apisix-helm-chart icon indicating copy to clipboard operation
apisix-helm-chart copied to clipboard

Published 20 hours ago • verified publisher icon apache

feat: support Kubernetes service discovery

Open lzxuan opened this issue 3 years ago • 9 comments

Primarily to support client.token_file in APISIX's Kubernetes service discovery configuration.

lzxuan avatar May 11 '22 05:05 lzxuan

thanks, if you create sa, then you need add RBAC for it. Right?

tao12345666333 avatar Jul 28 '22 16:07 tao12345666333

Is anything special for this ServiceAccount? I don't see the role binding for it.

tokers avatar Jul 29 '22 01:07 tokers

it also need to be added.

tao12345666333 avatar Jul 31 '22 16:07 tao12345666333

@tao12345666333 For the case of Kubernetes service discovery, yeah, ClusterRole and ClusterRoleBinding are also needed. If we are going into this use case specifically, I'll need to update the title of this PR together with the RBAC. Thanks

lzxuan avatar Aug 02 '22 05:08 lzxuan

@tokers I'll update the necessary RBAC resources to support Kubernetes service discovery. Thanks!

lzxuan avatar Aug 02 '22 05:08 lzxuan

@tao12345666333 @tokers Sorry for the late update, been busy recently. I've updated the necessary RBAC resources.

lzxuan avatar Aug 05 '22 01:08 lzxuan

@tokers Is it better if we specify the cluster role rules in values.yaml? Like so: image And use .serviceAccount.create as the only flag to determine whether to create cluster role and binding?

lzxuan avatar Aug 08 '22 08:08 lzxuan

@tokers Is is better if we specify the cluster role rules in values.yaml? Like so: image And use .serviceAccount.create as the only flag to determine whether to create cluster role and binding?

IMHO I didn't see any project do this. The permission for APISIX is certain. We may don't need to let users to customize it.

tokers avatar Aug 08 '22 11:08 tokers

@tokers Is is better if we specify the cluster role rules in values.yaml? Like so: image And use .serviceAccount.create as the only flag to determine whether to create cluster role and binding?

IMHO I didn't see any project do this. The permission for APISIX is certain. We may don't need to let users to customize it.

Fair enough. I didn't see any project do this either. Thanks for the input!

lzxuan avatar Aug 08 '22 14:08 lzxuan