde el código :
// roleBindingHack is a hack for implementing the namespace transform // for RoleBinding and ClusterRoleBinding resource types. // RoleBinding and ClusterRoleBinding have namespace set on // elements of the "subjects" field if and only if the subject elements // "name" is "default". Otherwise the namespace is not set. // // Example: // // kind: RoleBinding // subjects: // - name: "default" # this will have the namespace set // ... // - name: "something-else" # this will not have the namespace set // ... ServiceAccount y la referencia en ClusterRoleBinding deben tener "predeterminado" como espacio de nombres o, de lo contrario, no se reemplazará.
Revisa el ejemplo a continuación:
$ cat <<EOF > my-resources.yaml apiVersion: v1 kind: ServiceAccount metadata: name: my-service-account namespace: default --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: my-cluster-role-binding roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: my-clusterrole subjects: - kind: ServiceAccount name: my-service-account namespace: default EOF $ cat <<EOF > kustomization.yaml namespace: foo-namespace namePrefix: foo-prefix- resources: - my-resources.yaml EOF $ kustomize build apiVersion: v1 kind: ServiceAccount metadata: name: foo-prefix-my-service-account namespace: foo-namespace --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: foo-prefix-my-cluster-role-binding roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: my-clusterrole subjects: - kind: ServiceAccount name: foo-prefix-my-service-account namespace: foo-namespace