typhoon/addons/heapster/cluster-role-binding.yaml

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: heapster
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: heapster
subjects:
- kind: ServiceAccount
  name: heapster
  namespace: kube-system
addons: Update Heapster from v1.5.0 to v1.5.1 * Switch to k8s.gcr.io vanity image name * Add service account, Role, and ClusterRole for heapster 2018-02-11 19:45:39 +01:00			`apiVersion: rbac.authorization.k8s.io/v1`
			`kind: ClusterRoleBinding`
			`metadata:`
			`name: heapster`
			`roleRef:`
			`apiGroup: rbac.authorization.k8s.io`
			`kind: ClusterRole`
Configure Heapster to source metrics from Kubelet authenticated API * Heapster can now get nodes (i.e. kubelets) from the apiserver and source metrics from the Kubelet authenticated API (10250) instead of the Kubelet HTTP read-only API (10255) * https://github.com/kubernetes/heapster/blob/master/docs/source-configuration.md * Use the heapster service account token via Kubelet bearer token authn/authz. * Permit Heapster to skip CA verification. The CA cert does not contain IP SANs and cannot since nodes get random IPs that aren't known upfront. Heapster obtains the node list from the apiserver, so the risk of spoofing a node is limited. For the same reason, Prometheus scrapes must skip CA verification for scraping Kubelet's provided by the apiserver. * https://github.com/poseidon/typhoon/blob/v1.12.1/addons/prometheus/config.yaml#L68 * Create a heapster ClusterRole to work around the default Kubernetes `system:heapster` ClusterRole lacking the proper GET `nodes/stats` access. See https://github.com/kubernetes/heapster/issues/1936 2018-10-19 05:39:30 +02:00			`name: heapster`
addons: Update Heapster from v1.5.0 to v1.5.1 * Switch to k8s.gcr.io vanity image name * Add service account, Role, and ClusterRole for heapster 2018-02-11 19:45:39 +01:00			`subjects:`
			`- kind: ServiceAccount`
			`name: heapster`
			`namespace: kube-system`