fix(rbac): sa and rbac definitions (#117)

Sync the SA and RBAC definitions with what we have in submariner-operator.

Signed-off-by: Steve Mattar <smattar@redhat.com>

submariner-operator/templates/_helpers.tpl

@@ -47,7 +47,7 @@ Create the name of the submariner-engine service account to use
 */}}
 {{- define "submariner.engineServiceAccountName" -}}
 {{- if .Values.serviceAccounts.engine.create -}}
-    {{ default (printf "%s-engine" (include "submariner.fullname" .)) .Values.serviceAccounts.engine.name }}
+    {{ default "submariner-engine" .Values.serviceAccounts.engine.name }}
 {{- else -}}
     {{ default "default" .Values.serviceAccounts.engine.name }}
 {{- end -}}
@@ -58,7 +58,7 @@ Create the name of the submariner-route-agent service account to use
 */}}
 {{- define "submariner.routeAgentServiceAccountName" -}}
 {{- if .Values.serviceAccounts.routeAgent.create -}}
-    {{ default (printf "%s-routeagent" (include "submariner.fullname" .)) .Values.serviceAccounts.routeAgent.name }}
+    {{ default "submariner-routeagent" .Values.serviceAccounts.routeAgent.name }}
 {{- else -}}
     {{ default "default" .Values.serviceAccounts.routeAgent.name }}
 {{- end -}}
@@ -69,20 +69,31 @@ Create the name of the submariner-globalnet service account to use
 */}}
 {{- define "submariner.globalnetServiceAccountName" -}}
 {{- if .Values.serviceAccounts.globalnet.create -}}
-    {{ default (printf "%s-globalnet" (include "submariner.fullname" .)) .Values.serviceAccounts.globalnet.name }}
+    {{ default "submariner-globalnet" .Values.serviceAccounts.globalnet.name }}
 {{- else -}}
     {{ default "default" .Values.serviceAccounts.globalnet.name }}
 {{- end -}}
 {{- end -}}
 
 {{/*
-Create the name of the submariner-lighthouse service account to use
+Create the name of the submariner-lighthouse-agent service account to use
 */}}
-{{- define "submariner.lighthouseServiceAccountName" -}}
+{{- define "submariner.lighthouseAgentServiceAccountName" -}}
-{{- if .Values.submariner.serviceDiscovery -}}
+{{- if and (.Values.submariner.serviceDiscovery ) (.Values.serviceAccounts.lighthouseAgent.create) -}}
-    {{ default (printf "%s-lighthouse" (include "submariner.fullname" .)) .Values.serviceAccounts.lighthouse.name }}
+    {{ default "submariner-lighthouse-agent" .Values.serviceAccounts.lighthouseAgent.name }}
 {{- else -}}
-    {{ default "default" .Values.serviceAccounts.lighthouse.name }}
+    {{ default "default" .Values.serviceAccounts.lighthouseAgent.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create the name of the submariner-lighthouse-coredns service account to use
+*/}}
+{{- define "submariner.lighthouseCoreDnsServiceAccountName" -}}
+{{- if and (.Values.submariner.serviceDiscovery ) (.Values.serviceAccounts.lighthouseCoreDns.create) -}}
+    {{ default "submariner-lighthouse-coredns" .Values.serviceAccounts.lighthouseCoreDns.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccounts.lighthouseCoreDns.name }}
 {{- end -}}
 {{- end -}}
 

