Solution

.infrastructure/ingress/ingress.yml

@@ -4,13 +4,13 @@ metadata:
   name: todoapp-ingress
   namespace: todoapp
   annotations:
-    nginx.ingress.kubernetes.io/rewrite-target: /$2
+    nginx.ingress.kubernetes.io/rewrite-target: /
 spec:
   rules:
   - http:
       paths:
       - pathType: Prefix
-        path: /(|$)(.*)
+        path: /
         backend:
           service:
             name: todoapp-service

.infrastructure/security/rbac.yml

@@ -0,0 +1,32 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: secrets-reader
+  namespace: todoapp
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: secrets-reader
+  namespace: todoapp
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["list"]
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+ name: secrets-reader-binding
+ namespace: todoapp
+subjects:
+  - kind: ServiceAccount
+    name: secrets-reader
+roleRef:
+  kind: Role
+  name: secrets-reader
+  apiGroup: rbac.authorization.k8s.io

README.md

@@ -43,3 +43,70 @@ Now you can browse the [API](http://localhost:8000/api/) or start on the [landin
 1. Make a screenshot of the output and attach it to the PR
 1. `README.md` should have instructuions on how to validate the changes
 1. Create PR with your changes and attach it for validation on a platform.
+
+
+---
+
+### Validation
+
+Verify the `Role` is created:
+
+```bash
+kubectl get roles -n todoapp
+```
+Expected output:
+```yaml
+NAME             CREATED AT
+secrets-reader   2024-07-11T10:33:47Z
+```
+Describe the `Role` to ensure it allows listing secrets:
+
+```bash
+kubectl describe role secrets-reader -n todoapp
+```
+Expected output:
+```yaml
+Name:         secrets-reader
+Labels:       <none>
+Annotations:  <none>
+PolicyRule:
+  Resources  Non-Resource URLs  Resource Names  Verbs
+  ---------  -----------------  --------------  -----
+  secrets    []                 []              [list]
+```
+
+Verify the `RoleBinding` is created :
+
+```bash
+kubectl get rolebinding -n todoapp
+```
+Expected output:
+```yaml
+NAME                     ROLE                  AGE
+secrets-reader-binding   Role/secrets-reader   19m
+```
+Describe the `RoleBinding` to ensure it properly binds the `Role` to the `ServiceAccount`:
+```bash
+kubectl describe rolebinding secrets-reader-binding -n todoapp
+```
+Expected output:
+```yaml
+Name:         secrets-reader-binding
+Labels:       <none>
+Annotations:  <none>
+Role:
+  Kind:  Role
+  Name:  secrets-reader
+Subjects:
+  Kind            Name            Namespace
+  ----            ----            ---------
+  ServiceAccount  secrets-reader
+```
+Check the `ServiceAccount` is used by the `Deployment`:
+```bash
+kubectl get deployment todoapp -n todoapp -o jsonpath='{.spec.template.spec.serviceAccountName}'
+```
+Expected output:
+```yaml
+secrets-reader
+```

bootstrap.sh

@@ -1,11 +1,17 @@
 #!/bin/bash
+
+kind create cluster --config cluster.yml
+
 kubectl apply -f .infrastructure/mysql/ns.yml
 kubectl apply -f .infrastructure/mysql/configMap.yml
 kubectl apply -f .infrastructure/mysql/secret.yml
 kubectl apply -f .infrastructure/mysql/service.yml
 kubectl apply -f .infrastructure/mysql/statefulSet.yml
 
 kubectl apply -f .infrastructure/app/ns.yml
+
+kubectl apply -f .infrastructure/security/rbac.yml
+
 kubectl apply -f .infrastructure/app/pv.yml
 kubectl apply -f .infrastructure/app/pvc.yml
 kubectl apply -f .infrastructure/app/secret.yml
@@ -15,6 +21,14 @@ kubectl apply -f .infrastructure/app/nodeport.yml
 kubectl apply -f .infrastructure/app/hpa.yml
 kubectl apply -f .infrastructure/app/deployment.yml
 
+
+
 # Install Ingress Controller
 kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/kind/deploy.yaml
-# kubectl apply -f .infrastructure/ingress/ingress.yml
+
+kubectl wait --namespace ingress-nginx \
+  --for=condition=ready pod \
+  --selector=app.kubernetes.io/component=controller \
+  --timeout=600s
+
+kubectl apply -f .infrastructure/ingress/ingress.yml