From fb754f5f2f8835a3a838dc67b06579b970c6f2c6 Mon Sep 17 00:00:00 2001
From: Mike Kolesnik <mkolesni@redhat.com>
Date: Thu, 23 Jan 2020 14:36:26 +0200
Subject: [PATCH] Added the role & binding for globalnet

Signed-off-by: Mike Kolesnik <mkolesni@redhat.com>
---
 submariner/templates/rbac.yaml | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/submariner/templates/rbac.yaml b/submariner/templates/rbac.yaml
index e953321..2544989 100644
--- a/submariner/templates/rbac.yaml
+++ b/submariner/templates/rbac.yaml
@@ -61,4 +61,34 @@ subjects:
 - kind: ServiceAccount
   name: {{ template "submariner.routeAgentServiceAccountName" . }}
   namespace: {{ .Release.Namespace }}
+---
+{{- if ne .Values.submariner.globalCidr "" }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "submariner.fullname" . }}:globalnet
+rules:
+- apiGroups: [""]
+  resources: ["services", "namespaces", "pods"]
+  verbs: ["get", "list", "watch", "update"]
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["get"]
+- apiGroups: ["submariner.io"]
+  resources: ["endpoints"]
+  verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:globalnet
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "submariner.fullname" . }}:globalnet
+subjects:
+- kind: ServiceAccount
+  name: {{ template "submariner.globalnetServiceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+{{- end -}}
 {{- end -}}