We still have one more pending issue that we can solve with ServiceAccounts. In the previous chapter we tried to use cvallance/mongo-k8s-sidecar container in hopes it'll dynamically create and manage a MongoDB replica set.
We failed because, at that time, we did not know how to create sufficient permissions that would allow the side-car to do its job. Now we know better.
Let's take a look at an updated version of our go-demo-3 application.
1 cat sa/go-demo-3.yml
The relevant parts of the output are as follows
... apiVersion: v1 kind: ServiceAccount metadata: name: db namespace: go-demo-3
---
kind: Role apiVersion: rbac.authorization.k8s.io/v1beta1 metadata: name: db namespace: go-demo-3 rules: - apiGroups: [""] resources: ["pods"] verbs: ["list"]
---
apiVersion: rbac.authorization...