test RBAC, add kubelet restart to default disruptive policy

Author: QiWang19

manifests/machineconfigcontroller/criocredentialprovider-cluster-role.yaml

@@ -0,0 +1,26 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: node-credential-providers
+rules:
+  - apiGroups: [""]
+    resources: ["serviceaccounts"]
+    verbs: ["get", "list"]
+  - apiGroups: [""]
+    resources: ["*"]
+    verbs: ["request-serviceaccounts-token-audience"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: node-credential-providers-binding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: node-credential-providers
+subjects:
+  - apiGroup: rbac.authorization.k8s.io
+    kind: Group
+    # Required for each node, is there a better way to do this?
+    name: system:nodes

pkg/apihelpers/apihelpers.go

@@ -108,6 +108,18 @@ var (
 					},
 				},
 			},
+			// Add default policy for KubernetesCredentialProvidersDir
+			{
+				Path: constants.KubernetesCredentialProvidersDir,
+				Actions: []opv1.NodeDisruptionPolicyStatusAction{
+					{
+						Type: opv1.RestartStatusAction,
+						Restart: &opv1.RestartService{
+							ServiceName: "kubelet.service",
+						},
+					},
+				},
+			},
 		},
 		SSHKey: opv1.NodeDisruptionPolicyStatusSSHKey{
 			Actions: []opv1.NodeDisruptionPolicyStatusAction{