fix rbac

Author: rasheedamir

external/exposecontroller/expose-controller-deployment.yaml

@@ -60,7 +60,7 @@ spec:
         volumeMounts:
         - mountPath: /etc/exposecontroller
           name: config-volume
-      serviceAccountName: exposecontroller
+      serviceAccountName: ext-exposecontroller
       volumes:
       - configMap:
           name: exposecontroller

external/exposecontroller/expose-controller-rbac.yaml

@@ -1,14 +1,17 @@
+# one Role gives access to services & ingresses in the same namespace as the exposecontroller is running
+# other Role gives access to the services in the default namespace
+
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: exposecontroller
+  name: ext-exposecontroller
   namespace: external
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: Role
 metadata:
   # name + namespace + "role"
-  name: exposecontroller-external-role
+  name: ext-exposecontroller-external-role
   namespace: external
 rules:
   - apiGroups:
@@ -38,21 +41,21 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: RoleBinding
 metadata:
-  name: exposecontroller-external-role-binding
+  name: ext-exposecontroller-external-role-binding
   namespace: external
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
-  name: exposecontroller-external-role
+  name: ext-exposecontroller-external-role
 subjects:
   - kind: ServiceAccount
-    name: exposecontroller
+    name: ext-exposecontroller
     namespace: external
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: Role
 metadata:
-  name: exposecontroller-default-role
+  name: ext-exposecontroller-default-role
   namespace: default
 rules:
   - apiGroups:
@@ -66,14 +69,14 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: RoleBinding
 metadata:
-  name: exposecontroller-default-role-binding
+  name: ext-exposecontroller-default-role-binding
   # This only grants permissions within the "default" namespace.
   namespace: default
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
-  name: exposecontroller-default-role
+  name: ext-exposecontroller-default-role
 subjects:
   - kind: ServiceAccount
-    name: exposecontroller
+    name: ext-exposecontroller
     namespace: external

internal/exposecontroller/expose-controller-deployment.yaml

@@ -60,7 +60,7 @@ spec:
         volumeMounts:
         - mountPath: /etc/exposecontroller
           name: config-volume
-      serviceAccountName: exposecontroller
+      serviceAccountName: int-exposecontroller
       volumes:
       - configMap:
           name: exposecontroller

internal/exposecontroller/expose-controller-rbac.yaml

@@ -1,14 +1,17 @@
+# one Role gives access to services & ingresses in the same namespace as the exposecontroller is running
+# other Role gives access to the services in the default namespace
+
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: exposecontroller
+  name: int-exposecontroller
   namespace: internal
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: Role
 metadata:
   # name + namespace + "role"
-  name: exposecontroller-internal-role
+  name: int-exposecontroller-internal-role
   namespace: internal
 rules:
   - apiGroups:
@@ -38,21 +41,21 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: RoleBinding
 metadata:
-  name: exposecontroller-internal-role-binding
+  name: int-exposecontroller-internal-role-binding
   namespace: internal
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
-  name: exposecontroller-internal-role
+  name: int-exposecontroller-internal-role
 subjects:
   - kind: ServiceAccount
-    name: exposecontroller
+    name: int-exposecontroller
     namespace: internal
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: Role
 metadata:
-  name: exposecontroller-default-role
+  name: int-exposecontroller-default-role
   namespace: default
 rules:
   - apiGroups:
@@ -66,14 +69,14 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: RoleBinding
 metadata:
-  name: exposecontroller-default-role-binding
+  name: int-exposecontroller-default-role-binding
   # This only grants permissions within the "default" namespace.
   namespace: default
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
-  name: exposecontroller-default-role
+  name: int-exposecontroller-default-role
 subjects:
   - kind: ServiceAccount
-    name: exposecontroller
+    name: int-exposecontroller
     namespace: internal