solved

.infrastructure/app/deployment.yml

@@ -12,12 +12,13 @@ spec:
   selector:
     matchLabels:
       app: todoapp
+  replicas: 2
   template:
     metadata:
       labels:
         app: todoapp
     spec:
-      serviceAccountName: secrets-reader
+      serviceAccountName: list-pods-sa
       containers:
       - name: todoapp
         image: ikulyk404/todoapp:4.0.1

.infrastructure/security/rbac.yml

@@ -0,0 +1,33 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: list-pods-sa
+  namespace: todoapp
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: list-pods-role
+  namespace: todoapp
+rules:
+  - apiGroups: [""]
+    resources: ["pods", "secrets"]
+    verbs: ["get", "list"]
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: list-pods-rb
+  namespace: todoapp
+subjects:
+  - kind: ServiceAccount
+    name: list-pods-sa
+    namespace: todoapp
+roleRef:
+  kind: Role
+  name: list-pods-role
+  apiGroup: rbac.authorization.k8s.io

INSTRUCTIONS.md

@@ -0,0 +1,12 @@
+In order to validate that the roles are applied correctly:
+
+kubectl exec -it <pod-name> -- /bin/sh
+
+TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
+NAMESPACE=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)
+
+curl -s -k \
+  -H "Authorization: Bearer $TOKEN" \
+  https://kubernetes.default.svc/api/v1/namespaces/$NAMESPACE/secrets
+
+

bootstrap.sh

@@ -1,20 +1,21 @@
 #!/bin/bash
-kubectl apply -f .infrastructure/mysql/ns.yml
-kubectl apply -f .infrastructure/mysql/configMap.yml
-kubectl apply -f .infrastructure/mysql/secret.yml
-kubectl apply -f .infrastructure/mysql/service.yml
-kubectl apply -f .infrastructure/mysql/statefulSet.yml
+# kubectl apply -f .infrastructure/mysql/ns.yml
+# kubectl apply -f .infrastructure/mysql/configMap.yml
+# kubectl apply -f .infrastructure/mysql/secret.yml
+# kubectl apply -f .infrastructure/mysql/service.yml
+# kubectl apply -f .infrastructure/mysql/statefulSet.yml
 
-kubectl apply -f .infrastructure/app/ns.yml
+# kubectl apply -f .infrastructure/app/ns.yml
 kubectl apply -f .infrastructure/app/pv.yml
 kubectl apply -f .infrastructure/app/pvc.yml
 kubectl apply -f .infrastructure/app/secret.yml
 kubectl apply -f .infrastructure/app/configMap.yml
 kubectl apply -f .infrastructure/app/clusterIp.yml
-kubectl apply -f .infrastructure/app/nodeport.yml
+# kubectl apply -f .infrastructure/app/nodeport.yml
 kubectl apply -f .infrastructure/app/hpa.yml
 kubectl apply -f .infrastructure/app/deployment.yml
+kubectl apply -f .infrastructure/security/rbac.yml
 
 # Install Ingress Controller
-kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/kind/deploy.yaml
+# kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/kind/deploy.yaml
 # kubectl apply -f .infrastructure/ingress/ingress.yml

cluster.yml

@@ -43,14 +43,6 @@ nodes:
     hostPort: 443
     protocol: TCP
 # the two workers
-- role: worker
-  extraMounts:
-    - hostPath: /tmp
-      containerPath: /data
-- role: worker
-  extraMounts:
-    - hostPath: /tmp
-      containerPath: /data
 - role: worker
   extraMounts:
     - hostPath: /tmp