Create a separate ServiceAccount for the node-level controller

config/manager/manager.yaml

@@ -64,7 +64,7 @@ spec:
       maxUnavailable: '25%'
   template:
     spec:
-      serviceAccountName: nnf-dm-controller-manager # not sure why 'controller-manager' isn't patched to include the 'nnf-dm-' prefix
+      serviceAccountName: nnf-dm-node-controller
       tolerations:
         - key: 'cray.nnf.node'
           operator: 'Equal'

config/rbac/role_binding.yaml

@@ -9,4 +9,17 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: controller-manager
-  namespace: system
+  namespace: system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: node-manager-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: manager-role
+subjects:
+- kind: ServiceAccount
+  name: node-controller
+  namespace: system

config/rbac/service_account.yaml

@@ -15,4 +15,20 @@ metadata:
   annotations:
     kubernetes.io/service-account.name: controller-manager
     kubernetes.io/service-account.namespace: system
-type: kubernetes.io/service-account-token
+type: kubernetes.io/service-account-token
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: node-controller
+  namespace: system
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: node-controller
+  namespace: system
+  annotations:
+    kubernetes.io/service-account.name: node-controller
+    kubernetes.io/service-account.namespace: system
+type: kubernetes.io/service-account-token