cdi rbac roles about containerized-data-importer

[davidvossel]

I didn't test this but something similar should work as a short term solution

kind: ServiceAccount
apiVersion: v1
metadata:
  name: cdi-sa
  namespace: default
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: cdi-sa
roleRef:
  kind: ClusterRole
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io
subjects:
  - kind: ServiceAccount
    name: cdi-sa
    namespace: default
---
apiVersion: apps/v1beta2
kind: Deployment
metadata:
  name: cdi-deployment
  labels:
    app: containerized-data-importer
spec:
  selector:
    matchLabels:
      app: containerized-data-importer
  replicas: 1
  template:
    metadata:
      labels:
        app: containerized-data-importer
    spec:
      serviceAccountName: cdi-sa
      containers:
      - name: cdi-controller
        image: kubevirt/cdi-controller
        imagePullPolicy: IfNotPresent

[screeley44]

@davidvossel - this should work short term like you mentioned but I'll test it out to make sure. I noticed that in kubevirt you have {{.Namespace}} where are you getting /setting that value? I'm guessing we really don't want to have default namespace defined in our manifest it should be dynamic in some way right? Or is that just relevant from kubevirt-ansible where we would pass in {{ cdi_namespace }}

[davidvossel]

I noticed that in kubevirt you have {{.Namespace}} where are you getting /setting that value? I'm guessing we really don't want to have default namespace defined in our manifest it should be dynamic in some way right? Or is that just relevant from kubevirt-ansible where we would pass in {{ cdi_namespace }}

Yep, the {{.Namespace}} variable defines what namespace kubevirt components will be installed in. You'll likely want the same thing for CDI.

I'd imagine both KubeVirt and CDI would probably be installed in the same namespace. For kubevirt-ansible, you might not have to differentiate between kubevirt and cdi namespaces.