Revert "Revert "Revert "RBAC: rollout [2/2]"""

cluster/config-defaults.yaml

@@ -308,8 +308,3 @@ custom_dns_zone_nameservers: "" # space seperated list of nameserver IP addresse
 
 # prefix prepended to ownership TXT records for external-dns
 external_dns_ownership_prefix: ""
-
-# enable legacy serviceaccounts for smooth RBAC migration
-enable_operator_sa: "false"
-enable_default_sa: "false"
-enable_cdp_sa: "false"

cluster/manifests/deletions.yaml

@@ -22,9 +22,3 @@ post_apply:
 - name: ingress-template-controller
   kind: ClusterRoleBinding
 {{ end }}
-- name: poweruser-new
-  kind: ClusterRoleBinding
-- name: readonly-new
-  kind: ClusterRoleBinding
-- name: zmon-external-new
-  kind: ClusterRoleBinding

cluster/manifests/roles/poweruser-binding.yaml

@@ -1,7 +1,7 @@
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: poweruser
+  name: poweruser-new # TODO: migrate name
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole

cluster/manifests/roles/poweruser-role.yaml

@@ -838,18 +838,3 @@ rules:
   - create
   - update
   - patch
-- apiGroups:
-  - rbac.authorization.k8s.io
-  resources:
-  - roles
-  - rolebindings
-  - clusterroles
-  - clusterrolebindings
-  verbs:
-  - get
-  - list
-  - watch
-  - create
-  - update
-  - patch
-  - delete

cluster/manifests/roles/readonly-binding.yaml

@@ -1,7 +1,7 @@
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: readonly
+  name: readonly-new # TODO: migrate name
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole

cluster/manifests/roles/zmon-binding.yaml

@@ -1,7 +1,7 @@
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRoleBinding
 metadata:
-  name: zmon-external
+  name: zmon-external-new
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole

cluster/node-pools/master-default/userdata.yaml

@@ -226,7 +226,7 @@ write_files:
             - mountPath: /etc/kubernetes/ssl
               name: ssl-certs-kubernetes
               readOnly: true
-        - image: registry.opensource.zalan.do/teapot/k8s-authnz-webhook:v0.7.2
+        - image: registry.opensource.zalan.do/teapot/k8s-authnz-webhook:v0.7.0
           name: webhook
           ports:
           - containerPort: 8081
@@ -271,17 +271,7 @@ write_files:
             - --role-mapping=PowerUser=cn=PowerUser,ou={{.Cluster.ID}},ou=Kubernetes,ou=apps,dc=zalando,dc=net
 {{- end }}
             - --role-mapping=ReadOnly=cn=ReadOnly,ou={{.Cluster.ID}},ou=Kubernetes,ou=apps,dc=zalando,dc=net
-            # enable legacy serviceaccounts for smooth RBAC migration
-{{ if eq .Cluster.ConfigItems.enable_operator_sa "true"}}
-            - --enable-operator-sa
-{{ end }}
-{{ if eq .Cluster.ConfigItems.enable_default_sa "true"}}
-            - --enable-default-sa
-{{ end }}
-{{ if eq .Cluster.ConfigItems.enable_cdp_sa "true"}}
-            - --enable-cdp-sa
-{{ end }}
-            - --system-users=zalando-iam:zalando:service:credentials-provider
+
           env:
             - name: TEAMS_API_URL
               value: https://teams.auth.zalando.com