init

rbac/01-clusterrole.yaml

@@ -0,0 +1,8 @@
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: pod-reader-role
+rules:
+ - apiGroups: [""]
+   resources: ["pods"]
+   verbs: ["list", "get"]

rbac/02-sa.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: pod-reader

rbac/03-binding.yaml

@@ -0,0 +1,13 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: pod-role-binding
+  namespace: demo
+subjects:
+ - kind: ServiceAccount
+   name: pod-reader
+   namespace: demo
+roleRef:
+  kind: ClusterRole
+  name: pod-reader-role
+  apiGroup: rbac.authorization.k8s.io

rbac/04-pod.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: sample
+  namespace: demo
+spec:
+  serviceAccount: pod-reader
+  terminationGracePeriodSeconds: 1
+  containers:
+  - name: app
+    image: trion/curl:1
+    tty: true
+    resources: {}

rbac/commands

@@ -0,0 +1,17 @@
+kubectl create role pod-reader --verb=get --verb=list --verb=watch --resource=pods --dry-run=client -o yaml
+
+kubectl create rolebinding pod-reader-binding \
+  --clusterrole=pod-reader-role \
+  --serviceaccount=demo:pod-reader \
+  --dry-run=client -o yaml
+
+
+kubectl create serviceaccount pod-reader --dry-run=client -o yaml
+
+kubectl create token pod-reader
+
+kubectl create token default --duration 10m
+
+
+
+curl --cacert ca.crt -H "Authorization: Bearer $TOKEN" https://kubernetes.default/api/v1/namespaces/demo/pods

rbac/cronjob.yaml

@@ -0,0 +1,20 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: kraftfahrt-scaler
+spec:
+  schedule: "0 0 * * * "
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          serviceAccount: deployment-scaler
+          containers:
+          - name: scale-checka
+            image: trion/curl:1
+            command:
+            - /bin/sh
+            - -c
+            - |
+              # if restendpoint == true ; then curl https://kubernetes.default deployment replicas=10
+          restartPolicy: OnFailure