submariner-operator/templates/rbac.yaml

@@ -77,7 +77,7 @@ metadata:
     app: {{ template "submariner.name" . }}
 subjects:
 - kind: ServiceAccount
-  name: {{ template "submariner.fullname" . }}
+  name: {{ template "submariner.operatorServiceAccountName" . }}
 roleRef:
   kind: Role
   name: {{ template "submariner.fullname" . }}
@@ -93,15 +93,75 @@ metadata:
     chart: {{ template "submariner.chart" . }}
     app: {{ template "submariner.name" . }}
 rules:
-- apiGroups: [""]
+- apiGroups:
-  resources: ["configmaps"]
+    - ""
-  verbs: ["create", "get", "list", "watch", "patch", "update"]
+  resources:
-- apiGroups: ["submariner.io"]
+    - pods
-  resources: ["clusters", "endpoints", "gateways"]
+    - services
-  verbs: ["create", "get", "list", "watch", "patch", "update", "delete"]
+    - services/finalizers
-- apiGroups: [""]
+    - endpoints
-  resources: ["events"]
+    - persistentvolumeclaims
-  verbs: ["create", "patch"]
+    - events
+    - configmaps
+    - secrets
+  verbs:
+    - '*'
+- apiGroups:
+    - apps
+  resources:
+    - deployments
+    - daemonsets
+    - replicasets
+    - statefulsets
+  verbs:
+    - '*'
+- apiGroups:
+    - monitoring.coreos.com
+  resources:
+    - servicemonitors
+  verbs:
+    - get
+    - create
+- apiGroups:
+    - apps
+  resourceNames:
+    - submariner-operator
+  resources:
+    - deployments/finalizers
+  verbs:
+    - update
+- apiGroups:
+    - ""
+  resources:
+    - pods
+  verbs:
+    - get
+- apiGroups:
+    - apps
+  resources:
+    - replicasets
+  verbs:
+    - get
+- apiGroups:
+    - submariner.io
+  resources:
+    - '*'
+    - servicediscoveries
+  verbs:
+    - '*'
+- apiGroups:
+    - lighthouse.submariner.io
+  resources:
+    - '*'
+    - serviceexports
+  verbs:
+    - create
+    - delete
+    - get
+    - list
+    - patch
+    - update
+    - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -118,7 +178,7 @@ roleRef:
   name: {{ template "submariner.fullname" . }}:engine
 subjects:
 - kind: ServiceAccount
-  name: {{ template "submariner.operatorServiceAccountName" . }}
+  name: {{ template "submariner.engineServiceAccountName" . }}
   namespace: {{ .Release.Namespace }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -131,12 +191,75 @@ metadata:
     chart: {{ template "submariner.chart" . }}
     app: {{ template "submariner.name" . }}
 rules:
-- apiGroups: ["submariner.io"]
+  - apiGroups:
-  resources: ["clusters", "endpoints", "gateways"]
+      - ""
-  verbs: ["create", "get", "list", "watch", "patch", "update"]
+    resources:
-- apiGroups: [""]
+      - pods
-  resources: ["pods"]
+      - services
-  verbs: ["get", "watch", "list"]
+      - services/finalizers
+      - endpoints
+      - persistentvolumeclaims
+      - events
+      - configmaps
+      - secrets
+    verbs:
+      - '*'
+  - apiGroups:
+      - apps
+    resources:
+      - deployments
+      - daemonsets
+      - replicasets
+      - statefulsets
+    verbs:
+      - '*'
+  - apiGroups:
+      - monitoring.coreos.com
+    resources:
+      - servicemonitors
+    verbs:
+      - get
+      - create
+  - apiGroups:
+      - apps
+    resourceNames:
+      - submariner-operator
+    resources:
+      - deployments/finalizers
+    verbs:
+      - update
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - get
+  - apiGroups:
+      - apps
+    resources:
+      - replicasets
+    verbs:
+      - get
+  - apiGroups:
+      - submariner.io
+    resources:
+      - '*'
+      - servicediscoveries
+    verbs:
+      - '*'
+  - apiGroups:
+      - lighthouse.submariner.io
+    resources:
+      - '*'
+      - serviceexports
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -153,9 +276,109 @@ roleRef:
   name: {{ template "submariner.fullname" . }}:routeagent
 subjects:
 - kind: ServiceAccount
-  name: {{ template "submariner.operatorServiceAccountName" . }}
+  name: {{ template "submariner.routeAgentServiceAccountName" . }}
   namespace: {{ .Release.Namespace }}
 ---
+{{- if ne .Values.submariner.globalCidr "" }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ template "submariner.fullname" . }}:globalnet
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+      - services
+      - services/finalizers
+      - endpoints
+      - persistentvolumeclaims
+      - events
+      - configmaps
+      - secrets
+    verbs:
+      - '*'
+  - apiGroups:
+      - apps
+    resources:
+      - deployments
+      - daemonsets
+      - replicasets
+      - statefulsets
+    verbs:
+      - '*'
+  - apiGroups:
+      - monitoring.coreos.com
+    resources:
+      - servicemonitors
+    verbs:
+      - get
+      - create
+  - apiGroups:
+      - apps
+    resourceNames:
+      - submariner-operator
+    resources:
