To install your Tanzu RabbitMQ package, you must have permissions to create cluster-scope objects on any namespace. To create such objects, you must use or create a service account.
For example to create CustomResourceDefinition objects, you must have a service account.
The following example code creates a service account called tanzu-rabbitmq in the default namespace. The ClusterRole and ClusterRoleBinding objects are created in this namespace. These objects include all the permissions that are required to create any objects that are required by Tanzu RabbitMQ.
You can also access the example code below in this serviceaccount.yml file.
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: tanzu-rabbitmq-crd-install
rules:
- apiGroups:
- admissionregistration.k8s.io
resources:
- validatingwebhookconfigurations
- mutatingwebhookconfigurations
verbs:
- "*"
- apiGroups:
- apiextensions.k8s.io
resources:
- customresourcedefinitions
verbs:
- "*"
- apiGroups:
- apps
resources:
- deployments
verbs:
- "*"
- apiGroups:
- cert-manager.io
resources:
- certificates
- issuers
verbs:
- "*"
- apiGroups:
- ""
resources:
- configmaps
- namespaces
- secrets
- serviceaccounts
- services
verbs:
- "*"
- apiGroups:
- rbac.authorization.k8s.io
resources:
- clusterrolebindings
- clusterroles
- rolebindings
- roles
verbs:
- "*"
- apiGroups:
- coordination.k8s.io
resources:
- leases
verbs:
- "*"
- apiGroups:
- ""
resources:
- events
verbs:
- create
- get
- patch
- apiGroups:
- ""
resources:
- endpoints
verbs:
- get
- list
- watch
- apiGroups:
- ""
resources:
- persistentvolumeclaims
verbs:
- create
- get
- list
- update
- watch
- apiGroups:
- ""
resources:
- pods
verbs:
- get
- list
- update
- watch
- apiGroups:
- ""
resources:
- pods/exec
verbs:
- create
- apiGroups:
- apps
resources:
- statefulsets
verbs:
- create
- delete
- get
- list
- update
- watch
- apiGroups:
- rabbitmq.com
- rabbitmq.tanzu.vmware.com
resources:
- "*"
verbs:
- "*"
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: tanzu-rabbitmq
namespace: default
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: tanzu-rabbitmq-crd-install-binding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: tanzu-rabbitmq-crd-install
subjects:
- kind: ServiceAccount
name: tanzu-rabbitmq
namespace: default