seon
af37d19e2a
Experiment design 5 and 7 for the harness VM (10.20.0.11): vm/harness/apply.sh pulls the secrets from Secret Manager, compose runs runner:de076a7, measure-db, blackbox, Alloy (probe_success -> Mimir) and k6 under the campaign profile. Scenario files C-K1..X-M2 are loaded by the runner. Harness ClusterRole gains replicasets get/list for rollout undo.
45 lines
1.2 KiB
YAML
45 lines
1.2 KiB
YAML
# harness runner identity (Terraform design 6.11): Chaos Mesh CRs, rollout/scale, pod reads, cordon/drain.
|
|
# Tokens are minted by `make token` (kubectl create token harness -n chaos-mesh --duration 24h) into Secret Manager.
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: harness
|
|
namespace: chaos-mesh
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: selfheal-harness
|
|
rules:
|
|
- apiGroups: ["chaos-mesh.org"]
|
|
resources: ["*"]
|
|
verbs: ["*"]
|
|
- apiGroups: ["apps"]
|
|
resources: ["deployments", "deployments/scale"]
|
|
verbs: ["get", "list", "watch", "patch"]
|
|
- apiGroups: ["apps"]
|
|
resources: ["replicasets"] # rollout undo reads the previous revision's pod template
|
|
verbs: ["get", "list"]
|
|
- apiGroups: [""]
|
|
resources: ["pods"]
|
|
verbs: ["get", "list", "watch"]
|
|
- apiGroups: [""]
|
|
resources: ["nodes"]
|
|
verbs: ["get", "list", "watch", "patch"]
|
|
- apiGroups: [""]
|
|
resources: ["pods/eviction"]
|
|
verbs: ["create"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: selfheal-harness
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: selfheal-harness
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: harness
|
|
namespace: chaos-mesh
|