config-watcher-controller.yml

# Service account required for watching to resources
apiVersion: v1
kind: ServiceAccount
metadata:
  name: config-watcher-controller
---

# Bind to 'edit' role to allow for watching resources and restarting pods
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: config-watcher-controller
subjects:
- kind: ServiceAccount
  name: config-watcher-controller
roleRef:
  name: edit
  kind: ClusterRole
  apiGroup: rbac.authorization.k8s.io
---
# Controller with kubeapi-proxy sidecar for easy access to the API server
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    project: k8spatterns
    pattern: Controller
    role: contoller
  name: config-watcher-controller
spec:
  replicas: 1
  selector:
    matchLabels:
      app: config-watcher-controller
  template:
    metadata:
      labels:
        project: k8spatterns
        pattern: Controller
        app: config-watcher-controller
        role: controller
    spec:
      # A serviceaccount is needed to watch events
      # and to allow for restarting pods. For now its
      # associated with the 'edit' role
      serviceAccountName: config-watcher-controller
      containers:
      - name: kubeapi-proxy
        image: k8spatterns/kubeapi-proxy
      - name: config-watcher
        image: k8spatterns/curl-jq
        env:
         # The operator watches the namespace in which the controller
         # itself is installed (by using the Downward API)
         - name: WATCH_NAMESPACE
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
        command:
        - "sh"
        - "/watcher/config-watcher-controller.sh"
        # Mount script from a config map for ease of change
        volumeMounts:
        - mountPath: "/watcher"
          name: config-watcher-controller
      volumes:
      # Volume holding the controller script
      - name: config-watcher-controller
        configMap:
          name: config-watcher-controller