role rework

Author: bparees

examples/service-catalog/service-catalog.yaml

@@ -4,6 +4,11 @@ metadata:
   name: service-catalog
 objects:
 
+- kind: ServiceAccount
+  apiVersion: v1
+  metadata:
+    name: service-catalog-controller
+
 - kind: ClusterRoleBinding
   apiVersion: v1
   metadata:
@@ -35,6 +40,14 @@ objects:
     name: namespace-viewer
   userNames:
     - system:serviceaccount:service-catalog:default
+- kind: ClusterRoleBinding
+  apiVersion: v1
+  metadata:
+    name: service-catalog-controller-namespace-viewer-binding
+  roleRef:
+    name: namespace-viewer
+  userNames:
+    - system:serviceaccount:service-catalog:service-catalog-controller
 
 - kind: ClusterRole
   apiVersion: v1
@@ -54,11 +67,11 @@ objects:
 - kind: ClusterRoleBinding
   apiVersion: v1
   metadata:
-    name: service-catalog-secret-admin-binding
+    name: service-catalog-controller-secret-admin-binding
   roleRef:
     name: secret-admin
   userNames:
-    - system:serviceaccount:service-catalog:default
+    - system:serviceaccount:service-catalog:service-catalog-controller
 
 - kind: ClusterRole
   apiVersion: v1
@@ -78,11 +91,11 @@ objects:
 - kind: ClusterRoleBinding
   apiVersion: v1
   metadata:
-    name: service-catalog-podpreset-admin-binding
+    name: service-catalog-controller-podpreset-admin-binding
   roleRef:
     name: podpreset-admin
   userNames:
-    - system:serviceaccount:service-catalog:default
+    - system:serviceaccount:service-catalog:service-catalog-controller
 
 - kind: ClusterRole
   apiVersion: v1
@@ -100,11 +113,11 @@ objects:
 - kind: ClusterRoleBinding
   apiVersion: v1
   metadata:
-    name: servicecatalog-status-updater-binding
+    name: servicecatalog-controller-status-updater-binding
   roleRef:
     name: servicecatalog-status-updater
   userNames:
-    - system:serviceaccount:service-catalog:default
+    - system:serviceaccount:service-catalog:service-catalog-controller
 
 
 - kind: PolicyBinding
@@ -114,7 +127,6 @@ objects:
   policyRef:
     name: default
     namespace: service-catalog
-
 - kind: Role
   apiVersion: v1
   metadata:
@@ -137,7 +149,7 @@ objects:
     name: endpoint-accessor
     namespace: service-catalog
   userNames:
-    - system:serviceaccount:service-catalog:default
+    - system:serviceaccount:service-catalog:service-catalog-controller
 
 - kind: PolicyBinding
   apiVersion: v1
@@ -185,73 +197,26 @@ objects:
 - kind: ClusterRole
   apiVersion: v1
   metadata:
-    name: servicecatalog-viewer
+    name: servicecatalog-serviceclass-viewer
   rules:
   - apiGroups:
     - servicecatalog.k8s.io
     resources:
     - serviceclasses
-    - instances
-    - bindings
     verbs:
     - list
     - watch
     - get
 - kind: ClusterRoleBinding
   apiVersion: v1
   metadata:
-    name: servicecatalog-viewer-binding
-  roleRef:
-    name: servicecatalog-viewer
-  groupNames:
-  - system:authenticated
-
-- kind: ClusterRole
-  apiVersion: v1
-  metadata:
-    name: servicecatalog-provisioner
-  rules:
-  - apiGroups:
-    - servicecatalog.k8s.io
-    resources:
-    - instances
-    - bindings
-    verbs:
-    - create
-    - update
-    - delete
-- kind: ClusterRoleBinding
-  apiVersion: v1
-  metadata:
-    name: servicecatalog-provisioner-binding
+    name: servicecatalog-serviceclass-viewer-binding
   roleRef:
-    name: servicecatalog-provisioner
+    name: servicecatalog-serviceclass-viewer
   groupNames:
   - system:authenticated
 
 
-- kind: ClusterRole
-  apiVersion: v1
-  metadata:
-    name: servicecatalog-admin
-  rules:
-  - apiGroups:
-    - servicecatalog.k8s.io
-    resources:
-    - brokers
-    - instances
-    - bindings
-    - serviceclasses
-    verbs:
-    - get
-    - list
-    - watch
-    - create
-    - update
-    - delete
-
-
-
 - apiVersion: extensions/v1beta1
   kind: Deployment
   metadata:
@@ -355,22 +320,6 @@ objects:
       app: apiserver
     sessionAffinity: None
 
-- apiVersion: v1
-  kind: Route
-  metadata:
-    name: apiserver
-  spec:
-    host: ${SERVICE_CATALOG_ROUTE_HOSTNAME}
-    port:
-      targetPort: secure
-    tls:
-      termination: passthrough
-    to:
-      kind: Service
-      name: apiserver
-      weight: 100
-  wildcardPolicy: None
-
 - apiVersion: extensions/v1beta1
   kind: Deployment
   metadata:
@@ -392,6 +341,7 @@ objects:
         labels:
           app: controller-manager
       spec:
+        serviceAccountName: service-catalog-controller
         containers:
         - args:
           - -v
@@ -454,11 +404,6 @@ parameters:
   name: SERVICE_CATALOG_SERVICE_IP
   required: true
   value: 172.30.1.2
-- description: Hostname for the service catalog route
-  displayName: Service Catalog Route Host
-  name: SERVICE_CATALOG_ROUTE_HOSTNAME
-  required: true
-  value: apiserver-service-catalog.172.30.1.2.nip.io
 - description: Do not change this value.
   displayName: Name of the kube-system namespace
   name: KUBE_SYSTEM_NAMESPACE