From 83aeade0cc6d741e8bde3254aaec86774fc1ea80 Mon Sep 17 00:00:00 2001
From: Aswin Suryanarayanan <asuryana@redhat.com>
Date: Thu, 14 Jan 2021 15:03:21 +0530
Subject: [PATCH] Add a cluster role for submariner-engine serivce-account

The submainer-engine now access the node object as part
of golbalnet-healthcheck support and the required roles are
added

Signed-off-by: Aswin Surayanarayanan <asuryana@redhat.com>
---
 submariner/templates/rbac.yaml | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/submariner/templates/rbac.yaml b/submariner/templates/rbac.yaml
index cfacc0a..814f045 100644
--- a/submariner/templates/rbac.yaml
+++ b/submariner/templates/rbac.yaml
@@ -111,6 +111,30 @@ subjects:
   namespace: {{ .Release.Namespace }}
 ---
 {{- end -}}
+{{- if ne .Values.submariner.globalCidr "" }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "submariner.fullname" . }}:engine
+rules:
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:engine
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "submariner.fullname" . }}:engine
+subjects:
+- kind: ServiceAccount
+  name: {{ template "submariner.engineServiceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+---
+{{- end -}}
 {{- if .Values.submariner.serviceDiscovery }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole