Kubernetes resources

Kubernetes resources

This page documents the Kubernetes resources Keel creates and requires.

Resources created by Keel (deploy/)

File Kind Scope Notes
deploy/namespace.yaml Namespace Cluster tak-os
deploy/rbac.yaml ServiceAccount Namespaced keel in tak-os
deploy/rbac.yaml ClusterRole Cluster keel
deploy/rbac.yaml ClusterRoleBinding Cluster binds keel SA to the keel role
deploy/daemonset.yaml DaemonSet Namespaced keel in tak-os, one pod per node
config/crd/bases/*.yaml CustomResourceDefinition Cluster nodeconfigs.keel.tlspu.io

RBAC

The keel ClusterRole grants:

Group Resource Verbs
keel.tlspu.io nodeconfigs get, list, watch
keel.tlspu.io nodeconfigs/status get, update, patch
(core) nodes get, list, watch
(core) namespaces get, list, watch
(core) configmaps get, list, watch
(core) events create, patch

The daemonset runs with serviceAccountName: keel.

DaemonSet pod

The Keel pod requests:

  • hostPID: true
  • privileged: true, runAsUser: 0, explicit unconfined seccomp
  • Read-only container filesystem and a 64Mi writable /tmp emptyDir
  • A hostPath volume mounting host / at /host
  • NODE_NAME from the downward API
  • CPU request 50m / memory 64Mi, memory limit 256Mi, ephemeral-storage limit 128Mi
  • Liveness and readiness HTTP probes on port 8081 (/healthz, /readyz)

Resources created at runtime

Keel creates and patches core/v1 Events describing NodeConfig starts/results, reads Nodes/Namespaces/ConfigMaps/NodeConfigs, and patches NodeConfig status. Events are namespaced alongside their NodeConfig; Kubernetes handles aggregation and expiry. Users create NodeConfigs and optional trigger ConfigMaps in their chosen namespace (e.g. tak-os). ConfigMap contents are not copied into status.

Optional admission resources

deploy/webhook.yaml installs a dedicated unprivileged keel-webhook Deployment, ServiceAccount, HTTPS Service, cert-manager self-signed Issuer and Certificate. cert-manager creates the TLS Secret. This account has no role binding; the mounted API credentials provide manager configuration but no additional API permissions. The Deployment has no host mounts, host PID namespace or node controller. deploy/webhook-admission.yaml separately installs the cluster-scoped ValidatingWebhookConfiguration, with CA injection from the Certificate. Apply registration only after certificate issuance and healthy endpoints; see admission.md. These resources are optional and require cert-manager or equivalent manually supplied TLS material and CA configuration.

Cluster-scoped vs namespaced

  • Cluster-scoped: CRD, Namespace, ClusterRole, ClusterRoleBinding, optional ValidatingWebhookConfiguration.
  • Namespaced: ServiceAccount, DaemonSet, NodeConfig CRs, Events, optional trigger ConfigMaps and webhook Deployment/Service/Issuer/Certificate/TLS Secret.

When deploying through a tenant that cannot create cluster-scoped resources, pre-provision the cluster-scoped pieces and ship only the namespaced ones.