solution

.infrastructure/Security/rbac.yml

@@ -0,0 +1,31 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: secrets-reader
+  namespace: todoapp
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: secret-reader-role
+  namespace: todoapp
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get", "list"]
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: secret-reader-rolebinding
+  namespace: todoapp
+subjects:
+- kind: ServiceAccount
+  name: secrets-reader
+  namespace: todoapp
+roleRef:
+  kind: Role
+  name: secret-reader-role
+  apiGroup: rbac.authorization.k8s.io

.infrastructure/app/deployment.yml

@@ -91,4 +91,4 @@ spec:
           secretName: app-secret
       - name: app-config-volume
         configMap:
-          name: app-config
+          name: app-config

README.md

@@ -43,3 +43,20 @@ Now you can browse the [API](http://localhost:8000/api/) or start on the [landin
 1. Make a screenshot of the output and attach it to the PR
 1. `README.md` should have instructuions on how to validate the changes
 1. Create PR with your changes and attach it for validation on a platform.
+
+
+Readme updated:
+
+1. Start cluster:
+```sh
+kind create cluster --config=cluster.yml
+```
+2. Run project:
+```sh
+./bootstrap.sh
+```
+
+3. Use script to set up the RBAC, modify the deployment, and validate the changes:
+```sh
+./validate.sh
+```

bootstrap.sh

@@ -14,6 +14,7 @@ kubectl apply -f .infrastructure/app/clusterIp.yml
 kubectl apply -f .infrastructure/app/nodeport.yml
 kubectl apply -f .infrastructure/app/hpa.yml
 kubectl apply -f .infrastructure/app/deployment.yml
+kubectl apply -f .infrastructure/security/rbac.yml
 
 # Install Ingress Controller
 kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/kind/deploy.yaml

validate.sh

@@ -0,0 +1,50 @@
+#!/bin/bash
+
+set -e
+
+# Step 1: Apply RBAC Manifest
+echo "Applying RBAC manifest from C:/Users/shche/mate/kubernetes/devops_todolist_kubernetes_task_12_rbac/.infrastructure/Security/rbac.yml..."
+if kubectl apply -f C:/Users/shche/mate/kubernetes/devops_todolist_kubernetes_task_12_rbac/.infrastructure/Security/rbac.yml; then
+  echo "RBAC manifest applied successfully 😊"
+else
+  echo "Failed to apply RBAC manifest 😶‍🌫️"
+  exit 1
+fi
+
+# Step 2: Modify Deployment to Use ServiceAccount
+echo "Modifying Deployment to use the new ServiceAccount..."
+if kubectl patch deployment todoapp -n todoapp -p '{"spec": {"template": {"spec": {"serviceAccountName": "todoapp-sa"}}}}'; then
+  echo "Deployment modified successfully 😊"
+else
+  echo "Failed to modify Deployment 😶‍🌫️"
+  exit 1
+fi
+
+# Step 3: Wait for Pods to be Ready
+echo "Waiting for pods to be ready..."
+if kubectl wait --for=condition=ready pod -l app=todoapp -n todoapp --timeout=120s; then
+  echo "Pods are ready 😊"
+else
+  echo "Pods did not become ready 😶‍🌫️"
+  exit 1
+fi
+
+# Step 4: Execute curl to List Secrets
+echo "Executing curl command to list secrets..."
+POD_NAME=$(kubectl get pods -n todoapp -l app=todoapp -o jsonpath="{.items[0].metadata.name}")
+CONTAINER_NAME=$(kubectl get pod $POD_NAME -n todoapp -o jsonpath="{.spec.containers[0].name}")
+
+if kubectl exec $POD_NAME -n todoapp -c $CONTAINER_NAME -- sh -c '
+APISERVER=https://kubernetes.default.svc
+SERVICEACCOUNT=/var/run/secrets/kubernetes.io/serviceaccount
+TOKEN=$(cat ${SERVICEACCOUNT}/token)
+CACERT=${SERVICEACCOUNT}/ca.crt
+curl --cacert ${CACERT} --header "Authorization: Bearer ${TOKEN}" -X GET ${APISERVER}/api/v1/namespaces/todoapp/secrets
+'; then
+  echo "Secrets listed successfully 😊"
+else
+  echo "Failed to list secrets 😶‍🌫️"
+  exit 1
+fi
+
+echo "Validation complete."