+      - deployments/finalizers
+    verbs:
+      - update
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - get
+  - apiGroups:
+      - apps
+    resources:
+      - replicasets
+    verbs:
+      - get
+  - apiGroups:
+      - submariner.io
+    resources:
+      - '*'
+      - servicediscoveries
+    verbs:
+      - '*'
+  - apiGroups:
+      - lighthouse.submariner.io
+    resources:
+      - '*'
+      - serviceexports
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:globalnet
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "submariner.fullname" . }}:globalnet
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "submariner.globalnetServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+---
+{{- end -}}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
@@ -169,24 +392,50 @@ rules:
   # submariner-operator updates the config map of core-dns to forward requests to
   # clusterset.local to Lighthouse DNS, also looks at existing configmaps
   # to figure out network settings
-  - apiGroups: [""]
+  - apiGroups:
-    resources: ["configmaps"]
+      - ""
-    verbs: ["get", "list", "watch", "update"]
+    resources:
-  - apiGroups: ["apiextensions.k8s.io"]
+      - configmaps
-    resources: ["customresourcedefinitions"]
+    verbs:
-    verbs: ["get", "list", "create", "update", "delete"]
+      - get
-  - apiGroups: [""] # pods and services are looked up to figure out network settings
+      - list
-    resources: ["pods", "services"]
+      - watch
-    verbs: ["get", "list", "watch"]
+      - update
-  - apiGroups: ["operator.openshift.io"]
+  - apiGroups:
-    resources: ["dnses"]
+      - apiextensions.k8s.io
-    verbs: ["get", "list", "watch", "update"]
+    resources:
-  - apiGroups: ["config.openshift.io"]
+      - customresourcedefinitions
-    resources: ["networks"]
+    verbs:
-    verbs: ["get", "list"]
+      - get
-  - apiGroups: ["multicluster.x-k8s.io"]
+      - list
-    resources: ["*"]
+      - create
-    verbs: ["create", "get", "list", "watch", "update", "delete"]
+      - update
+      - delete
+  - apiGroups:  # pods and services are looked up to figure out network settings
+      - ""
+    resources:
+      - pods
+      - services
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - operator.openshift.io
+    resources:
+      - dnses
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - config.openshift.io
+    resources:
+      - networks
+    verbs:
+      - get
+      - list
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -208,6 +457,91 @@ roleRef:
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
+metadata:
+  name: {{ template "submariner.fullname" . }}:engine
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions
+    verbs:
+      - get
+      - list
+      - create
+      - update
+      - delete
+  - apiGroups:  # pods and services are looked up to figure out network settings
+      - ""
+    resources:
+      - pods
+      - services
+      - nodes
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - operator.openshift.io
+    resources:
+      - dnses
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - config.openshift.io
+    resources:
+      - networks
+    verbs:
+      - get
+      - list
+  - apiGroups:
+      - submariner.io
+    resources:
+      - endpoints
+      - gateways
+      - clusters
+    verbs:
+      - get
+      - list
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:engine
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "submariner.fullname" . }}:engine
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "submariner.engineServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
 metadata:
   name: {{ template "submariner.fullname" . }}:routeagent
   labels:
@@ -216,9 +550,59 @@ metadata:
     chart: {{ template "submariner.chart" . }}
     app: {{ template "submariner.name" . }}
 rules:
-  - apiGroups: [""]
+  - apiGroups:
-    resources: ["nodes"]
+      - ""
-    verbs: ["get", "update"]
+    resources:
+      - configmaps
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions
+    verbs:
+      - get
+      - list
+      - create
+      - update
+      - delete
+  - apiGroups:  # pods and services are looked up to figure out network settings
+      - ""
+    resources:
+      - pods
+      - services
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - operator.openshift.io
+    resources:
+      - dnses
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - config.openshift.io
+    resources:
+      - networks
+    verbs:
+      - get
+      - list
+  - apiGroups:
+      - ""
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+    resources:
+      - nodes
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -235,9 +619,10 @@ roleRef:
