Solution

.infrastructure/app/deployment.yml

@@ -17,7 +17,7 @@ spec:
       labels:
         app: todoapp
     spec:
-      serviceAccountName: secrets-reader
+      serviceAccountName: secret-lister
       containers:
       - name: todoapp
         image: ikulyk404/todoapp:4.0.1
@@ -91,4 +91,4 @@ spec:
           secretName: app-secret
       - name: app-config-volume
         configMap:
-          name: app-config
+          name: app-config

.infrastructure/security/rbac.yml

@@ -0,0 +1,33 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: secret-lister
+  namespace: todoapp
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: secret-lister-role
+  namespace: todoapp
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["list"]
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: secret-lister-binding
+  namespace: todoapp
+subjects:
+  - kind: ServiceAccount
+    name: secret-lister
+    namespace: todoapp
+roleRef:
+  kind: Role
+  name: secret-lister-role
+  apiGroup: rbac.authorization.k8s.io

INSTRUCTION.md

@@ -0,0 +1,42 @@
+d# RBAC for TodoApp
+
+## 1. Create a kubernetes cluster using kind:
+
+```bash
+kind create cluster --config cluster.yml
+```
+
+## 2. Deploy the application and additional resources:
+```bash
+./bootstrap.sh
+```
+
+## 3. Wait for 2 minutes for all pods to initialize. Once ready, verify pods status:
+```bash
+kubectl get pods -n todoapp
+```
+If this command does not show you information about your pods, try verifing cluster name using command:
+```bash
+kubectl config current-context
+kubectl get pods -n todoapp --context <current context>
+```
+and replace 'kind-kind' with your context
+
+## 4. Connect to a pod:
+Replace <pod name> with your pod name
+```bash
+kubectl exec -n todoapp <pod name> -it -- sh
+```
+
+## 5. Set Up and Execute the CURL Command:
+```bash
+SERVICEACCOUNT=/var/run/secrets/kubernetes.io/serviceaccount
+APISERVER=https://kubernetes.default.svc
+TOKEN=$(cat ${SERVICEACCOUNT}/token)
+CACERT=${SERVICEACCOUNT}/ca.crt
+
+curl --cacert ${CACERT} --header "Authorization: Bearer ${TOKEN}" -X GET ${APISERVER}/api/v1/namespaces/todoapp/secrets
+```
+
+## Verify the Output:
+The response should include the details of the secrets in the todoapp namespace.

bootstrap.sh

@@ -15,6 +15,8 @@ kubectl apply -f .infrastructure/app/nodeport.yml
 kubectl apply -f .infrastructure/app/hpa.yml
 kubectl apply -f .infrastructure/app/deployment.yml
 
+kubectl apply -f .infrastructure/security/rbac.yml
+
 # Install Ingress Controller
 kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/kind/deploy.yaml
 # kubectl apply -f .infrastructure/ingress/ingress.yml