chore: remove cluster-admin role

charts/virtual-kubelet/README.md

@@ -103,4 +103,3 @@ The following table lists the configurable parameters of the azure-aci chart and
 | rbac.install | Install Default RBAC roles and bindings. | `true` |
 | rbac.serviceAccountName | RBAC service account name. | `virtual-kubelet-helm` |
 | rbac.apiVersion | RBAC api version. | `v1` |
-| rbac.roleRef | Cluster role reference. | `cluster-admin` |

charts/virtual-kubelet/templates/clusterrole.yaml

@@ -0,0 +1,24 @@
+apiVersion: "rbac.authorization.k8s.io/{{ .Values.rbac.apiVersion }}"
+kind: ClusterRole
+metadata:
+ name: {{ include "vk.fullname" . }}-clusterrole
+{{ include "vk.labels" . | indent 2 }}
+rules:
+ - apiGroups: [""]
+ resources: ["pods"]
+ verbs: ["get", "list", "watch", "create", "delete", "update", "patch"]
+ - apiGroups: [""]
+ resources: ["nodes"]
+ verbs: ["get", "list", "watch", "create", "update", "patch"]
+ - apiGroups: [""]
+ resources: ["pods/status", "nodes/status"]
+ verbs: ["get", "list", "watch", "update", "patch"]
+ - apiGroups: [""]
+ resources: ["persistentvolumes", "persistentvolumeclaims", "replicationcontrollers", "namespaces", "configmaps", "secrets", "services"]
+ verbs: ["get", "list", "watch"]
+ - apiGroups: ["apps"]
+ resources: ["deployments"]
+ verbs: ["get","list","watch","create", "delete", "update", "patch"]
+ - apiGroups: ["coordination.k8s.io"]
+ resources: ["leases"]
+ verbs: ["get", "create", "update"]

charts/virtual-kubelet/templates/clusterrolebinding.yaml

@@ -5,11 +5,11 @@ metadata:
  name: {{ template "vk.fullname" . }}-{{ .Values.rbac.serviceAccountName }}
 {{ include "vk.labels" . | indent 2 }}
 subjects:
-- kind: ServiceAccount
- name: {{ template "vk.fullname" . }}-{{ .Values.rbac.serviceAccountName }}
- namespace: {{ .Values.namespace }}
+ - kind: ServiceAccount
+  name: {{ template "vk.fullname" . }}-{{ .Values.rbac.serviceAccountName }}
+  namespace: {{ .Values.namespace }}
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
- name: {{ .Values.rbac.roleRef }}
+ name: {{ include "vk.fullname" . }}-clusterrole
 {{ end }}

charts/virtual-kubelet/values.yaml

@@ -74,5 +74,3 @@ rbac:
  serviceAccountName: virtual-kubelet-helm
  ## RBAC api version
  apiVersion: v1
- ## Cluster role reference
- roleRef: cluster-admin

hack/e2e/aks-addon.sh

@@ -114,7 +114,7 @@ az aks create \
  -g "$RESOURCE_GROUP" \
  -l "$LOCATION" \
  -c "$NODE_COUNT" \
- --node-vm-size standard_d8_v3 \
+ --node-vm-size standard_d8s_v3 \
  -n "$CLUSTER_NAME" \
  --network-plugin azure \
  --vnet-subnet-id "$cluster_subnet_id" \
@@ -128,7 +128,7 @@ az aks create \
  -g "$RESOURCE_GROUP" \
  -l "$LOCATION" \
  -c "$NODE_COUNT" \
- --node-vm-size standard_d8_v3 \
+ --node-vm-size standard_d8s_v3 \
  -n "$CLUSTER_NAME" \
  --network-plugin azure \
  --vnet-subnet-id "$cluster_subnet_id" \