From ebd7d12d17a4ca5a08e7d3bdb42b266cc3a36609 Mon Sep 17 00:00:00 2001
From: ston1th <ston1th@giftfish.de>
Date: Sun, 1 Nov 2020 01:17:54 +0100
Subject: [PATCH] somes fixes

---
 cmd/pve-csr-approver-manager/main.go     |  2 +-
 deploy/pve-cloud-controller-manager.yaml | 15 +++++++++------
 deploy/pve-csr-approver-manager.yaml     | 14 +++++++++++---
 pkg/approver/approver.go                 |  2 --
 4 files changed, 21 insertions(+), 12 deletions(-)

diff --git a/cmd/pve-csr-approver-manager/main.go b/cmd/pve-csr-approver-manager/main.go
index 80391c4..87c12a3 100644
--- a/cmd/pve-csr-approver-manager/main.go
+++ b/cmd/pve-csr-approver-manager/main.go
@@ -76,6 +76,7 @@ func main() {
 		LeaderElection:         leaderElect,
 		LeaderElectionID:       "pve-csr-approver-manager",
 		HealthProbeBindAddress: healthAddr,
+		MetricsBindAddress:     "0",
 		SyncPeriod:             &syncPeriod,
 	})
 	if err != nil {
@@ -117,7 +118,6 @@ func main() {
 		Client:    mgr.GetClient(),
 		Log:       ctrl.Log.WithName("controllers").WithName("CSR"),
 		Scheme:    mgr.GetScheme(),
-		Recorder:  mgr.GetEventRecorderFor("pvecluster-controller"),
 		PVEClient: pveClient,
 		CSRClient: typedcertificatesv1beta1.NewForConfigOrDie(rcfg),
 	}).SetupWithManager(mgr, controller.Options{MaxConcurrentReconciles: csrConcurrency}); err != nil {
diff --git a/deploy/pve-cloud-controller-manager.yaml b/deploy/pve-cloud-controller-manager.yaml
index ccabca5..c7b0e2c 100644
--- a/deploy/pve-cloud-controller-manager.yaml
+++ b/deploy/pve-cloud-controller-manager.yaml
@@ -14,7 +14,6 @@ rules:
   verbs:
   - create
   - patch
-  - update
 - apiGroups: [""]
   resources: ["nodes"]
   verbs: ["*"]
@@ -30,17 +29,21 @@ rules:
   - watch
 - apiGroups: [""]
   resources: ["endpoints"]
+  verbs: ["create"]
+- apiGroups: [""]
+  resources: ["endpoints"]
+  resourceNames: ["cloud-controller-manager"]
   verbs:
-  - create
   - get
-  - list
-  - watch
   - update
 - apiGroups: ["coordination.k8s.io"]
   resources: ["leases"]
+  verbs: ["create"]
+- apiGroups: ["coordination.k8s.io"]
+  resources: ["leases"]
+  resourceNames: ["cloud-controller-manager"]
   verbs:
   - get
-  - create
   - update
 ---
 kind: ClusterRoleBinding
@@ -92,7 +95,7 @@ spec:
       - args:
         - --cloud-config=/etc/kubernetes/pve.json
         - --tls-min-version=VersionTLS12
-        - --tls-cipher-suites="TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
+        #- --tls-cipher-suites="TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
         - --cloud-provider=pve
         - --leader-elect=true
         image: reg.k8s.giftfish.de/library/pve-cloud-controller-manager-amd64:dev
diff --git a/deploy/pve-csr-approver-manager.yaml b/deploy/pve-csr-approver-manager.yaml
index 4444d15..4a7dbd7 100644
--- a/deploy/pve-csr-approver-manager.yaml
+++ b/deploy/pve-csr-approver-manager.yaml
@@ -26,12 +26,20 @@ rules:
   verbs:
   - create
   - update
-- apiGroups: ["coordination.k8s.io"]
-  resources: ["leases"]
+- apiGroups: [""]
+  resources: ["events"]
+  verbs:
+  - create
+  - patch
+- apiGroups: [""]
+  resources: ["configmaps"]
+  resourceNames: ["pve-csr-approver-manager"]
   verbs:
   - get
-  - create
   - update
+- apiGroups: [""]
+  resources: ["configmaps"]
+  verbs: ["create"]
 ---
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
diff --git a/pkg/approver/approver.go b/pkg/approver/approver.go
index 5028e92..8713e4a 100644
--- a/pkg/approver/approver.go
+++ b/pkg/approver/approver.go
@@ -15,7 +15,6 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/util/sets"
 	typedcertificatesv1beta1 "k8s.io/client-go/kubernetes/typed/certificates/v1beta1"
-	"k8s.io/client-go/tools/record"
 	"k8s.io/kubernetes/pkg/apis/certificates"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -26,7 +25,6 @@ var ErrNoKubeletServingCSR = errors.New("CSR is no kubelet serving certificate")
 
 type CSRReconciler struct {
 	client.Client
-	Recorder  record.EventRecorder
 	Log       logr.Logger
 	Scheme    *runtime.Scheme
 	PVEClient *pve.Client