add rbac

k8s/interpreter/100-interpreter-pod.yaml

@@ -12,7 +12,7 @@ spec:
   containers:
   - name: {{CONTAINER_NAME}}
     image: {{CONTAINER_IMAGE}}
-    command: ["sh", "-c", "$(ZEPPELIN_HOME)/bin/interpreter.sh -d $(ZEPPELIN_HOME)/interpreter/{{INTP_NAME}} -r {{INTP_PORT}}:{{INTP_PORT}} -c {{CALLBACK_HOST}} -p {{CALLBACK_PORT}} -i {{INTP_ID}} -l {{INTP_REPO}} -g {{INTP_SETTING}}"]
+    command: ["sh", "-c", "$(ZEPPELIN_HOME)/bin/interpreter.sh -d $(ZEPPELIN_HOME)/interpreter/{{INTP_NAME}} -r {{INTP_PORT}} -c {{CALLBACK_HOST}} -p {{CALLBACK_PORT}} -i {{INTP_ID}} -l {{INTP_REPO}} -g {{INTP_SETTING}}"]
     env:
     - name: ZEPPELIN_HOME
       value: /zeppelin

k8s/zeppelin.yaml

@@ -9,7 +9,7 @@ spec:
   automountServiceAccountToken: true
   containers:
   - name: zeppelin-server
-    image: apache/zeppelin:0.8.0
+    image: apache/zeppelin:0.9.0-SNAPSHOT
     command: ["sh", "-c", "$(ZEPPELIN_HOME)/bin/zeppelin.sh"]
     env:
     - name: ZEPPELIN_HOME
@@ -30,3 +30,25 @@ spec:
       port: 12320
   selector:
     app: zeppelin-server
+---
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: zeppelin-server-role
+  namespace: default
+rules:
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["create", "get", "update", "patch", "list", "delete", "watch"]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: zeppelin-server-role-binding
+subjects:
+- kind: ServiceAccount
+  name: default
+roleRef:
+  kind: Role
+  name: zeppelin-server-role
+  apiGroup: rbac.authorization.k8s.io