rbac: Move to use private ServiceAccount (#435)

Currently kubemacpool pods are using the default SA. Therefore extra permissions are being granted to the default SA. It would be better if they will use a dedicated SA. Signed-off-by: Ram Lavi <[email protected]>
k8snetworkplumbingwg · Sep 9, 2024 · 8ccff0e · 8ccff0e
1 parent c1e70b8
commit 8ccff0e
Show file tree

Hide file tree

Showing 4 changed files with 27 additions and 3 deletions.
diff --git a/config/default/manager/manager.yaml b/config/default/manager/manager.yaml
@@ -1,4 +1,10 @@
 apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: sa
+  namespace: system
+---
+apiVersion: v1
 kind: Namespace
 metadata:
   labels:
@@ -45,6 +51,7 @@ spec:
       annotations:
         description: KubeMacPool manages MAC allocation to Pods and VMs
     spec:
+      serviceAccountName: sa
       tolerations:
         - key: node.kubernetes.io/unreachable
           operator: Exists
@@ -180,6 +187,7 @@ spec:
         control-plane: cert-manager
         controller-tools.k8s.io: "1.0"
     spec:
+      serviceAccountName: sa
       restartPolicy: Always
       securityContext:
         runAsNonRoot: true

diff --git a/config/default/rbac/rbac_role_binding.yaml b/config/default/rbac/rbac_role_binding.yaml
@@ -9,5 +9,5 @@ roleRef:
   name: manager-role
 subjects:
 - kind: ServiceAccount
-  name: default
+  name: sa
   namespace: system
diff --git a/config/release/kubemacpool.yaml b/config/release/kubemacpool.yaml
@@ -5,6 +5,12 @@ metadata:
     pod-security.kubernetes.io/enforce: restricted
   name: kubemacpool-system
 ---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: kubemacpool-sa
+  namespace: kubemacpool-system
+---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
@@ -95,7 +101,7 @@ roleRef:
   name: kubemacpool-manager-role
 subjects:
 - kind: ServiceAccount
-  name: default
+  name: kubemacpool-sa
   namespace: kubemacpool-system
 ---
 apiVersion: v1
@@ -205,6 +211,7 @@ spec:
         runAsUser: 107
         seccompProfile:
           type: RuntimeDefault
+      serviceAccountName: kubemacpool-sa
       terminationGracePeriodSeconds: 5
 ---
 apiVersion: apps/v1
@@ -329,6 +336,7 @@ spec:
         runAsUser: 107
         seccompProfile:
           type: RuntimeDefault
+      serviceAccountName: kubemacpool-sa
       terminationGracePeriodSeconds: 5
       tolerations:
       - effect: NoExecute

diff --git a/config/test/kubemacpool.yaml b/config/test/kubemacpool.yaml
@@ -6,6 +6,12 @@ metadata:
     pod-security.kubernetes.io/enforce: restricted
   name: kubemacpool-system
 ---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: kubemacpool-sa
+  namespace: kubemacpool-system
+---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
@@ -96,7 +102,7 @@ roleRef:
   name: kubemacpool-manager-role
 subjects:
 - kind: ServiceAccount
-  name: default
+  name: kubemacpool-sa
   namespace: kubemacpool-system
 ---
 apiVersion: v1
@@ -206,6 +212,7 @@ spec:
         runAsUser: 107
         seccompProfile:
           type: RuntimeDefault
+      serviceAccountName: kubemacpool-sa
       terminationGracePeriodSeconds: 5
 ---
 apiVersion: apps/v1
@@ -330,6 +337,7 @@ spec:
         runAsUser: 107
         seccompProfile:
           type: RuntimeDefault
+      serviceAccountName: kubemacpool-sa
       terminationGracePeriodSeconds: 5
       tolerations:
       - effect: NoExecute