added csr approver

deploy/pve-cloud-controller-manager.yaml

@@ -60,7 +60,7 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
-        image: reg.k8s.giftfish.de/library/pve-cloud-controller-manager-amd64:latest
+        image: reg.k8s.giftfish.de/library/pve-cloud-controller-manager-amd64:dev
         imagePullPolicy: Always
         livenessProbe:
           httpGet:

deploy/pve-csr-approver-manager.yaml

@@ -0,0 +1,105 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: pve-csr-approver
+  namespace: kube-system
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRole
+metadata:
+  name: pve-csr-approver
+rules:
+- apiGroups:
+  - certificates.k8s.io
+  resources:
+  - signers
+  # legacy-unknown: support before kubernetes-1.18.0
+  resourceNames:
+  - "kubernetes.io/legacy-unknown"
+  - "kubernetes.io/kubelet-serving"
+  verbs:
+  - approve
+- apiGroups:
+  - certificates.k8s.io
+  resources:
+  - certificatesigningrequests
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - certificates.k8s.io
+  resources:
+  - certificatesigningrequests/approval
+  verbs:
+  - create
+  - update
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: pve-csr-approver
+subjects:
+- kind: ServiceAccount
+  namespace: kube-system
+  name: pve-csr-approver
+roleRef:
+  kind: ClusterRole
+  name: pve-csr-approver
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: pve-csr-approver-manager
+  name: pve-csr-approver-manager
+  namespace: kube-system
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: pve-csr-approver-manager
+  template:
+    metadata:
+      annotations:
+        scheduler.alpha.kubernetes.io/critical-pod: ""
+      labels:
+        app: pve-csr-approver-manager
+    spec:
+      containers:
+      - name: manager
+        env:
+        - name: PVE_API
+          valueFrom:
+            secretKeyRef:
+              key: api
+              name: pvecloud
+        - name: PVE_USER
+          valueFrom:
+            secretKeyRef:
+              key: user
+              name: pvecloud
+        - name: PVE_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: pvecloud
+        image: reg.k8s.giftfish.de/library/pve-csr-approver-manager-amd64:dev
+        imagePullPolicy: Always
+        resources:
+          requests:
+            cpu: 100m
+            memory: 50Mi
+      dnsPolicy: Default
+      serviceAccountName: pve-csr-approver
+      tolerations:
+      - effect: NoSchedule
+        key: node.cloudprovider.kubernetes.io/uninitialized
+        value: "true"
+      - key: CriticalAddonsOnly
+        operator: Exists
+      - effect: NoSchedule
+        key: node-role.kubernetes.io/master
+      - effect: NoSchedule
+        key: node.kubernetes.io/not-ready