   name: {{ template "submariner.fullname" . }}:routeagent
 subjects:
   - kind: ServiceAccount
-    name: {{ template "submariner.operatorServiceAccountName" . }}
+    name: {{ template "submariner.routeAgentServiceAccountName" . }}
     namespace: {{ .Release.Namespace }}
 ---
+{{- if ne .Values.submariner.globalCidr "" }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
@@ -248,13 +633,37 @@ metadata:
     chart: {{ template "submariner.chart" . }}
     app: {{ template "submariner.name" . }}
 rules:
-- apiGroups: [""]
+  - apiGroups:
-  resources: ["services", "namespaces", "pods", "nodes"]
+      - ""
-  verbs: ["get", "list", "watch", "update"]
+    resources:
-- apiGroups: ["submariner.io"]
+      - pods
-  resources: ["clusters", "endpoints", "gateways"]
+      - services
-  verbs: ["get", "list", "watch"]
+      - namespaces
+      - nodes
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - submariner.io
+    resources:
+      - endpoints
+      - clusters
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - multicluster.x-k8s.io
+    resources:
+      - "serviceexports"
+    verbs:
+      - get
+      - list
+      - watch
 ---
+{{- end -}}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
@@ -270,37 +679,67 @@ roleRef:
   name: {{ template "submariner.fullname" . }}:globalnet
 subjects:
 - kind: ServiceAccount
-  name: {{ template "submariner.operatorServiceAccountName" . }}
+  name: {{ template "submariner.globalnetServiceAccountName" . }}
   namespace: {{ .Release.Namespace }}
 ---
 {{- if .Values.submariner.serviceDiscovery }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: {{ template "submariner.fullname" . }}:lighthouse
+  name: {{ template "submariner.fullname" . }}:lighthouse-agent
   labels:
     heritage: {{ .Release.Service | quote }}
     release: {{ .Release.Name | quote }}
     chart: {{ template "submariner.chart" . }}
     app: {{ template "submariner.name" . }}
 rules:
-  - apiGroups: [""]
+  - apiGroups:
-    resources: ["services", "namespaces", "configmaps", "endpoints"]
+      - ""
-    verbs: ["get", "list", "watch", "update"]
+    resources:
-  - apiGroups: ["discovery.k8s.io"]
+      - services
-    resources: ["endpointslices"]
+      - namespaces
-    verbs: ["create", "get", "list", "watch", "update", "delete"]
+      - endpoints
-  - apiGroups: ["lighthouse.submariner.io"]
+    verbs:
-    resources: ["*"]
+      - get
-    verbs: ["create", "get", "list", "watch", "update", "delete"]
+      - list
-  - apiGroups: ["submariner.io"]
+      - watch
-    resources: ["gateways"]
+      - update
-    verbs: ["get", "list", "watch"]
+  - apiGroups:
+      - discovery.k8s.io
+    resources:
+      - endpointslices
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - delete
+      - deletecollection
+  - apiGroups:
+      - submariner.io
+    resources:
+      - "gateways"
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - multicluster.x-k8s.io
+    resources:
+      - "*"
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - delete
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: {{ template "submariner.fullname" . }}:lighthouse
+  name: {{ template "submariner.fullname" . }}:lighthouse-agent
   labels:
     heritage: {{ .Release.Service | quote }}
     release: {{ .Release.Name | quote }}
@@ -309,10 +748,82 @@ metadata:
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: {{ template "submariner.fullname" . }}:lighthouse
+  name: {{ template "submariner.fullname" . }}:lighthouse-agent
 subjects:
   - kind: ServiceAccount
-    name: {{ template "submariner.operatorServiceAccountName" . }}
+    name: {{ template "submariner.lighthouseAgentServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "submariner.fullname" . }}:lighthouse-coredns
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - services
+      - namespaces
+      - endpoints
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - discovery.k8s.io
+    resources:
+      - endpointslices
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - delete
+      - deletecollection
+  - apiGroups:
+      - lighthouse.submariner.io
+    resources:
+      - "*"
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - delete
+  - apiGroups:
+      - submariner.io
+    resources:
+      - "gateways"
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - multicluster.x-k8s.io
+    resources:
+      - "*"
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - delete
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:lighthouse-coredns
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "submariner.fullname" . }}:lighthouse-coredns
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }}
     namespace: {{ .Release.Namespace }}
 {{- end -}}
 {{- end -}}

