From ae121cfdc48cf0b84ea858a243508c0b60362ee9 Mon Sep 17 00:00:00 2001 From: Sridhar Gaddam Date: Fri, 10 Apr 2020 14:35:48 +0530 Subject: [PATCH] Add ClusterRole for route-agent to annotate a node As part of supporting connectivity from HostNetwork to remoteClusters, globalnet controller requires the CNIInterfaceIP on each node. This PR adds the necessary clusterRoles for the route-agent daemonSet which will annotate the node with the CNIInterfaceIP on that respective node. Signed-off-by: Sridhar Gaddam --- submariner/templates/rbac.yaml | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/submariner/templates/rbac.yaml b/submariner/templates/rbac.yaml index de2b6ec..0c2b068 100644 --- a/submariner/templates/rbac.yaml +++ b/submariner/templates/rbac.yaml @@ -62,6 +62,28 @@ subjects: name: {{ template "submariner.routeAgentServiceAccountName" . }} namespace: {{ .Release.Namespace }} --- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ template "submariner.fullname" . }}:routeagent +rules: + - apiGroups: [""] + resources: ["nodes"] + verbs: ["get", "update"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ template "submariner.fullname" . }}:routeagent +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "submariner.fullname" . }}:routeagent +subjects: + - kind: ServiceAccount + name: {{ template "submariner.routeAgentServiceAccountName" . }} + namespace: {{ .Release.Namespace }} +--- {{- if ne .Values.submariner.globalCidr "" }} apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole