somes fixes

deploy/pve-cloud-controller-manager.yaml

@@ -14,7 +14,6 @@ rules:
   verbs:
   - create
   - patch
-  - update
 - apiGroups: [""]
   resources: ["nodes"]
   verbs: ["*"]
@@ -30,17 +29,21 @@ rules:
   - watch
 - apiGroups: [""]
   resources: ["endpoints"]
+  verbs: ["create"]
+- apiGroups: [""]
+  resources: ["endpoints"]
+  resourceNames: ["cloud-controller-manager"]
   verbs:
-  - create
   - get
-  - list
-  - watch
   - update
 - apiGroups: ["coordination.k8s.io"]
   resources: ["leases"]
+  verbs: ["create"]
+- apiGroups: ["coordination.k8s.io"]
+  resources: ["leases"]
+  resourceNames: ["cloud-controller-manager"]
   verbs:
   - get
-  - create
   - update
 ---
 kind: ClusterRoleBinding
@@ -92,7 +95,7 @@ spec:
       - args:
         - --cloud-config=/etc/kubernetes/pve.json
         - --tls-min-version=VersionTLS12
-        - --tls-cipher-suites="TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
+        #- --tls-cipher-suites="TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
         - --cloud-provider=pve
         - --leader-elect=true
         image: reg.k8s.giftfish.de/library/pve-cloud-controller-manager-amd64:dev

deploy/pve-csr-approver-manager.yaml

@@ -26,12 +26,20 @@ rules:
   verbs:
   - create
   - update
-- apiGroups: ["coordination.k8s.io"]
-  resources: ["leases"]
+- apiGroups: [""]
+  resources: ["events"]
+  verbs:
+  - create
+  - patch
+- apiGroups: [""]
+  resources: ["configmaps"]
+  resourceNames: ["pve-csr-approver-manager"]
   verbs:
   - get
-  - create
   - update
+- apiGroups: [""]
+  resources: ["configmaps"]
+  verbs: ["create"]
 ---
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1