submariner-operator/templates/svc-acct.yaml

@@ -46,14 +46,26 @@ metadata:
     app: {{ template "submariner.name" . }}
 {{- end }}
 ---
-{{- if .Values.serviceAccounts.lighthouse.create }}
+{{- if .Values.serviceAccounts.lighthouseAgent.create }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ template "submariner.lighthouseServiceAccountName" . }}
+  name: {{ template "submariner.lighthouseAgentServiceAccountName" . }}
   labels:
     heritage: {{ .Release.Service | quote }}
     release: {{ .Release.Name | quote }}
     chart: {{ template "submariner.chart" . }}
     app: {{ template "submariner.name" . }}
 {{- end }}
+---
+  {{- if .Values.serviceAccounts.lighthouseCoreDns.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+  {{- end }}

submariner-operator/values.yaml

@@ -54,6 +54,9 @@ serviceAccounts:
   globalnet:
     create: true
     name: ""
-  lighthouse:
+  lighthouseAgent:
-    create: false
+    create: true
+    name: ""
+  lighthouseCoreDns:
+    create: true
     name: ""

submariner/templates/_helpers.tpl

@@ -36,7 +36,7 @@ Create the name of the submariner-engine service account to use
 */}}
 {{- define "submariner.engineServiceAccountName" -}}
 {{- if .Values.serviceAccounts.engine.create -}}
-    {{ default (printf "%s-engine" (include "submariner.fullname" .)) .Values.serviceAccounts.engine.name }}
+    {{ default "submariner-engine" .Values.serviceAccounts.engine.name }}
 {{- else -}}
     {{ default "default" .Values.serviceAccounts.engine.name }}
 {{- end -}}
@@ -47,7 +47,7 @@ Create the name of the submariner-route-agent service account to use
 */}}
 {{- define "submariner.routeAgentServiceAccountName" -}}
 {{- if .Values.serviceAccounts.routeAgent.create -}}
-    {{ default (printf "%s-routeagent" (include "submariner.fullname" .)) .Values.serviceAccounts.routeAgent.name }}
+    {{ default "submariner-routeagent" .Values.serviceAccounts.routeAgent.name }}
 {{- else -}}
     {{ default "default" .Values.serviceAccounts.routeAgent.name }}
 {{- end -}}
@@ -58,20 +58,31 @@ Create the name of the submariner-globalnet service account to use
 */}}
 {{- define "submariner.globalnetServiceAccountName" -}}
 {{- if .Values.serviceAccounts.globalnet.create -}}
-    {{ default (printf "%s-globalnet" (include "submariner.fullname" .)) .Values.serviceAccounts.globalnet.name }}
+    {{ default "submariner-globalnet" .Values.serviceAccounts.globalnet.name }}
 {{- else -}}
     {{ default "default" .Values.serviceAccounts.globalnet.name }}
 {{- end -}}
 {{- end -}}
 
 {{/*
-Create the name of the submariner-lighthouse service account to use
+Create the name of the submariner-lighthouse-agent service account to use
 */}}
-{{- define "submariner.lighthouseServiceAccountName" -}}
+{{- define "submariner.lighthouseAgentServiceAccountName" -}}
-{{- if .Values.submariner.serviceDiscovery -}}
+{{- if and (.Values.submariner.serviceDiscovery ) (.Values.serviceAccounts.lighthouseAgent.create) -}}
-    {{ default (printf "%s-lighthouse" (include "submariner.fullname" .)) .Values.serviceAccounts.lighthouse.name }}
+    {{ default "submariner-lighthouse-agent" .Values.serviceAccounts.lighthouseAgent.name }}
 {{- else -}}
-    {{ default "default" .Values.serviceAccounts.lighthouse.name }}
+    {{ default "default" .Values.serviceAccounts.lighthouseAgent.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create the name of the submariner-lighthouse-coredns service account to use
+*/}}
+{{- define "submariner.lighthouseCoreDnsServiceAccountName" -}}
+{{- if and (.Values.submariner.serviceDiscovery ) (.Values.serviceAccounts.lighthouseCoreDns.create) -}}
+    {{ default "submariner-lighthouse-coredns" .Values.serviceAccounts.lighthouseCoreDns.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccounts.lighthouseCoreDns.name }}
 {{- end -}}
 {{- end -}}
 

submariner/templates/lighthouse-coredns.yaml

@@ -30,7 +30,7 @@ spec:
             - mountPath: /etc/coredns
               name: config-volume
               readOnly: true
-      serviceAccountName: {{ template "submariner.lighthouseServiceAccountName" . }}
+      serviceAccountName: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }}
       volumes:
         - configMap:
             defaultMode: 420

