Add service account for operator-companion (#31)

Co-authored-by: Frédéric Collonval <[email protected]>

charts/datalayer-operator/templates/companion-role.yaml

@@ -0,0 +1,14 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: datalayer-jupyter
+  name: datalayer-operator-companion
+  labels:
+    k8s-app: datalayer-operator-companion
+    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+rules:
+- apiGroups: [""] # "" indicates the core API group
+  resources: ["pods"]
+  verbs: ["get"]

charts/datalayer-operator/templates/companion-rolebinding.yaml

@@ -0,0 +1,13 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: read-pods
+  namespace: datalayer-jupyter
+subjects:
+- kind: ServiceAccount
+  name: datalayer-operator-companion
+  namespace: datalayer-jupyter
+roleRef:
+  kind: Role
+  name: datalayer-operator-companion
+  apiGroup: rbac.authorization.k8s.io

charts/datalayer-operator/templates/companion-serviceaccount.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: datalayer-operator-companion
+  namespace: datalayer-jupyter
+# Opt out of auto API credentials to prevent all containers
+# to use the service account
+automountServiceAccountToken: false