use a ClusterRoleBinding for image-cleaner
rather than a RoleBinding
@@ -45,36 +45,36 @@ metadata:
---
# image-cleaner role
# needs to cordon nodes during image cleaning
-kind: Role
+kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
- name: image-cleaner
labels:
app: binderhub
chart: {{ .Chart.Name }}-{{ .Chart.Version }}
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
+ name: image-cleaner-{{ .Release.Name }}
rules:
- apiGroups: [""] # "" indicates the core API group
resources: ["nodes"]
verbs: ["get", "patch"]
---
-kind: RoleBinding
+kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
- name: image-cleaner
labels:
app: binderhub
chart: {{ .Chart.Name }}-{{ .Chart.Version }}
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
+ name: image-cleaner-{{ .Release.Name }}
subjects:
- kind: ServiceAccount
namespace: {{ .Release.Namespace }}
name: image-cleaner
roleRef:
- kind: Role
- name: image-cleaner
+ kind: ClusterRole
+ name: image-cleaner-{{ .Release.Name }}
apiGroup: rbac.authorization.k8s.io
---
apiVersion: v1
