diff options
| author | Staffan Olsson <staffan@repos.se> | 2017-08-05 07:02:46 +0200 |
|---|---|---|
| committer | Staffan Olsson <staffan@repos.se> | 2017-08-05 07:04:08 +0200 |
| commit | ff972b99cc6ae2af5d5d420c43ce1304e6879aeb (patch) | |
| tree | 30514f2da93a354d710ac42754762b71dee36e96 | |
| parent | 3678ad5db2290af7a1bbc64d297de2d40edc2a6e (diff) | |
| download | kubernetes-kafka-multizone-rack-awareness.tar.gz kubernetes-kafka-multizone-rack-awareness.tar.bz2 kubernetes-kafka-multizone-rack-awareness.zip | |
Adds RBAC policy for kubectl to look up node's zonemultizone-rack-awareness
| -rw-r--r-- | rbac-namespace-default/node-reader.yml | 37 |
1 files changed, 37 insertions, 0 deletions
diff --git a/rbac-namespace-default/node-reader.yml b/rbac-namespace-default/node-reader.yml new file mode 100644 index 0000000..edf3dde --- /dev/null +++ b/rbac-namespace-default/node-reader.yml @@ -0,0 +1,37 @@ +# To see if init containers need RBAC: +# +# $ kubectl exec kafka-0 -- cat /etc/kafka/server.properties | grep broker.rack +# #init#broker.rack=# zone lookup failed, see -c init-config logs +# $ kubectl logs -c init-config kafka-0 +# ++ kubectl get node some-node '-o=go-template={{index .metadata.labels "failure-domain.beta.kubernetes.io/zone"}}' +# Error from server (Forbidden): User "system:serviceaccount:kafka:default" cannot get nodes at the cluster scope.: "Unknown user \"system:serviceaccount:kafka:default\"" +# +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1beta1 +metadata: + name: node-reader + labels: + origin: github.com_Yolean_kubernetes-kafka +rules: +- apiGroups: + - "" + resources: + - nodes + verbs: + - get +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1beta1 +metadata: + name: kafka-node-reader + labels: + origin: github.com_Yolean_kubernetes-kafka +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: node-reader +subjects: +- kind: ServiceAccount + name: default + namespace: kafka |