Skip to content

Commit 960772c

Browse files
committed
Remove outdated cert-manager RBAC configuration
Default ClusterRole permissions already allow cross-namespace secret creation Signed-off-by: kahirokunn <[email protected]>
1 parent 65479f9 commit 960772c

File tree

1 file changed

+0
-40
lines changed

1 file changed

+0
-40
lines changed

linkerd.io/content/2-edge/tasks/automatically-rotating-control-plane-tls-credentials.md

Lines changed: 0 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -149,46 +149,6 @@ helm install \
149149
--wait
150150
```
151151

152-
Finally, we'll need to update cert-manager's RBAC permissions. By default
153-
cert-manager will only create certificate secrets in the namespace where it is
154-
installed. Linkerd, however, requires its identity issuer to be created in the
155-
`linkerd` namespace. To allow this, we create a `ServiceAccount` for
156-
cert-manager in the `linkerd` namespace with the required permissions.
157-
158-
```bash
159-
kubectl apply -f - <<EOF
160-
apiVersion: v1
161-
kind: ServiceAccount
162-
metadata:
163-
name: cert-manager
164-
namespace: linkerd
165-
---
166-
apiVersion: rbac.authorization.k8s.io/v1
167-
kind: Role
168-
metadata:
169-
name: cert-manager-secret-creator
170-
namespace: linkerd
171-
rules:
172-
- apiGroups: [""]
173-
resources: ["secrets"]
174-
verbs: ["create", "get", "update", "patch"]
175-
---
176-
apiVersion: rbac.authorization.k8s.io/v1
177-
kind: RoleBinding
178-
metadata:
179-
name: cert-manager-secret-creator-binding
180-
namespace: linkerd
181-
subjects:
182-
- kind: ServiceAccount
183-
name: cert-manager
184-
namespace: linkerd
185-
roleRef:
186-
kind: Role
187-
name: cert-manager-secret-creator
188-
apiGroup: rbac.authorization.k8s.io
189-
EOF
190-
```
191-
192152
### 3. Configure cert-manager to create the trust anchor
193153

194154
As described in Buoyant's [cert-manager concepts primer], cert-manager uses

0 commit comments

Comments
 (0)