submariner/templates/lighthouse.yaml

@@ -19,7 +19,7 @@ spec:
       labels:
         app: {{ template "submariner.fullname" . }}-lighthouse-agent
     spec:
-      serviceAccountName: {{ template "submariner.lighthouseServiceAccountName" . }}
+      serviceAccountName: {{ template "submariner.lighthouseAgentServiceAccountName" . }}
       containers:
       - command:
         - lighthouse-agent.sh

submariner/templates/rbac.yaml

@@ -9,15 +9,93 @@ metadata:
     chart: {{ template "submariner.chart" . }}
     app: {{ template "submariner.name" . }}
 rules:
-- apiGroups: [""]
+  - apiGroups:
-  resources: ["configmaps"]
+      - ""
-  verbs: ["create", "get", "list", "watch", "patch", "update"]
+    resources:
-- apiGroups: ["submariner.io"]
+      - pods
-  resources: ["clusters", "endpoints", "gateways"]
+      - services
-  verbs: ["create", "get", "list", "watch", "patch", "update", "delete"]
+      - services/finalizers
-- apiGroups: [""]
+      - endpoints
-  resources: ["events"]
+      - persistentvolumeclaims
-  verbs: ["create", "patch"]
+      - events
+      - configmaps
+      - secrets
+    verbs:
+      - '*'
+  - apiGroups:
+      - apps
+    resources:
+      - deployments
+      - daemonsets
+      - replicasets
+      - statefulsets
+    verbs:
+      - '*'
+  - apiGroups:
+      - monitoring.coreos.com
+    resources:
+      - servicemonitors
+    verbs:
+      - get
+      - create
+  - apiGroups:
+      - apps
+    resourceNames:
+      - submariner-operator
+    resources:
+      - deployments/finalizers
+    verbs:
+      - update
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - get
+  - apiGroups:
+      - apps
+    resources:
+      - replicasets
+    verbs:
+      - get
+  - apiGroups:
+      - submariner.io
+    resources:
+      - '*'
+      - servicediscoveries
+    verbs:
+      - '*'
+  - apiGroups:
+      - lighthouse.submariner.io
+    resources:
+      - '*'
+      - serviceexports
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:engine
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "submariner.fullname" . }}:engine
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "submariner.engineServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
@@ -29,52 +107,353 @@ metadata:
     chart: {{ template "submariner.chart" . }}
     app: {{ template "submariner.name" . }}
 rules:
-- apiGroups: ["submariner.io"]
+  - apiGroups:
-  resources: ["clusters", "endpoints", "gateways"]
+      - ""
-  verbs: ["create", "get", "list", "watch", "patch", "update"]
+    resources:
-- apiGroups: [""]
+      - pods
-  resources: ["pods"]
+      - services
-  verbs: ["get", "watch", "list"]
+      - services/finalizers
----
+      - endpoints
-apiVersion: rbac.authorization.k8s.io/v1
+      - persistentvolumeclaims
-kind: RoleBinding
+      - events
-metadata:
+      - configmaps
-  name: {{ template "submariner.fullname" . }}:engine
+      - secrets
-roleRef:
+    verbs:
-  apiGroup: rbac.authorization.k8s.io
+      - '*'
-  kind: Role
+  - apiGroups:
-  name: {{ template "submariner.fullname" . }}:engine
+      - apps
-subjects:
+    resources:
-- kind: ServiceAccount
+      - deployments
-  name: {{ template "submariner.engineServiceAccountName" . }}
+      - daemonsets
-  namespace: {{ .Release.Namespace }}
+      - replicasets
+      - statefulsets
+    verbs:
+      - '*'
+  - apiGroups:
+      - monitoring.coreos.com
+    resources:
+      - servicemonitors
+    verbs:
+      - get
+      - create
+  - apiGroups:
+      - apps
+    resourceNames:
+      - submariner-operator
+    resources:
+      - deployments/finalizers
+    verbs:
+      - update
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - get
+  - apiGroups:
+      - apps
+    resources:
+      - replicasets
+    verbs:
+      - get
+  - apiGroups:
+      - submariner.io
+    resources:
+      - '*'
+      - servicediscoveries
+    verbs:
+      - '*'
+  - apiGroups:
+      - lighthouse.submariner.io
+    resources:
+      - '*'
+      - serviceexports
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   name: {{ template "submariner.fullname" . }}:routeagent
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
   name: {{ template "submariner.fullname" . }}:routeagent
 subjects:
-- kind: ServiceAccount
+  - kind: ServiceAccount
-  name: {{ template "submariner.routeAgentServiceAccountName" . }}
+    name: {{ template "submariner.routeAgentServiceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
+    namespace: {{ .Release.Namespace }}
+---
+{{- if ne .Values.submariner.globalCidr "" }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ template "submariner.fullname" . }}:globalnet
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+      - services
