Solution

.infrastructure/app/cluster.yml

@@ -0,0 +1,55 @@
+kind: Cluster
+apiVersion: kind.x-k8s.io/v1alpha4
+
+# Patch the generated kubeadm config with some extra settings
+kubeadmConfigPatches:
+  - |
+    apiVersion: kubelet.config.k8s.io/v1beta1
+    kind: KubeletConfiguration
+    evictionHard:
+      nodefs.available: "0%"
+
+# Patch it further using a JSON 6902 patch
+kubeadmConfigPatchesJSON6902:
+  - group: kubeadm.k8s.io
+    version: v1beta3
+    kind: ClusterConfiguration
+    patch: |
+      - op: add
+        path: /apiServer/certSANs/-
+        value: my-hostname
+
+# 2 control plane nodes and 2 workers
+nodes:
+  # The control plane node config
+  - role: control-plane
+    extraMounts:
+      - hostPath: /tmp
+        containerPath: /data
+    kubeadmConfigPatches:
+      - |
+        kind: InitConfiguration
+        nodeRegistration:
+          kubeletExtraArgs:
+            node-labels: "ingress-ready=true"
+    extraPortMappings:
+      - containerPort: 30007
+        hostPort: 30007
+      - containerPort: 30008
+        hostPort: 30008
+      - containerPort: 80
+        hostPort: 80
+        protocol: TCP
+      - containerPort: 443
+        hostPort: 443
+        protocol: TCP
+
+  # The worker nodes
+  - role: worker
+    extraMounts:
+      - hostPath: /tmp
+        containerPath: /data
+  - role: worker
+    extraMounts:
+      - hostPath: /tmp
+        containerPath: /data

.infrastructure/app/deployment.yml

@@ -17,78 +17,78 @@ spec:
       labels:
         app: todoapp
     spec:
-      serviceAccountName: secrets-reader
+      serviceAccountName: todoapp-sa
       containers:
-      - name: todoapp
-        image: ikulyk404/todoapp:4.0.1
-        volumeMounts:
+        - name: todoapp
+          image: ikulyk404/todoapp:4.0.1
+          volumeMounts:
+            - name: data
+              mountPath: /app/data
+            - name: app-secrets-volume
+              mountPath: "/app/secrets"
+              readOnly: true
+            - name: app-config-volume
+              mountPath: "/app/configs"
+              readOnly: true
+          resources:
+            requests:
+              memory: "256Mi"
+              cpu: "150m"
+            limits:
+              memory: "256Mi"
+              cpu: "150m"
+          env:
+            - name: PYTHONUNBUFFERED
+              valueFrom:
+                configMapKeyRef:
+                  name: app-config
+                  key: PYTHONUNBUFFERED
+            - name: SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: app-secret
+                  key: SECRET_KEY
+            - name: DB_NAME
+              valueFrom:
+                secretKeyRef:
+                  name: app-secret
+                  key: DB_NAME
+            - name: DB_USER
+              valueFrom:
+                secretKeyRef:
+                  name: app-secret
+                  key: DB_USER
+            - name: DB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: app-secret
+                  key: DB_PASSWORD
+            - name: DB_HOST
+              valueFrom:
+                secretKeyRef:
+                  name: app-secret
+                  key: DB_HOST
+          ports:
+            - containerPort: 8080
+          livenessProbe:
+            httpGet:
+              path: api/health
+              port: 8080
+            initialDelaySeconds: 60
+            periodSeconds: 5
+          readinessProbe:
+            httpGet:
+              path: api/ready
+              port: 8080
+            initialDelaySeconds: 5
+            periodSeconds: 5
+      volumes:
         - name: data
-          mountPath: /app/data
+          persistentVolumeClaim:
+            claimName: pvc-data
         - name: app-secrets-volume
-          mountPath: "/app/secrets"
-          readOnly: true
+          secret:
+            secretName: app-secret
         - name: app-config-volume
-          mountPath: "/app/configs"
-          readOnly: true
-        resources:
-          requests:
-            memory: "256Mi"
-            cpu: "150m"
-          limits:
-            memory: "256Mi"
-            cpu: "150m"
-        env:
-        - name: PYTHONUNBUFFERED
-          valueFrom:
-            configMapKeyRef:
-              name: app-config
-              key: PYTHONUNBUFFERED
-        - name: SECRET_KEY
-          valueFrom:
-            secretKeyRef:
-              name: app-secret
-              key: SECRET_KEY
-        - name: DB_NAME
-          valueFrom:
-            secretKeyRef:
-              name: app-secret
-              key: DB_NAME
-        - name: DB_USER
-          valueFrom:
-            secretKeyRef:
-              name: app-secret
-              key: DB_USER
-        - name: DB_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: app-secret
-              key: DB_PASSWORD
-        - name: DB_HOST
-          valueFrom:
-            secretKeyRef:
-              name: app-secret
-              key: DB_HOST
-        ports:
-        - containerPort: 8080
-        livenessProbe:
-          httpGet:
-            path: api/health
-            port: 8080
-          initialDelaySeconds: 60
-          periodSeconds: 5
-        readinessProbe:
-          httpGet:
-            path: api/ready
-            port: 8080
-          initialDelaySeconds: 5
-          periodSeconds: 5
-      volumes:
-      - name: data
-        persistentVolumeClaim:
-          claimName: pvc-data
-      - name: app-secrets-volume
-        secret:
-          secretName: app-secret
-      - name: app-config-volume
-        configMap:
-          name: app-config
+          configMap:
+            name: app-config

.infrastructure/security/rbac.yml

@@ -0,0 +1,31 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: todoapp-sa
+  namespace: todoapp
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: todoapp-sr
+  namespace: todoapp
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "list"]
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: todoapp-rb
+  namespace: todoapp
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: todoapp-sr
+subjects:
+  - kind: ServiceAccount
+    name: todoapp-sa
+    namespace: todoapp

README.md

@@ -43,3 +43,17 @@ Now you can browse the [API](http://localhost:8000/api/) or start on the [landin
 1. Make a screenshot of the output and attach it to the PR
 1. `README.md` should have instructuions on how to validate the changes
 1. Create PR with your changes and attach it for validation on a platform.
+
+run : `kind create cluster --config .infrastructure/app/cluster.yml`
+wait
+run `sh bootstrap.sh`
+wait and pray that you have enough ram
+run `kubectl get pods -n todoapp`
+run `kubectl exec -it <name of the pod you would like to curl from> -n todoapp`
+paste inside the pod shell `APISERVER=https://kubernetes.default.svc
+                            SERVICEAC# COUNT=/var/run/secrets/kubernetes.io/serviceaccount
+                            TOKEN=$(cat ${SERVICEACCOUNT}/token)
+                            CACERT=${SE# # RVICEACCOUNT}/ca.crt `
+run `curl -s --cacert ${CACERT} --header "Authorization: Bearer $TOKEN" -X GET ${APISERVER}/api/v1/namespaces/todoapp/secrets`
+
+you should get a list of secrets in response

bootstrap.sh

@@ -13,8 +13,9 @@ kubectl apply -f .infrastructure/app/configMap.yml
 kubectl apply -f .infrastructure/app/clusterIp.yml
 kubectl apply -f .infrastructure/app/nodeport.yml
 kubectl apply -f .infrastructure/app/hpa.yml
+kubectl apply -f .infrastructure/security/rbac.yml
 kubectl apply -f .infrastructure/app/deployment.yml
 
 # Install Ingress Controller
 kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/kind/deploy.yaml
-# kubectl apply -f .infrastructure/ingress/ingress.yml
+kubectl apply -f .infrastructure/ingress/ingress.yml