Use a dedicated service account for CAPZ controller

config/rbac/role.yaml

@@ -21,6 +21,14 @@ rules:
   - namespaces
   verbs:
   - list
+- apiGroups:
+  - ""
+  resources:
+  - nodes
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - ""
   resources:
@@ -33,6 +41,14 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - authentication.k8s.io
   resources:
@@ -48,8 +64,7 @@ rules:
 - apiGroups:
   - bootstrap.cluster.x-k8s.io
   resources:
-  - kubeadmconfigs
-  - kubeadmconfigs/status
+  - '*'
   verbs:
   - get
   - list
@@ -128,14 +143,6 @@ rules:
   - get
   - list
   - watch
-- apiGroups:
-  - ""
-  resources:
-  - nodes
-  verbs:
-  - get
-  - list
-  - watch
 - apiGroups:
   - infrastructure.cluster.x-k8s.io
   resources:

spectro/base/kustomization.yaml

@@ -6,6 +6,7 @@ namePrefix: capz-
 
 resources:
 - ../../config/manager
+- ../../config/rbac
 
 
 
@@ -16,13 +17,6 @@ labels:
   pairs:
     cluster.x-k8s.io/provider: infrastructure-azure
 patches:
-- path: patch_service_account.yaml
-  target:
-    group: apps
-    kind: Deployment
-    name: controller-manager
-    namespace: system
-    version: v1
 - path: patch_healthcheck.yaml
   target:
     group: apps