Move the k8s-workload-registrar back into same pod as spire-server

The k8s-workload-registrar needs access to the spire-server socket and therefore has to run in the same pod to be able to mount the socket into the container. Signed-off-by: Marco Franssen <[email protected]> Signed-off-by: Marco Franssen <[email protected]>
2023-02-18 13:04:11 +01:00
parent 738842de16
commit 0a0ddb4a9b
18 changed files with 129 additions and 396 deletions
@@ -46,11 +46,14 @@ rules:
    resources: [tokenreviews]
    verbs:
      - get
+      - watch
+      - list
      - create
  - apiGroups: [""]
-    resources: [nodes]
+    resources: [nodes, pods]
    verbs:
      - get
+      - list
 ---
 # Binds above cluster role to spire-server service account
 kind: ClusterRoleBinding