Merge pull request #519 from cwrau/feat/use-real-serviceaccount

⚠️ feat(rbac): use real ServiceAccount instead of default

Author: k8s-ci-robot

config/manager/manager.yaml

@@ -15,6 +15,8 @@ spec:
       labels:
         control-plane: controller-manager
     spec:
+      serviceAccountName: manager
+      automountServiceAccountToken: true
       containers:
       - command:
         - /manager

config/rbac/kustomization.yaml

@@ -3,3 +3,4 @@ resources:
 - role_binding.yaml
 - leader_election_role.yaml
 - leader_election_role_binding.yaml
+- service_account.yaml

config/rbac/leader_election_role_binding.yaml

@@ -8,5 +8,5 @@ roleRef:
   name: leader-election-role
 subjects:
 - kind: ServiceAccount
-  name: default
+  name: manager
   namespace: system

config/rbac/role_binding.yaml

@@ -8,5 +8,5 @@ roleRef:
   name: manager-role
 subjects:
 - kind: ServiceAccount
-  name: default
+  name: manager
   namespace: system

config/rbac/service_account.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: manager
+  namespace: system

hack/charts/cluster-api-operator/templates/deployment.yaml

@@ -47,6 +47,8 @@ spec:
       {{- toYaml . | nindent 8 }}
       {{- end }}
     spec:
+      serviceAccountName: capi-operator-manager
+      automountServiceAccountToken: true
       {{- with .Values.securityContext }}
       securityContext:
       {{- toYaml . | nindent 8 }}

test/e2e/resources/full-chart-install.yaml

@@ -1,5 +1,14 @@
 ---
 # Source: cluster-api-operator/templates/operator-components.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    clusterctl.cluster.x-k8s.io/core: capi-operator
+  name: capi-operator-manager
+  namespace: 'default'
+---
+# Source: cluster-api-operator/templates/operator-components.yaml
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
@@ -17702,7 +17711,7 @@ roleRef:
   name: capi-operator-manager-role
 subjects:
 - kind: ServiceAccount
-  name: default
+  name: capi-operator-manager
   namespace: 'default'
 ---
 # Source: cluster-api-operator/templates/operator-components.yaml
@@ -17767,7 +17776,7 @@ roleRef:
   name: capi-operator-leader-election-role
 subjects:
 - kind: ServiceAccount
-  name: default
+  name: capi-operator-manager
   namespace: 'default'
 ---
 # Source: cluster-api-operator/templates/operator-components.yaml
@@ -17818,6 +17827,8 @@ spec:
         control-plane: controller-manager
         clusterctl.cluster.x-k8s.io/core: capi-operator
     spec:
+      serviceAccountName: capi-operator-manager
+      automountServiceAccountToken: true
       containers:
       - args:
         - --v=2