Moves RBAC resources to a dedicated base, so specs that don't

need rbac can be created and deleted faster.
Specs might not use the kubernetes client,
or mighte have sufficient access with the default service account
such as in ephemeral test clusters.

Author: solsson

runtime-nodejs/kustomize-with-rbac/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+bases:
+- ../rbac-readonly
+- ../kustomize
+patchesStrategicMerge:
+- specs-serviceaccount.yaml

runtime-nodejs/kustomize-with-rbac/specs-serviceaccount.yaml

@@ -0,0 +1,8 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: specs
+spec:
+  template:
+    spec:
+      serviceAccountName: assert

runtime-nodejs/kustomize/kustomization.yaml

@@ -1,7 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-bases:
-- ../rbac-readonly
 resources:
 - scrapeable-deployment.yaml
 # TODO if many tests reuse this base, how do we manage podmonitor?

runtime-nodejs/kustomize/scrapeable-deployment.yaml

@@ -12,7 +12,6 @@ spec:
       labels:
         kubernetes-assert: metrics
     spec:
-      serviceAccountName: assert
       containers:
       - name: specs
         # We can't have a tag here because https://kubectl.docs.kubernetes.io/pages/reference/kustomize.html#images won't unset it, and Skaffold required no-tag URLs for build