Globalnet controller now uses internal services with external-ips
to support exported services. On OCP Clusters, we require an explicit
RBAC to create services with external-ips, this PR includes the
necessary RBAC for Globalnet pods.
Related to: https://github.com/submariner-io/submariner/issues/1166
Signed-Off-by: Sridhar Gaddam <sgaddam@redhat.com>
As part of Globalnet enhancement where kubeproxy dependency
is removed, the Globalnet Pod will now create internal
services for every exported service in the respective
namespace where the original service resides. This PR
adds the necessary clusterRole to allow Globalnet pod
to create/delete such internal services.
Related to: https://github.com/submariner-io/submariner/issues/1166
Signed-off-by: Sridhar Gaddam <sgaddam@redhat.com>
`lighthouse-agent` `ClusterRole` requires access to `globalingressips`
for Globalnetv2 in Lighthouse.
Signed-off-by: Vishal Thapar <5137689+vthapar@users.noreply.github.com>
Globalnetv2 requires `globalnet` `ClusterRole` for Egress/IngressIPs
but those were added as `globalnet` `Role` instead. This change
moves the permissions from `Role` to `ClusterRole`
Signed-off-by: Vishal Thapar <5137689+vthapar@users.noreply.github.com>
The submariner-operator Helm chart deploys Submariner using the
Submariner operator: it deploys the CRDs, roles, and SAs required to
run the operator and Submariner, then pushes a Submariner CR to
instruct the operator to deploy Submariner.
This patch also adds a Makefile to validate the deployments; run
make deploy
to test the Helm charts (this will bring up two clusters, install the
broker on one of them and the operator on both, and end with a
connectivity test).
Fixes: #17
Signed-off-by: Stephen Kitt <skitt@redhat.com>
