diff --git a/submariner-operator/templates/_helpers.tpl b/submariner-operator/templates/_helpers.tpl index 911eaa9..2df8baa 100644 --- a/submariner-operator/templates/_helpers.tpl +++ b/submariner-operator/templates/_helpers.tpl @@ -47,7 +47,7 @@ Create the name of the submariner-engine service account to use */}} {{- define "submariner.engineServiceAccountName" -}} {{- if .Values.serviceAccounts.engine.create -}} - {{ default (printf "%s-engine" (include "submariner.fullname" .)) .Values.serviceAccounts.engine.name }} + {{ default "submariner-engine" .Values.serviceAccounts.engine.name }} {{- else -}} {{ default "default" .Values.serviceAccounts.engine.name }} {{- end -}} @@ -58,7 +58,7 @@ Create the name of the submariner-route-agent service account to use */}} {{- define "submariner.routeAgentServiceAccountName" -}} {{- if .Values.serviceAccounts.routeAgent.create -}} - {{ default (printf "%s-routeagent" (include "submariner.fullname" .)) .Values.serviceAccounts.routeAgent.name }} + {{ default "submariner-routeagent" .Values.serviceAccounts.routeAgent.name }} {{- else -}} {{ default "default" .Values.serviceAccounts.routeAgent.name }} {{- end -}} @@ -69,20 +69,31 @@ Create the name of the submariner-globalnet service account to use */}} {{- define "submariner.globalnetServiceAccountName" -}} {{- if .Values.serviceAccounts.globalnet.create -}} - {{ default (printf "%s-globalnet" (include "submariner.fullname" .)) .Values.serviceAccounts.globalnet.name }} + {{ default "submariner-globalnet" .Values.serviceAccounts.globalnet.name }} {{- else -}} {{ default "default" .Values.serviceAccounts.globalnet.name }} {{- end -}} {{- end -}} {{/* -Create the name of the submariner-lighthouse service account to use +Create the name of the submariner-lighthouse-agent service account to use */}} -{{- define "submariner.lighthouseServiceAccountName" -}} -{{- if .Values.submariner.serviceDiscovery -}} - {{ default (printf "%s-lighthouse" (include "submariner.fullname" .)) .Values.serviceAccounts.lighthouse.name }} +{{- define "submariner.lighthouseAgentServiceAccountName" -}} +{{- if and (.Values.submariner.serviceDiscovery ) (.Values.serviceAccounts.lighthouseAgent.create) -}} + {{ default "submariner-lighthouse-agent" .Values.serviceAccounts.lighthouseAgent.name }} {{- else -}} - {{ default "default" .Values.serviceAccounts.lighthouse.name }} + {{ default "default" .Values.serviceAccounts.lighthouseAgent.name }} +{{- end -}} +{{- end -}} + +{{/* +Create the name of the submariner-lighthouse-coredns service account to use +*/}} +{{- define "submariner.lighthouseCoreDnsServiceAccountName" -}} +{{- if and (.Values.submariner.serviceDiscovery ) (.Values.serviceAccounts.lighthouseCoreDns.create) -}} + {{ default "submariner-lighthouse-coredns" .Values.serviceAccounts.lighthouseCoreDns.name }} +{{- else -}} + {{ default "default" .Values.serviceAccounts.lighthouseCoreDns.name }} {{- end -}} {{- end -}} diff --git a/submariner-operator/templates/rbac.yaml b/submariner-operator/templates/rbac.yaml index 8fbb6a7..1000bfc 100644 --- a/submariner-operator/templates/rbac.yaml +++ b/submariner-operator/templates/rbac.yaml @@ -77,7 +77,7 @@ metadata: app: {{ template "submariner.name" . }} subjects: - kind: ServiceAccount - name: {{ template "submariner.fullname" . }} + name: {{ template "submariner.operatorServiceAccountName" . }} roleRef: kind: Role name: {{ template "submariner.fullname" . }} @@ -93,15 +93,75 @@ metadata: chart: {{ template "submariner.chart" . }} app: {{ template "submariner.name" . }} rules: -- apiGroups: [""] - resources: ["configmaps"] - verbs: ["create", "get", "list", "watch", "patch", "update"] -- apiGroups: ["submariner.io"] - resources: ["clusters", "endpoints", "gateways"] - verbs: ["create", "get", "list", "watch", "patch", "update", "delete"] -- apiGroups: [""] - resources: ["events"] - verbs: ["create", "patch"] +- apiGroups: + - "" + resources: + - pods + - services + - services/finalizers + - endpoints + - persistentvolumeclaims + - events + - configmaps + - secrets + verbs: + - '*' +- apiGroups: + - apps + resources: + - deployments + - daemonsets + - replicasets + - statefulsets + verbs: + - '*' +- apiGroups: + - monitoring.coreos.com + resources: + - servicemonitors + verbs: + - get + - create +- apiGroups: + - apps + resourceNames: + - submariner-operator + resources: + - deployments/finalizers + verbs: + - update +- apiGroups: + - "" + resources: + - pods + verbs: + - get +- apiGroups: + - apps + resources: + - replicasets + verbs: + - get +- apiGroups: + - submariner.io + resources: + - '*' + - servicediscoveries + verbs: + - '*' +- apiGroups: + - lighthouse.submariner.io + resources: + - '*' + - serviceexports + verbs: + - create + - delete + - get + - list + - patch + - update + - watch --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding @@ -118,7 +178,7 @@ roleRef: name: {{ template "submariner.fullname" . }}:engine subjects: - kind: ServiceAccount - name: {{ template "submariner.operatorServiceAccountName" . }} + name: {{ template "submariner.engineServiceAccountName" . }} namespace: {{ .Release.Namespace }} --- apiVersion: rbac.authorization.k8s.io/v1 @@ -131,12 +191,75 @@ metadata: chart: {{ template "submariner.chart" . }} app: {{ template "submariner.name" . }} rules: -- apiGroups: ["submariner.io"] - resources: ["clusters", "endpoints", "gateways"] - verbs: ["create", "get", "list", "watch", "patch", "update"] -- apiGroups: [""] - resources: ["pods"] - verbs: ["get", "watch", "list"] + - apiGroups: + - "" + resources: + - pods + - services + - services/finalizers + - endpoints + - persistentvolumeclaims + - events + - configmaps + - secrets + verbs: + - '*' + - apiGroups: + - apps + resources: + - deployments + - daemonsets + - replicasets + - statefulsets + verbs: + - '*' + - apiGroups: + - monitoring.coreos.com + resources: + - servicemonitors + verbs: + - get + - create + - apiGroups: + - apps + resourceNames: + - submariner-operator + resources: + - deployments/finalizers + verbs: + - update + - apiGroups: + - "" + resources: + - pods + verbs: + - get + - apiGroups: + - apps + resources: + - replicasets + verbs: + - get + - apiGroups: + - submariner.io + resources: + - '*' + - servicediscoveries + verbs: + - '*' + - apiGroups: + - lighthouse.submariner.io + resources: + - '*' + - serviceexports + verbs: + - create + - delete + - get + - list + - patch + - update + - watch --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding @@ -153,9 +276,109 @@ roleRef: name: {{ template "submariner.fullname" . }}:routeagent subjects: - kind: ServiceAccount - name: {{ template "submariner.operatorServiceAccountName" . }} + name: {{ template "submariner.routeAgentServiceAccountName" . }} namespace: {{ .Release.Namespace }} --- +{{- if ne .Values.submariner.globalCidr "" }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ template "submariner.fullname" . }}:globalnet + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: {{ template "submariner.chart" . }} + app: {{ template "submariner.name" . }} +rules: + - apiGroups: + - "" + resources: + - pods + - services + - services/finalizers + - endpoints + - persistentvolumeclaims + - events + - configmaps + - secrets + verbs: + - '*' + - apiGroups: + - apps + resources: + - deployments + - daemonsets + - replicasets + - statefulsets + verbs: + - '*' + - apiGroups: + - monitoring.coreos.com + resources: + - servicemonitors + verbs: + - get + - create + - apiGroups: + - apps + resourceNames: + - submariner-operator + resources: + - deployments/finalizers + verbs: + - update + - apiGroups: + - "" + resources: + - pods + verbs: + - get + - apiGroups: + - apps + resources: + - replicasets + verbs: + - get + - apiGroups: + - submariner.io + resources: + - '*' + - servicediscoveries + verbs: + - '*' + - apiGroups: + - lighthouse.submariner.io + resources: + - '*' + - serviceexports + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ template "submariner.fullname" . }}:globalnet + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: {{ template "submariner.chart" . }} + app: {{ template "submariner.name" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ template "submariner.fullname" . }}:globalnet +subjects: + - kind: ServiceAccount + name: {{ template "submariner.globalnetServiceAccountName" . }} + namespace: {{ .Release.Namespace }} +--- +{{- end -}} apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: @@ -169,24 +392,50 @@ rules: # submariner-operator updates the config map of core-dns to forward requests to # clusterset.local to Lighthouse DNS, also looks at existing configmaps # to figure out network settings - - apiGroups: [""] - resources: ["configmaps"] - verbs: ["get", "list", "watch", "update"] - - apiGroups: ["apiextensions.k8s.io"] - resources: ["customresourcedefinitions"] - verbs: ["get", "list", "create", "update", "delete"] - - apiGroups: [""] # pods and services are looked up to figure out network settings - resources: ["pods", "services"] - verbs: ["get", "list", "watch"] - - apiGroups: ["operator.openshift.io"] - resources: ["dnses"] - verbs: ["get", "list", "watch", "update"] - - apiGroups: ["config.openshift.io"] - resources: ["networks"] - verbs: ["get", "list"] - - apiGroups: ["multicluster.x-k8s.io"] - resources: ["*"] - verbs: ["create", "get", "list", "watch", "update", "delete"] + - apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - update + - apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - list + - create + - update + - delete + - apiGroups: # pods and services are looked up to figure out network settings + - "" + resources: + - pods + - services + verbs: + - get + - list + - watch + - apiGroups: + - operator.openshift.io + resources: + - dnses + verbs: + - get + - list + - watch + - update + - apiGroups: + - config.openshift.io + resources: + - networks + verbs: + - get + - list --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -208,6 +457,91 @@ roleRef: --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole +metadata: + name: {{ template "submariner.fullname" . }}:engine + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: {{ template "submariner.chart" . }} + app: {{ template "submariner.name" . }} +rules: + - apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - list + - create + - update + - delete + - apiGroups: # pods and services are looked up to figure out network settings + - "" + resources: + - pods + - services + - nodes + verbs: + - get + - list + - watch + - apiGroups: + - operator.openshift.io + resources: + - dnses + verbs: + - get + - list + - watch + - update + - apiGroups: + - config.openshift.io + resources: + - networks + verbs: + - get + - list + - apiGroups: + - submariner.io + resources: + - endpoints + - gateways + - clusters + verbs: + - get + - list + - watch +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ template "submariner.fullname" . }}:engine + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: {{ template "submariner.chart" . }} + app: {{ template "submariner.name" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "submariner.fullname" . }}:engine +subjects: + - kind: ServiceAccount + name: {{ template "submariner.engineServiceAccountName" . }} + namespace: {{ .Release.Namespace }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole metadata: name: {{ template "submariner.fullname" . }}:routeagent labels: @@ -216,9 +550,59 @@ metadata: chart: {{ template "submariner.chart" . }} app: {{ template "submariner.name" . }} rules: - - apiGroups: [""] - resources: ["nodes"] - verbs: ["get", "update"] + - apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - update + - apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - list + - create + - update + - delete + - apiGroups: # pods and services are looked up to figure out network settings + - "" + resources: + - pods + - services + verbs: + - get + - list + - watch + - apiGroups: + - operator.openshift.io + resources: + - dnses + verbs: + - get + - list + - watch + - update + - apiGroups: + - config.openshift.io + resources: + - networks + verbs: + - get + - list + - apiGroups: + - "" + verbs: + - get + - list + - watch + - update + resources: + - nodes --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -235,9 +619,10 @@ roleRef: name: {{ template "submariner.fullname" . }}:routeagent subjects: - kind: ServiceAccount - name: {{ template "submariner.operatorServiceAccountName" . }} + name: {{ template "submariner.routeAgentServiceAccountName" . }} namespace: {{ .Release.Namespace }} --- +{{- if ne .Values.submariner.globalCidr "" }} apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: @@ -248,13 +633,37 @@ metadata: chart: {{ template "submariner.chart" . }} app: {{ template "submariner.name" . }} rules: -- apiGroups: [""] - resources: ["services", "namespaces", "pods", "nodes"] - verbs: ["get", "list", "watch", "update"] -- apiGroups: ["submariner.io"] - resources: ["clusters", "endpoints", "gateways"] - verbs: ["get", "list", "watch"] + - apiGroups: + - "" + resources: + - pods + - services + - namespaces + - nodes + verbs: + - get + - list + - watch + - update + - apiGroups: + - submariner.io + resources: + - endpoints + - clusters + verbs: + - get + - list + - watch + - apiGroups: + - multicluster.x-k8s.io + resources: + - "serviceexports" + verbs: + - get + - list + - watch --- +{{- end -}} apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: @@ -270,37 +679,67 @@ roleRef: name: {{ template "submariner.fullname" . }}:globalnet subjects: - kind: ServiceAccount - name: {{ template "submariner.operatorServiceAccountName" . }} + name: {{ template "submariner.globalnetServiceAccountName" . }} namespace: {{ .Release.Namespace }} --- {{- if .Values.submariner.serviceDiscovery }} apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: {{ template "submariner.fullname" . }}:lighthouse + name: {{ template "submariner.fullname" . }}:lighthouse-agent labels: heritage: {{ .Release.Service | quote }} release: {{ .Release.Name | quote }} chart: {{ template "submariner.chart" . }} app: {{ template "submariner.name" . }} rules: - - apiGroups: [""] - resources: ["services", "namespaces", "configmaps", "endpoints"] - verbs: ["get", "list", "watch", "update"] - - apiGroups: ["discovery.k8s.io"] - resources: ["endpointslices"] - verbs: ["create", "get", "list", "watch", "update", "delete"] - - apiGroups: ["lighthouse.submariner.io"] - resources: ["*"] - verbs: ["create", "get", "list", "watch", "update", "delete"] - - apiGroups: ["submariner.io"] - resources: ["gateways"] - verbs: ["get", "list", "watch"] + - apiGroups: + - "" + resources: + - services + - namespaces + - endpoints + verbs: + - get + - list + - watch + - update + - apiGroups: + - discovery.k8s.io + resources: + - endpointslices + verbs: + - create + - get + - list + - watch + - update + - delete + - deletecollection + - apiGroups: + - submariner.io + resources: + - "gateways" + verbs: + - get + - list + - watch + - apiGroups: + - multicluster.x-k8s.io + resources: + - "*" + verbs: + - create + - get + - list + - watch + - update + - delete --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: - name: {{ template "submariner.fullname" . }}:lighthouse + name: {{ template "submariner.fullname" . }}:lighthouse-agent labels: heritage: {{ .Release.Service | quote }} release: {{ .Release.Name | quote }} @@ -309,10 +748,82 @@ metadata: roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole - name: {{ template "submariner.fullname" . }}:lighthouse + name: {{ template "submariner.fullname" . }}:lighthouse-agent subjects: - kind: ServiceAccount - name: {{ template "submariner.operatorServiceAccountName" . }} + name: {{ template "submariner.lighthouseAgentServiceAccountName" . }} + namespace: {{ .Release.Namespace }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ template "submariner.fullname" . }}:lighthouse-coredns +rules: + - apiGroups: + - "" + resources: + - services + - namespaces + - endpoints + verbs: + - get + - list + - watch + - update + - apiGroups: + - discovery.k8s.io + resources: + - endpointslices + verbs: + - create + - get + - list + - watch + - update + - delete + - deletecollection + - apiGroups: + - lighthouse.submariner.io + resources: + - "*" + verbs: + - create + - get + - list + - watch + - update + - delete + - apiGroups: + - submariner.io + resources: + - "gateways" + verbs: + - get + - list + - watch + - apiGroups: + - multicluster.x-k8s.io + resources: + - "*" + verbs: + - create + - get + - list + - watch + - update + - delete +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ template "submariner.fullname" . }}:lighthouse-coredns +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "submariner.fullname" . }}:lighthouse-coredns +subjects: + - kind: ServiceAccount + name: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }} namespace: {{ .Release.Namespace }} {{- end -}} {{- end -}} diff --git a/submariner-operator/templates/svc-acct.yaml b/submariner-operator/templates/svc-acct.yaml index f7abcad..2cfc525 100644 --- a/submariner-operator/templates/svc-acct.yaml +++ b/submariner-operator/templates/svc-acct.yaml @@ -46,14 +46,26 @@ metadata: app: {{ template "submariner.name" . }} {{- end }} --- -{{- if .Values.serviceAccounts.lighthouse.create }} +{{- if .Values.serviceAccounts.lighthouseAgent.create }} apiVersion: v1 kind: ServiceAccount metadata: - name: {{ template "submariner.lighthouseServiceAccountName" . }} + name: {{ template "submariner.lighthouseAgentServiceAccountName" . }} labels: heritage: {{ .Release.Service | quote }} release: {{ .Release.Name | quote }} chart: {{ template "submariner.chart" . }} app: {{ template "submariner.name" . }} {{- end }} +--- + {{- if .Values.serviceAccounts.lighthouseCoreDns.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }} + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: {{ template "submariner.chart" . }} + app: {{ template "submariner.name" . }} + {{- end }} diff --git a/submariner-operator/values.yaml b/submariner-operator/values.yaml index 1e60d96..0e03d02 100644 --- a/submariner-operator/values.yaml +++ b/submariner-operator/values.yaml @@ -54,6 +54,9 @@ serviceAccounts: globalnet: create: true name: "" - lighthouse: - create: false + lighthouseAgent: + create: true + name: "" + lighthouseCoreDns: + create: true name: "" diff --git a/submariner/templates/_helpers.tpl b/submariner/templates/_helpers.tpl index d512372..99477b3 100644 --- a/submariner/templates/_helpers.tpl +++ b/submariner/templates/_helpers.tpl @@ -36,7 +36,7 @@ Create the name of the submariner-engine service account to use */}} {{- define "submariner.engineServiceAccountName" -}} {{- if .Values.serviceAccounts.engine.create -}} - {{ default (printf "%s-engine" (include "submariner.fullname" .)) .Values.serviceAccounts.engine.name }} + {{ default "submariner-engine" .Values.serviceAccounts.engine.name }} {{- else -}} {{ default "default" .Values.serviceAccounts.engine.name }} {{- end -}} @@ -47,7 +47,7 @@ Create the name of the submariner-route-agent service account to use */}} {{- define "submariner.routeAgentServiceAccountName" -}} {{- if .Values.serviceAccounts.routeAgent.create -}} - {{ default (printf "%s-routeagent" (include "submariner.fullname" .)) .Values.serviceAccounts.routeAgent.name }} + {{ default "submariner-routeagent" .Values.serviceAccounts.routeAgent.name }} {{- else -}} {{ default "default" .Values.serviceAccounts.routeAgent.name }} {{- end -}} @@ -58,20 +58,31 @@ Create the name of the submariner-globalnet service account to use */}} {{- define "submariner.globalnetServiceAccountName" -}} {{- if .Values.serviceAccounts.globalnet.create -}} - {{ default (printf "%s-globalnet" (include "submariner.fullname" .)) .Values.serviceAccounts.globalnet.name }} + {{ default "submariner-globalnet" .Values.serviceAccounts.globalnet.name }} {{- else -}} {{ default "default" .Values.serviceAccounts.globalnet.name }} {{- end -}} {{- end -}} {{/* -Create the name of the submariner-lighthouse service account to use +Create the name of the submariner-lighthouse-agent service account to use */}} -{{- define "submariner.lighthouseServiceAccountName" -}} -{{- if .Values.submariner.serviceDiscovery -}} - {{ default (printf "%s-lighthouse" (include "submariner.fullname" .)) .Values.serviceAccounts.lighthouse.name }} +{{- define "submariner.lighthouseAgentServiceAccountName" -}} +{{- if and (.Values.submariner.serviceDiscovery ) (.Values.serviceAccounts.lighthouseAgent.create) -}} + {{ default "submariner-lighthouse-agent" .Values.serviceAccounts.lighthouseAgent.name }} {{- else -}} - {{ default "default" .Values.serviceAccounts.lighthouse.name }} + {{ default "default" .Values.serviceAccounts.lighthouseAgent.name }} +{{- end -}} +{{- end -}} + +{{/* +Create the name of the submariner-lighthouse-coredns service account to use +*/}} +{{- define "submariner.lighthouseCoreDnsServiceAccountName" -}} +{{- if and (.Values.submariner.serviceDiscovery ) (.Values.serviceAccounts.lighthouseCoreDns.create) -}} + {{ default "submariner-lighthouse-coredns" .Values.serviceAccounts.lighthouseCoreDns.name }} +{{- else -}} + {{ default "default" .Values.serviceAccounts.lighthouseCoreDns.name }} {{- end -}} {{- end -}} diff --git a/submariner/templates/lighthouse-coredns.yaml b/submariner/templates/lighthouse-coredns.yaml index 99430d2..e7897b0 100644 --- a/submariner/templates/lighthouse-coredns.yaml +++ b/submariner/templates/lighthouse-coredns.yaml @@ -30,7 +30,7 @@ spec: - mountPath: /etc/coredns name: config-volume readOnly: true - serviceAccountName: {{ template "submariner.lighthouseServiceAccountName" . }} + serviceAccountName: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }} volumes: - configMap: defaultMode: 420 diff --git a/submariner/templates/lighthouse.yaml b/submariner/templates/lighthouse.yaml index 8be0240..f47ce49 100644 --- a/submariner/templates/lighthouse.yaml +++ b/submariner/templates/lighthouse.yaml @@ -19,7 +19,7 @@ spec: labels: app: {{ template "submariner.fullname" . }}-lighthouse-agent spec: - serviceAccountName: {{ template "submariner.lighthouseServiceAccountName" . }} + serviceAccountName: {{ template "submariner.lighthouseAgentServiceAccountName" . }} containers: - command: - lighthouse-agent.sh diff --git a/submariner/templates/rbac.yaml b/submariner/templates/rbac.yaml index 814f045..94563eb 100644 --- a/submariner/templates/rbac.yaml +++ b/submariner/templates/rbac.yaml @@ -9,15 +9,93 @@ metadata: chart: {{ template "submariner.chart" . }} app: {{ template "submariner.name" . }} rules: -- apiGroups: [""] - resources: ["configmaps"] - verbs: ["create", "get", "list", "watch", "patch", "update"] -- apiGroups: ["submariner.io"] - resources: ["clusters", "endpoints", "gateways"] - verbs: ["create", "get", "list", "watch", "patch", "update", "delete"] -- apiGroups: [""] - resources: ["events"] - verbs: ["create", "patch"] + - apiGroups: + - "" + resources: + - pods + - services + - services/finalizers + - endpoints + - persistentvolumeclaims + - events + - configmaps + - secrets + verbs: + - '*' + - apiGroups: + - apps + resources: + - deployments + - daemonsets + - replicasets + - statefulsets + verbs: + - '*' + - apiGroups: + - monitoring.coreos.com + resources: + - servicemonitors + verbs: + - get + - create + - apiGroups: + - apps + resourceNames: + - submariner-operator + resources: + - deployments/finalizers + verbs: + - update + - apiGroups: + - "" + resources: + - pods + verbs: + - get + - apiGroups: + - apps + resources: + - replicasets + verbs: + - get + - apiGroups: + - submariner.io + resources: + - '*' + - servicediscoveries + verbs: + - '*' + - apiGroups: + - lighthouse.submariner.io + resources: + - '*' + - serviceexports + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ template "submariner.fullname" . }}:engine + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: {{ template "submariner.chart" . }} + app: {{ template "submariner.name" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ template "submariner.fullname" . }}:engine +subjects: + - kind: ServiceAccount + name: {{ template "submariner.engineServiceAccountName" . }} + namespace: {{ .Release.Namespace }} --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role @@ -29,52 +107,353 @@ metadata: chart: {{ template "submariner.chart" . }} app: {{ template "submariner.name" . }} rules: -- apiGroups: ["submariner.io"] - resources: ["clusters", "endpoints", "gateways"] - verbs: ["create", "get", "list", "watch", "patch", "update"] -- apiGroups: [""] - resources: ["pods"] - verbs: ["get", "watch", "list"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ template "submariner.fullname" . }}:engine -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: {{ template "submariner.fullname" . }}:engine -subjects: -- kind: ServiceAccount - name: {{ template "submariner.engineServiceAccountName" . }} - namespace: {{ .Release.Namespace }} + - apiGroups: + - "" + resources: + - pods + - services + - services/finalizers + - endpoints + - persistentvolumeclaims + - events + - configmaps + - secrets + verbs: + - '*' + - apiGroups: + - apps + resources: + - deployments + - daemonsets + - replicasets + - statefulsets + verbs: + - '*' + - apiGroups: + - monitoring.coreos.com + resources: + - servicemonitors + verbs: + - get + - create + - apiGroups: + - apps + resourceNames: + - submariner-operator + resources: + - deployments/finalizers + verbs: + - update + - apiGroups: + - "" + resources: + - pods + verbs: + - get + - apiGroups: + - apps + resources: + - replicasets + verbs: + - get + - apiGroups: + - submariner.io + resources: + - '*' + - servicediscoveries + verbs: + - '*' + - apiGroups: + - lighthouse.submariner.io + resources: + - '*' + - serviceexports + verbs: + - create + - delete + - get + - list + - patch + - update + - watch --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: {{ template "submariner.fullname" . }}:routeagent + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: {{ template "submariner.chart" . }} + app: {{ template "submariner.name" . }} roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: {{ template "submariner.fullname" . }}:routeagent subjects: -- kind: ServiceAccount - name: {{ template "submariner.routeAgentServiceAccountName" . }} - namespace: {{ .Release.Namespace }} + - kind: ServiceAccount + name: {{ template "submariner.routeAgentServiceAccountName" . }} + namespace: {{ .Release.Namespace }} +--- +{{- if ne .Values.submariner.globalCidr "" }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ template "submariner.fullname" . }}:globalnet + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: {{ template "submariner.chart" . }} + app: {{ template "submariner.name" . }} +rules: + - apiGroups: + - "" + resources: + - pods + - services + - services/finalizers + - endpoints + - persistentvolumeclaims + - events + - configmaps + - secrets + verbs: + - '*' + - apiGroups: + - apps + resources: + - deployments + - daemonsets + - replicasets + - statefulsets + verbs: + - '*' + - apiGroups: + - monitoring.coreos.com + resources: + - servicemonitors + verbs: + - get + - create + - apiGroups: + - apps + resourceNames: + - submariner-operator + resources: + - deployments/finalizers + verbs: + - update + - apiGroups: + - "" + resources: + - pods + verbs: + - get + - apiGroups: + - apps + resources: + - replicasets + verbs: + - get + - apiGroups: + - submariner.io + resources: + - '*' + - servicediscoveries + verbs: + - '*' + - apiGroups: + - lighthouse.submariner.io + resources: + - '*' + - serviceexports + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ template "submariner.fullname" . }}:globalnet + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: {{ template "submariner.chart" . }} + app: {{ template "submariner.name" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ template "submariner.fullname" . }}:globalnet +subjects: + - kind: ServiceAccount + name: {{ template "submariner.globalnetServiceAccountName" . }} + namespace: {{ .Release.Namespace }} +--- +{{- end -}} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ template "submariner.fullname" . }}:engine + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: {{ template "submariner.chart" . }} + app: {{ template "submariner.name" . }} +rules: + - apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - list + - create + - update + - delete + - apiGroups: # pods and services are looked up to figure out network settings + - "" + resources: + - pods + - services + - nodes + verbs: + - get + - list + - watch + - apiGroups: + - operator.openshift.io + resources: + - dnses + verbs: + - get + - list + - watch + - update + - apiGroups: + - config.openshift.io + resources: + - networks + verbs: + - get + - list + - apiGroups: + - submariner.io + resources: + - endpoints + - gateways + - clusters + verbs: + - get + - list + - watch +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ template "submariner.fullname" . }}:engine + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: {{ template "submariner.chart" . }} + app: {{ template "submariner.name" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "submariner.fullname" . }}:engine +subjects: + - kind: ServiceAccount + name: {{ template "submariner.engineServiceAccountName" . }} + namespace: {{ .Release.Namespace }} --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: {{ template "submariner.fullname" . }}:routeagent + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: {{ template "submariner.chart" . }} + app: {{ template "submariner.name" . }} rules: - - apiGroups: [""] - resources: ["nodes"] - verbs: ["get", "list", "watch", "update"] + - apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - update + - apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - list + - create + - update + - delete + - apiGroups: # pods and services are looked up to figure out network settings + - "" + resources: + - pods + - services + verbs: + - get + - list + - watch + - apiGroups: + - operator.openshift.io + resources: + - dnses + verbs: + - get + - list + - watch + - update + - apiGroups: + - config.openshift.io + resources: + - networks + verbs: + - get + - list + - apiGroups: + - "" + verbs: + - get + - list + - watch + - update + resources: + - nodes --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: {{ template "submariner.fullname" . }}:routeagent + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: {{ template "submariner.chart" . }} + app: {{ template "submariner.name" . }} roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole @@ -89,85 +468,203 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: {{ template "submariner.fullname" . }}:globalnet + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: {{ template "submariner.chart" . }} + app: {{ template "submariner.name" . }} rules: -- apiGroups: [""] - resources: ["services", "namespaces", "pods", "nodes"] - verbs: ["get", "list", "watch", "update"] -- apiGroups: ["submariner.io"] - resources: ["clusters", "endpoints", "gateways"] - verbs: ["get", "list", "watch"] + - apiGroups: + - "" + resources: + - pods + - services + - namespaces + - nodes + verbs: + - get + - list + - watch + - update + - apiGroups: + - submariner.io + resources: + - endpoints + - clusters + verbs: + - get + - list + - watch + - apiGroups: + - multicluster.x-k8s.io + resources: + - "serviceexports" + verbs: + - get + - list + - watch --- +{{- end -}} apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: {{ template "submariner.fullname" . }}:globalnet + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: {{ template "submariner.chart" . }} + app: {{ template "submariner.name" . }} roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: {{ template "submariner.fullname" . }}:globalnet subjects: -- kind: ServiceAccount - name: {{ template "submariner.globalnetServiceAccountName" . }} - namespace: {{ .Release.Namespace }} + - kind: ServiceAccount + name: {{ template "submariner.globalnetServiceAccountName" . }} + namespace: {{ .Release.Namespace }} --- -{{- end -}} -{{- if ne .Values.submariner.globalCidr "" }} -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ template "submariner.fullname" . }}:engine -rules: -- apiGroups: [""] - resources: ["nodes"] - verbs: ["get", "list", "watch"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: {{ template "submariner.fullname" . }}:engine -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: {{ template "submariner.fullname" . }}:engine -subjects: -- kind: ServiceAccount - name: {{ template "submariner.engineServiceAccountName" . }} - namespace: {{ .Release.Namespace }} ---- -{{- end -}} {{- if .Values.submariner.serviceDiscovery }} apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: {{ template "submariner.fullname" . }}:lighthouse + name: {{ template "submariner.fullname" . }}:lighthouse-agent + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: {{ template "submariner.chart" . }} + app: {{ template "submariner.name" . }} rules: - - apiGroups: [""] - resources: ["services", "namespaces", "configmaps", "endpoints"] - verbs: ["get", "list", "watch", "update"] - - apiGroups: ["discovery.k8s.io"] - resources: ["endpointslices"] - verbs: ["create", "get", "list", "watch", "update", "delete", "deletecollection"] - - apiGroups: ["lighthouse.submariner.io"] - resources: ["*"] - verbs: ["create", "get", "list", "watch", "update", "delete"] - - apiGroups: ["submariner.io"] - resources: ["gateways"] - verbs: ["get", "list", "watch"] - - apiGroups: ["multicluster.x-k8s.io"] - resources: ["*"] - verbs: ["create", "get", "list", "watch", "update", "delete"] + - apiGroups: + - "" + resources: + - services + - namespaces + - endpoints + verbs: + - get + - list + - watch + - update + - apiGroups: + - discovery.k8s.io + resources: + - endpointslices + verbs: + - create + - get + - list + - watch + - update + - delete + - deletecollection + - apiGroups: + - submariner.io + resources: + - "gateways" + verbs: + - get + - list + - watch + - apiGroups: + - multicluster.x-k8s.io + resources: + - "*" + verbs: + - create + - get + - list + - watch + - update + - delete --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: - name: {{ template "submariner.fullname" . }}:lighthouse + name: {{ template "submariner.fullname" . }}:lighthouse-agent + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: {{ template "submariner.chart" . }} + app: {{ template "submariner.name" . }} roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole - name: {{ template "submariner.fullname" . }}:lighthouse + name: {{ template "submariner.fullname" . }}:lighthouse-agent subjects: - kind: ServiceAccount - name: {{ template "submariner.lighthouseServiceAccountName" . }} + name: {{ template "submariner.lighthouseAgentServiceAccountName" . }} + namespace: {{ .Release.Namespace }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ template "submariner.fullname" . }}:lighthouse-coredns +rules: + - apiGroups: + - "" + resources: + - services + - namespaces + - endpoints + verbs: + - get + - list + - watch + - update + - apiGroups: + - discovery.k8s.io + resources: + - endpointslices + verbs: + - create + - get + - list + - watch + - update + - delete + - deletecollection + - apiGroups: + - lighthouse.submariner.io + resources: + - "*" + verbs: + - create + - get + - list + - watch + - update + - delete + - apiGroups: + - submariner.io + resources: + - "gateways" + verbs: + - get + - list + - watch + - apiGroups: + - multicluster.x-k8s.io + resources: + - "*" + verbs: + - create + - get + - list + - watch + - update + - delete +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ template "submariner.fullname" . }}:lighthouse-coredns +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "submariner.fullname" . }}:lighthouse-coredns +subjects: + - kind: ServiceAccount + name: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }} namespace: {{ .Release.Namespace }} {{- end -}} {{- end -}} diff --git a/submariner/templates/svc-acct.yaml b/submariner/templates/svc-acct.yaml index cecf8e1..154c2c9 100644 --- a/submariner/templates/svc-acct.yaml +++ b/submariner/templates/svc-acct.yaml @@ -34,14 +34,26 @@ metadata: app: {{ template "submariner.name" . }} {{- end }} --- -{{- if .Values.serviceAccounts.lighthouse.create }} +{{- if .Values.serviceAccounts.lighthouseAgent.create }} apiVersion: v1 kind: ServiceAccount metadata: - name: {{ template "submariner.lighthouseServiceAccountName" . }} + name: {{ template "submariner.lighthouseAgentServiceAccountName" . }} labels: heritage: {{ .Release.Service | quote }} release: {{ .Release.Name | quote }} chart: {{ template "submariner.chart" . }} app: {{ template "submariner.name" . }} {{- end }} +--- +{{- if .Values.serviceAccounts.lighthouseCoreDns.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }} + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: {{ template "submariner.chart" . }} + app: {{ template "submariner.name" . }} + {{- end }} diff --git a/submariner/values.yaml b/submariner/values.yaml index b847cbe..4a2ced6 100644 --- a/submariner/values.yaml +++ b/submariner/values.yaml @@ -72,8 +72,11 @@ serviceAccounts: create: true name: "" globalnet: - create: false + create: true name: "" - lighthouse: - create: false + lighthouseAgent: + create: true + name: "" + lighthouseCoreDns: + create: true name: ""