[stable/traefik] Optional RBAC support for k8s 1.6+

[cknowles]

RBAC support is required for k8s 1.6+ clusters with RBAC enabled.

Docs are here.

Example here.

I think it should be optional to support users on k8s < 1.6.

[krancour]

@c-knowles any thoughts on how to implement this?

I imagine defining roles and creating service accounts to be the duty of a cluster operator. By that token, I am wondering if maybe all this chart should do is allow the deployment to optionally reference a service account that is defined out-of-band.

Or...

Do we want to say that whoever installs this chart (typically into the kube-system namespace) is the cluster operator and it's therefore acceptable for the role, service account, and role binding to be defined within this very chart?

I'm comfortable with either approach. Am just curious to know what you had in mind.

[cknowles]

Hmmm, interesting question. I hadn't thought about it much, just wanted to get the item in so we can start to think about it. My first impression is allow it in this chart for ease of use, or at least allow it as an option so this can work out of the box. I wonder what the other charts are doing/assuming.

In my case I'm running the chart updates in from our CI so if it isn't built in for now I would likely just put the deploy of the roles and bindings there as well until I work out a nicer way to include them in some automated cluster initialisation.

[krancour]

I wonder what the other charts are doing/assuming.

Let's keep an eye on that, contribute to those discussions, and see if we can be consistent with whatever the consensus ends up being.

[blackstar257]

Is there any other discussions around this going on? I know this is an issue for Traefik specifically, but its a bigger helm chart issue for 1.6+

[skorski]

Any update on this? I've been having trouble with a slow traefik service and wanted to try using this instead. Out of the box, that's not possible yet. Is there a proposed helm direction based on the community?

[cknowles]

Submitted a PR just now, there's a comment in the PR but not sure why when switching RBAC off that the deployment still has the old service account. While this is a bit of an edge case, I've set the service account to default when rbac is disabled. @krancour have you seen that issue before? I could not find anything in the Helm or main Kubernetes repos about it.

[kachkaev]

Also could not start traefik on k8s 1.6 with helm. Had to fallback to https://docs.traefik.io/user-guide/kubernetes/ with the rbac step before the rest.

[cknowles]

#1225 is now merged.