Solution

.gitignore

@@ -157,4 +157,4 @@ cython_debug/
 #  be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
 #  and can be added to the global gitignore or merged into this file.  For a more nuclear
 #  option (not recommended) you can uncomment the following to ignore the entire idea folder.
-#.idea/
+.idea/

.infrastructure/app/deployment.yml

@@ -17,7 +17,7 @@ spec:
       labels:
         app: todoapp
     spec:
-      serviceAccountName: secrets-reader
+      serviceAccountName: pods-lister
       containers:
       - name: todoapp
         image: ikulyk404/todoapp:4.0.1
@@ -91,4 +91,4 @@ spec:
           secretName: app-secret
       - name: app-config-volume
         configMap:
-          name: app-config
+          name: app-config

.infrastructure/security/rbac.yml

@@ -0,0 +1,32 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: pods-lister
+  namespace: todoapp
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: pods-lister
+  namespace: todoapp
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["list"]
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: pods-lister-binging
+  namespace: todoapp
+subjects:
+  - kind: ServiceAccount
+    name: pods-lister
+roleRef:
+  kind: Role
+  name: pods-lister
+  apiGroup: rbac.authorization.k8s.io

README.md

@@ -1,45 +1,14 @@
 # Django ToDo list
 
-This is a todo list web application with basic features of most web apps, i.e., accounts/login, API, and interactive UI. To do this task, you will need:
-
-- CSS | [Skeleton](http://getskeleton.com/)
-- JS  | [jQuery](https://jquery.com/)
-
-## Explore
-
-Try it out by installing the requirements (the following commands work only with Python 3.8 and higher, due to Django 4):
-
-```
-pip install -r requirements.txt
-```
-
-Create a database schema:
-
-```
-python manage.py migrate
-```
-
-And then start the server (default is http://localhost:8000):
-
-```
-python manage.py runserver
-```
-
-Now you can browse the [API](http://localhost:8000/api/) or start on the [landing page](http://localhost:8000/).
-
-## Task
-
-1. Fork this repository.
-1. Use `kind` to spin up a cluster from a `cluster.yml` configuration file.
-1. Create a manifest  named `rbac` inside a `security` directory
-1. `rbac` manifest requirements:
-    1. File should containa `ServiceAccount` definition
-    1. File should contain a `Role` definition
-    1. Role should allow to list secrets
-    1. File should contain a `RoleBinding` definition
-    1. RoleBinding should bind the `Role` to the `ServiceAccount`
-1. Use newly created `ServiceAccount` should be used by the `Deployment` in the `deployment` manifest
-1. Execute a curl command to list secrets from the `Deployment` pod to list secrets
-1. Make a screenshot of the output and attach it to the PR
-1. `README.md` should have instructuions on how to validate the changes
-1. Create PR with your changes and attach it for validation on a platform.
+## Validation changes
+1. Run `bootstrap.sh`
+2. Use `kubectl get pods -n todoapp`
+3. Use `kubectl exec POD-NAME -it -n todoapp -- sh`, where POD-NAME is a name of your pod (NAME column). 
+The command should look like `kubectl exec todoapp-9f575cc76-7vplb -it -n todoapp -- sh`
+4. Use `SERVICEACCOUNT=/var/run/secrets/kubernetes.io/serviceaccount
+APISERVER=https://kubernetes.default.svc
+TOKEN=$(cat ${SERVICEACCOUNT}/token)
+CACERT=${SERVICEACCOUNT}/ca.crt
+curl --cacert ${CACERT} --header "Authorization: Bearer ${TOKEN}" -X GET ${APISERVER}/api/v1/namespaces/todoapp/pods` to get a response
+
+![Result photo](rbac.png)

bootstrap.sh

@@ -13,6 +13,7 @@ kubectl apply -f .infrastructure/app/configMap.yml
 kubectl apply -f .infrastructure/app/clusterIp.yml
 kubectl apply -f .infrastructure/app/nodeport.yml
 kubectl apply -f .infrastructure/app/hpa.yml
+kubectl apply -f .infrastructure/security/rbac.yml
 kubectl apply -f .infrastructure/app/deployment.yml
 
 # Install Ingress Controller