Add RBAC for autoregistration

- Also fix mistakes in the deployment.yaml
- Also hardcode the ownerRef kind and version because otherwise we get an error

Signed-off-by: Monis Khan <mok@vmware.com>

deploy/deployment.yaml

@@ -9,6 +9,12 @@ metadata:
     name: #@ data.values.namespace
 ---
 apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: #@ data.values.app_name + "-service-account"
+  namespace: #@ data.values.namespace
+---
+apiVersion: v1
 kind: ConfigMap
 metadata:
   name: #@ data.values.app_name + "-config"
@@ -39,6 +45,7 @@ spec:
       labels:
         app: #@ data.values.app_name
     spec:
+      serviceAccountName: #@ data.values.app_name + "-service-account"
       containers:
         - name: placeholder-name
           #@ if data.values.image_digest:
@@ -49,18 +56,18 @@ spec:
           imagePullPolicy: IfNotPresent
           command:
             - ./app
+          args:
             - --config=/etc/config/placeholder-config.yaml
             - --downward-api-path=/etc/podinfo
           volumeMounts:
             - name: config-volume
               mountPath: /etc/config
+            - name: podinfo
+              mountPath: /etc/podinfo
       volumes:
         - name: config-volume
           configMap:
             name: #@ data.values.app_name + "-config"
-        - name: podinfo
-          mountPath: /etc/podinfo
-  volumes:
         - name: podinfo
           downwardAPI:
             items:

deploy/rbac.yaml

@@ -0,0 +1,51 @@
+#@ load("@ytt:data", "data")
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: #@ data.values.app_name + "-aggregated-api-server-cluster-role"
+rules:
+  - apiGroups: [""]
+    resources: [namespaces]
+    verbs: [get, list, watch]
+  - apiGroups: [apiregistration.k8s.io]
+    resources: [apiservices]
+    verbs: [create, get, list, patch, update, watch]
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: #@ data.values.app_name + "-aggregated-api-server-cluster-role-binding"
+subjects:
+  - kind: ServiceAccount
+    name: #@ data.values.app_name + "-service-account"
+    namespace: #@ data.values.namespace
+roleRef:
+  kind: ClusterRole
+  name: #@ data.values.app_name + "-aggregated-api-server-cluster-role"
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: #@ data.values.app_name + "-aggregated-api-server-role"
+  namespace: #@ data.values.namespace
+rules:
+  - apiGroups: [""]
+    resources: [services]
+    verbs: [create, get, list, patch, update, watch]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: #@ data.values.app_name + "-aggregated-api-server-role-binding"
+  namespace: #@ data.values.namespace
+subjects:
+  - kind: ServiceAccount
+    name: #@ data.values.app_name + "-service-account"
+    namespace: #@ data.values.namespace
+roleRef:
+  kind: Role
+  name: #@ data.values.app_name + "-aggregated-api-server-role"
+  apiGroup: rbac.authorization.k8s.io

internal/autoregistration/autoregistration.go

@@ -64,8 +64,8 @@ func Setup(ctx context.Context, options SetupOptions) error {
 		Port:      &svc.Spec.Ports[0].Port,
 	}
 	apiSvc.ObjectMeta.OwnerReferences = []metav1.OwnerReference{{
-		APIVersion: ns.APIVersion,
+		APIVersion: "v1",        // TODO why did we need to hardcode this to avoid errors? was ns.APIVersion
-		Kind:       ns.Kind,
+		Kind:       "Namespace", // TODO why did we need to hardcode this to avoid errors? was ns.Kind
 		UID:        ns.UID,
 		Name:       ns.Name,
 	}}