Merge pull request #2480 from colinhoglund/storage-provisioner_with_rbac

Create ServiceAccount and ClusterRoleBinding for storage-provisioner
kubernetes · Jan 29, 2018 · 35d685a · 35d685a
2 parents 06cc69b + 479ca10
commit 35d685a
Show file tree

Hide file tree

Showing 2 changed files with 34 additions and 1 deletion.
diff --git a/cmd/minikube/cmd/config/config.go b/cmd/minikube/cmd/config/config.go
@@ -196,6 +196,12 @@ var settings = []Setting{
 		validations: []setFn{IsValidAddon},
 		callbacks:   []setFn{EnableOrDisableDefaultStorageClass},
 	},
+	{
+		name:        "storage-provisioner",
+		set:         SetBool,
+		validations: []setFn{IsValidAddon},
+		callbacks:   []setFn{EnableOrDisableAddon},
+	},
 	{
 		name: "hyperv-virtual-switch",
 		set:  SetString,

diff --git a/deploy/addons/storage-provisioner/storage-provisioner.yaml b/deploy/addons/storage-provisioner/storage-provisioner.yaml
@@ -12,15 +12,42 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: storage-provisioner
+  namespace: kube-system
+  labels:
+    addonmanager.kubernetes.io/mode: Reconcile
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: storage-provisioner
+  labels:
+    addonmanager.kubernetes.io/mode: EnsureExists
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:persistent-volume-provisioner
+subjects:
+  - kind: ServiceAccount
+    name: storage-provisioner
+    namespace: kube-system
+
+---
 apiVersion: v1
 kind: Pod
 metadata:
   name: storage-provisioner
   namespace: kube-system
   labels:
     integration-test: storage-provisioner
-    addonmanager.kubernetes.io/mode: EnsureExists
+    addonmanager.kubernetes.io/mode: Reconcile
 spec:
+  serviceAccountName: storage-provisioner
   hostNetwork: true
   containers:
   - name: storage-provisioner