Solution

.infrastructure/app/deployment.yml

@@ -91,4 +91,4 @@ spec:
           secretName: app-secret
       - name: app-config-volume
         configMap:
-          name: app-config
+          name: app-config

.infrastructure/cluster.yml

@@ -0,0 +1,53 @@
+kind: Cluster
+apiVersion: kind.x-k8s.io/v1alpha4
+
+# Patch the generated kubeadm config with some extra settings
+kubeadmConfigPatches:
+  - |
+    apiVersion: kubelet.config.k8s.io/v1beta1
+    kind: KubeletConfiguration
+    evictionHard:
+      nodefs.available: "0%"
+# Patch it further using a JSON 6902 patch
+kubeadmConfigPatchesJSON6902:
+  - group: kubeadm.k8s.io
+    version: v1beta3
+    kind: ClusterConfiguration
+    patch: |
+      - op: add
+        path: /apiServer/certSANs/-
+        value: my-hostname
+# 2 control plane nodes and 2 workers
+nodes:
+  # The control plane node config
+  - role: control-plane
+    extraMounts:
+      - hostPath: /tmp
+        containerPath: /data
+    kubeadmConfigPatches:
+      - |
+        kind: InitConfiguration
+        nodeRegistration:
+          kubeletExtraArgs:
+            node-labels: "ingress-ready=true"
+    extraPortMappings:
+      - containerPort: 30007
+        hostPort: 30007
+      - containerPort: 30008
+        hostPort: 30008
+      - containerPort: 80
+        hostPort: 80
+        protocol: TCP
+      - containerPort: 443
+        hostPort: 443
+        protocol: TCP
+
+  # The worker nodes
+  - role: worker
+    extraMounts:
+      - hostPath: /tmp
+        containerPath: /data
+  - role: worker
+    extraMounts:
+      - hostPath: /tmp
+        containerPath: /data

.infrastructure/security/rbac.yml

@@ -0,0 +1,33 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: secrets-reader
+  namespace: todoapp
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: secrets-reader
+  namespace: todoapp
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["list", "get"]
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: secrets-reader-binding
+  namespace: todoapp
+subjects:
+- kind: ServiceAccount
+  name: secrets-reader
+  namespace: todoapp
+roleRef:
+  kind: Role
+  name: secrets-reader
+  apiGroup: rbac.authorization.k8s.io

README.md

@@ -1,45 +1,22 @@
-# Django ToDo list
+# Apply cluster
 
-This is a todo list web application with basic features of most web apps, i.e., accounts/login, API, and interactive UI. To do this task, you will need:
+kind create cluster --config .infrastructure/app/cluster.yml
 
-- CSS | [Skeleton](http://getskeleton.com/)
-- JS  | [jQuery](https://jquery.com/)
+# Apply all manifests
 
-## Explore
+sh bootstrap.sh
 
-Try it out by installing the requirements (the following commands work only with Python 3.8 and higher, due to Django 4):
+# Verify updated information
 
-```
-pip install -r requirements.txt
-```
+kubectl exec <the pod you want to check> -it -n todoapp -- sh
 
-Create a database schema:
+# Paste inside pod shell
 
-```
-python manage.py migrate
-```
+APISERVER=https://kubernetes.default.svc
+SERVICEAC# COUNT=/var/run/secrets/kubernetes.io/serviceaccount
+TOKEN=$(cat ${SERVICEACCOUNT}/token)
+CACERT=${SE# # RVICEACCOUNT}/ca.crt
 
-And then start the server (default is http://localhost:8000):
+# Run the command that lists the secrets
 
-```
-python manage.py runserver
-```
-
-Now you can browse the [API](http://localhost:8000/api/) or start on the [landing page](http://localhost:8000/).
-
-## Task
-
-1. Fork this repository.
-1. Use `kind` to spin up a cluster from a `cluster.yml` configuration file.
-1. Create a manifest  named `rbac` inside a `security` directory
-1. `rbac` manifest requirements:
-    1. File should containa `ServiceAccount` definition
-    1. File should contain a `Role` definition
-    1. Role should allow to list secrets
-    1. File should contain a `RoleBinding` definition
-    1. RoleBinding should bind the `Role` to the `ServiceAccount`
-1. Use newly created `ServiceAccount` should be used by the `Deployment` in the `deployment` manifest
-1. Execute a curl command to list secrets from the `Deployment` pod to list secrets
-1. Make a screenshot of the output and attach it to the PR
-1. `README.md` should have instructuions on how to validate the changes
-1. Create PR with your changes and attach it for validation on a platform.
+curl -s --cacert ${CACERT} --header "Authorization: Bearer $TOKEN" -X GET ${APISERVER}/api/v1/namespaces/todoapp/secrets

bootstrap.sh

@@ -14,7 +14,8 @@ kubectl apply -f .infrastructure/app/clusterIp.yml
 kubectl apply -f .infrastructure/app/nodeport.yml
 kubectl apply -f .infrastructure/app/hpa.yml
 kubectl apply -f .infrastructure/app/deployment.yml
+kubectl apply -f .infrastructure/security/rbac.yml
 
 # Install Ingress Controller
 kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/kind/deploy.yaml
-# kubectl apply -f .infrastructure/ingress/ingress.yml
+kubectl apply -f .infrastructure/ingress/ingress.yml