mirror of
https://github.com/zooai/operator.git
synced 2026-10-30 14:49:50 +00:00
zeekayandHanzo Dev
e547076ea2
Each zoo-* namespace runs its own zoo-operator ServiceAccount; only the zoo-system one was bound, so reconciles from the other namespaces 403'd. Co-authored-by: Hanzo Dev <[email protected]>
73 lines
2.0 KiB
YAML
73 lines
2.0 KiB
YAML
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: zoo-operator
|
|
namespace: zoo-system
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: zoo-operator
|
|
rules:
|
|
# CRDs
|
|
- apiGroups: ["zoo.network"]
|
|
resources:
|
|
- zoonetworks
|
|
- zoonetworks/status
|
|
- zoochains
|
|
- zoochains/status
|
|
- zooexplorers
|
|
- zooexplorers/status
|
|
- zoogateways
|
|
- zoogateways/status
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
|
# Core resources managed by the operator
|
|
- apiGroups: [""]
|
|
resources:
|
|
- pods
|
|
- services
|
|
- configmaps
|
|
- secrets
|
|
- persistentvolumeclaims
|
|
- events
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
|
# StatefulSets and Deployments
|
|
- apiGroups: ["apps"]
|
|
resources:
|
|
- statefulsets
|
|
- deployments
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
|
# Leader election via Lease
|
|
- apiGroups: ["coordination.k8s.io"]
|
|
resources:
|
|
- leases
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: zoo-operator
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: zoo-operator
|
|
# The operator runs cluster-scoped (Api::all, --namespace "") and elects a
|
|
# single global leader across every per-network Deployment. Whichever pod wins
|
|
# the lease must be able to list/watch zoo.network resources cluster-wide, so
|
|
# every namespace that runs a zoo-operator Deployment must have its
|
|
# ServiceAccount bound here — otherwise the elected leader gets HTTP 403 on
|
|
# every reconcile and all CRs stall with an empty phase.
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: zoo-operator
|
|
namespace: zoo-system
|
|
- kind: ServiceAccount
|
|
name: zoo-operator
|
|
namespace: zoo-mainnet
|
|
- kind: ServiceAccount
|
|
name: zoo-operator
|
|
namespace: zoo-testnet
|
|
- kind: ServiceAccount
|
|
name: zoo-operator
|
|
namespace: zoo-devnet
|