Nik Afiq
e980fcb755
Some checks failed
validate / lint (push) Failing after 1s
CRD, RBAC, thick-plugin DaemonSet (nik-debian only, k3s CNI paths, digest-pinned), the VLAN 50 NAD (macvlan bridge on enp1s0.50), the shared pod egress-guard script, a temporary canary pod, and the not-yet-deployed browser-vpn-proxy workload (kept in reserved/, outside this Application's non-recursive source path). Referenced by argocd/apps/multus.yaml (already pushed) but not deployed by it — that Application has no syncPolicy.automated, so this still needs an explicit selective sync per resource. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
78 lines
1.9 KiB
YAML
78 lines
1.9 KiB
YAML
# Apply: kubectl apply -f manifests/multus/01-rbac.yaml
|
|
# Description: ServiceAccount and cluster-scoped RBAC for the Multus
|
|
# DaemonSet (02-daemonset.yaml). sync-wave 0 — after the CRD, before
|
|
# the DaemonSet that uses this ServiceAccount.
|
|
#
|
|
# Verbatim from k8snetworkplumbingwg/multus-cni's official
|
|
# deployments/multus-daemonset-thick.yml (commit 95a0932350f0060cd23209
|
|
# 6876e24672a1de83fa, fetched 2026-08-24 — see 02-daemonset.yaml's header
|
|
# for the same pin), including the resource.k8s.io (Dynamic Resource
|
|
# Allocation) and events.k8s.io rules upstream grants — left in even
|
|
# though k3s v1.32 may not register that API group, since RBAC rules for
|
|
# a nonexistent group/resource are inert, not an error, and removing
|
|
# them would be inventing a divergence from upstream rather than fixing
|
|
# anything.
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: multus
|
|
namespace: kube-system
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "0"
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: multus
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "0"
|
|
rules:
|
|
- apiGroups: ["k8s.cni.cncf.io"]
|
|
resources:
|
|
- "*"
|
|
verbs:
|
|
- "*"
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- pods
|
|
- pods/status
|
|
verbs:
|
|
- get
|
|
- list
|
|
- update
|
|
- watch
|
|
- apiGroups:
|
|
- "resource.k8s.io"
|
|
resources:
|
|
- resourceclaims
|
|
- resourceclaims/status
|
|
- resourceslices
|
|
verbs:
|
|
- get
|
|
- list
|
|
- apiGroups:
|
|
- ""
|
|
- events.k8s.io
|
|
resources:
|
|
- events
|
|
verbs:
|
|
- create
|
|
- patch
|
|
- update
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: multus
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "0"
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: multus
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: multus
|
|
namespace: kube-system
|