k3s/cluster/addons/metadata-agent/stackdriver/podsecuritypolicies/metadata-agent-psp-binding....

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: gce:podsecuritypolicy:metadata-agent
  namespace: kube-system
  labels:
    addonmanager.kubernetes.io/mode: Reconcile
    kubernetes.io/cluster-service: "true"
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: gce:podsecuritypolicy:privileged
subjects:
  - kind: ServiceAccount
    name: metadata-agent
    namespace: kube-system
Fix RBAC permissions for metadata agent. 2017-12-20 13:41:25 +00:00			`apiVersion: rbac.authorization.k8s.io/v1`
Enable “Kubernetes Monitoring” and “PodSecurityPolicies” on the same cluster Without that the daemonset "metadata-agent" return: ```pods "metadata-agent-" is forbidden: unable to validate against any pod security policy: [spec.containers[0].securityContext.containers[0].hostPort: Invalid value: 8799: Host port 8799 is not allowed to be used. Allowed ports: []]``` 2018-06-26 12:06:32 +00:00			`kind: RoleBinding`
			`metadata:`
			`name: gce:podsecuritypolicy:metadata-agent`
			`namespace: kube-system`
			`labels:`
			`addonmanager.kubernetes.io/mode: Reconcile`
			`kubernetes.io/cluster-service: "true"`
			`roleRef:`
			`apiGroup: rbac.authorization.k8s.io`
			`kind: ClusterRole`
			`name: gce:podsecuritypolicy:privileged`
			`subjects:`
			`- kind: ServiceAccount`
			`name: metadata-agent`
			`namespace: kube-system`