Reconciler fixup
I made some changes further down the revision stack which weren't properly propagated.
This makes sure the code from subsequent revisions also has the necessary changes.
Test Plan: `bazel run //:launch` no longer shows the reconciler looping
X-Origin-Diff: phab/D547
GitOrigin-RevId: 2d8c6121b071504048f10cd8a34cbfba2a0f94b7
diff --git a/core/internal/kubernetes/reconcile.go b/core/internal/kubernetes/reconcile.go
index 93ee4da..b000883 100644
--- a/core/internal/kubernetes/reconcile.go
+++ b/core/internal/kubernetes/reconcile.go
@@ -116,6 +116,9 @@
{
ObjectMeta: metav1.ObjectMeta{
Name: rbac("psp-default"),
+ Labels: map[string]string{
+ "smalltown.com/builtin": "true",
+ },
Annotations: map[string]string{
"kubernetes.io/description": "This role grants access to the \"default\" PSP.",
},
@@ -135,6 +138,9 @@
{
ObjectMeta: metav1.ObjectMeta{
Name: rbac("default-psp-for-sa"),
+ Labels: map[string]string{
+ "smalltown.com/builtin": "true",
+ },
Annotations: map[string]string{
"kubernetes.io/description": "This binding grants every service account access to the \"default\" PSP. " +
"Creation of Pods is still restricted by other RBAC roles. Otherwise no pods (unprivileged or not) " +
@@ -157,6 +163,9 @@
{
ObjectMeta: metav1.ObjectMeta{
Name: rbac("apiserver-kubelet-client"),
+ Labels: map[string]string{
+ "smalltown.com/builtin": "true",
+ },
Annotations: map[string]string{
"kubernetes.io/description": "This binding grants the apiserver access to the kubelets. This enables " +
"lots of built-in functionality like reading logs or forwarding ports via the API.",