Make RoleBinding for Postgres ServiceAccount Work

[eberlep]

It seems I can't get the RoleBinding of the postgres-pod ServiceAccount to the postgres-pod ClusterRole to work. This is, however, neccessary for us so that our updated PodSecurityPolicy takes effect.

We have updated the ClusterRole postgres-pod:

  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
    name: postgres-pod
  rules:
[...]
  - apiGroups:
    - extensions
    resourceNames:
    - privileged
    - postgres-operator-psp # add our new PSP
    resources:
    - podsecuritypolicies
    verbs:
    - use

The default RoleBinding (as taken from the operator's log) should be sufficient (and does indeed work if I apply it manually):

"PodServiceAccountRoleBindingDefinition\": \"{\\\"apiVersion\\\":\\\"rbac.authorization.k8s.io/v1\\\",\\\"kind\\\":\\\"RoleBinding\\\",\\\"metadata\\\":{\\\"name\\\":\\\"postgres-pod\\\"},\\\"roleRef\\\":{\\\"apiGroup\\\":\\\"rbac.authorization.k8s.io\\\",\\\"kind\\\":\\\"ClusterRole\\\",\\\"name\\\":\\\"postgres-pod\\\"},\\\"subjects\\\":[{\\\"kind\\\":\\\"ServiceAccount\\\",\\\"name\\\":\\\"postgres-pod\\\"}]}\"," pkg=controller

However, when the operator gets deployed an the postgres cluster is being created, the pods fail to start due to a lack of persistentVolumeClaim permissions, and no RoleBinding for the ServiceAccount postgres-pod exists.

There are several routes to take here:

• Make sure the operator applies the RoleBinding
• dynamically apply the RoleBinding in our OperatorManager
• Completely manage the ServiceAccount and ClusterRoles ourselves (also in the OperatorManager)