+      - services/finalizers
+      - endpoints
+      - persistentvolumeclaims
+      - events
+      - configmaps
+      - secrets
+    verbs:
+      - '*'
+  - apiGroups:
+      - apps
+    resources:
+      - deployments
+      - daemonsets
+      - replicasets
+      - statefulsets
+    verbs:
+      - '*'
+  - apiGroups:
+      - monitoring.coreos.com
+    resources:
+      - servicemonitors
+    verbs:
+      - get
+      - create
+  - apiGroups:
+      - apps
+    resourceNames:
+      - submariner-operator
+    resources:
+      - deployments/finalizers
+    verbs:
+      - update
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - get
+  - apiGroups:
+      - apps
+    resources:
+      - replicasets
+    verbs:
+      - get
+  - apiGroups:
+      - submariner.io
+    resources:
+      - '*'
+      - servicediscoveries
+    verbs:
+      - '*'
+  - apiGroups:
+      - lighthouse.submariner.io
+    resources:
+      - '*'
+      - serviceexports
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:globalnet
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "submariner.fullname" . }}:globalnet
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "submariner.globalnetServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+---
+{{- end -}}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "submariner.fullname" . }}:engine
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions
+    verbs:
+      - get
+      - list
+      - create
+      - update
+      - delete
+  - apiGroups:  # pods and services are looked up to figure out network settings
+      - ""
+    resources:
+      - pods
+      - services
+      - nodes
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - operator.openshift.io
+    resources:
+      - dnses
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - config.openshift.io
+    resources:
+      - networks
+    verbs:
+      - get
+      - list
+  - apiGroups:
+      - submariner.io
+    resources:
+      - endpoints
+      - gateways
+      - clusters
+    verbs:
+      - get
+      - list
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:engine
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "submariner.fullname" . }}:engine
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "submariner.engineServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: {{ template "submariner.fullname" . }}:routeagent
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
 rules:
-  - apiGroups: [""]
+  - apiGroups:
-    resources: ["nodes"]
+      - ""
-    verbs: ["get", "list", "watch", "update"]
+    resources:
+      - configmaps
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions
+    verbs:
+      - get
+      - list
+      - create
+      - update
+      - delete
+  - apiGroups:  # pods and services are looked up to figure out network settings
+      - ""
+    resources:
+      - pods
+      - services
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - operator.openshift.io
+    resources:
+      - dnses
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - config.openshift.io
+    resources:
+      - networks
+    verbs:
+      - get
+      - list
+  - apiGroups:
+      - ""
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+    resources:
+      - nodes
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: {{ template "submariner.fullname" . }}:routeagent
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -89,85 +468,203 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: {{ template "submariner.fullname" . }}:globalnet
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
 rules:
-- apiGroups: [""]
+  - apiGroups:
-  resources: ["services", "namespaces", "pods", "nodes"]
+      - ""
-  verbs: ["get", "list", "watch", "update"]
+    resources:
-- apiGroups: ["submariner.io"]
+      - pods
-  resources: ["clusters", "endpoints", "gateways"]
+      - services
-  verbs: ["get", "list", "watch"]
+      - namespaces
+      - nodes
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - submariner.io
+    resources:
+      - endpoints
+      - clusters
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - multicluster.x-k8s.io
+    resources:
+      - "serviceexports"
+    verbs:
+      - get
+      - list
+      - watch
 ---
+{{- end -}}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: {{ template "submariner.fullname" . }}:globalnet
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
   name: {{ template "submariner.fullname" . }}:globalnet
 subjects:
-- kind: ServiceAccount
+  - kind: ServiceAccount
-  name: {{ template "submariner.globalnetServiceAccountName" . }}
+    name: {{ template "submariner.globalnetServiceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
+    namespace: {{ .Release.Namespace }}
 ---
-{{- end -}}
-{{- if ne .Values.submariner.globalCidr "" }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ template "submariner.fullname" . }}:engine
-rules:
-- apiGroups: [""]
-  resources: ["nodes"]
-  verbs: ["get", "list", "watch"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ template "submariner.fullname" . }}:engine
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ template "submariner.fullname" . }}:engine
-subjects:
-- kind: ServiceAccount
-  name: {{ template "submariner.engineServiceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
----
-{{- end -}}
 {{- if .Values.submariner.serviceDiscovery }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: {{ template "submariner.fullname" . }}:lighthouse
+  name: {{ template "submariner.fullname" . }}:lighthouse-agent
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
 rules:
-  - apiGroups: [""]
+  - apiGroups:
-    resources: ["services", "namespaces", "configmaps", "endpoints"]
+      - ""
-    verbs: ["get", "list", "watch", "update"]
+    resources:
-  - apiGroups: ["discovery.k8s.io"]
+      - services
-    resources: ["endpointslices"]
+      - namespaces
-    verbs: ["create", "get", "list", "watch", "update", "delete", "deletecollection"]
+      - endpoints
-  - apiGroups: ["lighthouse.submariner.io"]
+    verbs:
-    resources: ["*"]
+      - get
-    verbs: ["create", "get", "list", "watch", "update", "delete"]
+      - list
-  - apiGroups: ["submariner.io"]
+      - watch
-    resources: ["gateways"]
+      - update
-    verbs: ["get", "list", "watch"]
+  - apiGroups:
-  - apiGroups: ["multicluster.x-k8s.io"]
+      - discovery.k8s.io
-    resources: ["*"]
+    resources:
-    verbs: ["create", "get", "list", "watch", "update", "delete"]
+      - endpointslices
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - delete
+      - deletecollection
+  - apiGroups:
+      - submariner.io
+    resources:
+      - "gateways"
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - multicluster.x-k8s.io
+    resources:
+      - "*"
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - delete
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: {{ template "submariner.fullname" . }}:lighthouse
+  name: {{ template "submariner.fullname" . }}:lighthouse-agent
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: {{ template "submariner.fullname" . }}:lighthouse
+  name: {{ template "submariner.fullname" . }}:lighthouse-agent
 subjects:
   - kind: ServiceAccount
-    name: {{ template "submariner.lighthouseServiceAccountName" . }}
+    name: {{ template "submariner.lighthouseAgentServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "submariner.fullname" . }}:lighthouse-coredns
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - services
+      - namespaces
+      - endpoints
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - discovery.k8s.io
+    resources:
+      - endpointslices
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - delete
+      - deletecollection
+  - apiGroups:
+      - lighthouse.submariner.io
+    resources:
+      - "*"
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - delete
+  - apiGroups:
+      - submariner.io
+    resources:
+      - "gateways"
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - multicluster.x-k8s.io
+    resources:
+      - "*"
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - delete
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:lighthouse-coredns
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "submariner.fullname" . }}:lighthouse-coredns
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }}
     namespace: {{ .Release.Namespace }}
 {{- end -}}
 {{- end -}}

submariner/templates/svc-acct.yaml

@@ -34,14 +34,26 @@ metadata:
     app: {{ template "submariner.name" . }}
 {{- end }}
 ---
-{{- if .Values.serviceAccounts.lighthouse.create }}
+{{- if .Values.serviceAccounts.lighthouseAgent.create }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ template "submariner.lighthouseServiceAccountName" . }}
+  name: {{ template "submariner.lighthouseAgentServiceAccountName" . }}
   labels:
     heritage: {{ .Release.Service | quote }}
     release: {{ .Release.Name | quote }}
     chart: {{ template "submariner.chart" . }}
     app: {{ template "submariner.name" . }}
 {{- end }}
+---
+{{- if .Values.serviceAccounts.lighthouseCoreDns.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+  {{- end }}

submariner/values.yaml

@@ -72,8 +72,11 @@ serviceAccounts:
     create: true
     name: ""
   globalnet:
-    create: false
+    create: true
     name: ""
-  lighthouse:
+  lighthouseAgent:
-    create: false
+    create: true
+    name: ""
+  lighthouseCoreDns:
+    create: true
     name: ""