Update Submariner dependencies to v0.19.0-m2

Signed-off-by: Automated Release <release@submariner.io>
Bump actions/setup-python in the github-actions group
2026-09-21 18:30:34 +00:00 · 2024-08-16 19:03:54 +03:00 · 2024-07-22 17:31:53 +02:00 · 2024-07-22 18:00:24 +03:00 · 2024-07-22 18:00:24 +03:00 · 2024-06-20 08:19:59 -04:00
14 changed files with 302 additions and 478 deletions
@@ -5,18 +5,52 @@ updates:
    directory: '/'
    schedule:
      interval: monthly
-  - package-ecosystem: github-actions
+    groups:
-    directory: '/'
+      github-actions:
-    target-branch: "release-0.12"
+        patterns:
-    schedule:
+          - "*"
      interval: monthly
  - package-ecosystem: github-actions
    directory: '/'
    target-branch: "release-0.13"
    schedule:
      interval: monthly
  - package-ecosystem: github-actions
    directory: '/'
    target-branch: "release-0.14"
    schedule:
      interval: monthly
    groups:
      github-actions:
        patterns:
          - "*"
  - package-ecosystem: github-actions
    directory: '/'
    target-branch: "release-0.15"
    schedule:
      interval: monthly
    groups:
      github-actions:
        patterns:
          - "*"
  - package-ecosystem: github-actions
    directory: '/'
    target-branch: "release-0.16"
    schedule:
      interval: monthly
    groups:
      github-actions:
        patterns:
          - "*"
  - package-ecosystem: github-actions
    directory: '/'
    target-branch: "release-0.17"
    schedule:
      interval: monthly
    groups:
      github-actions:
        patterns:
          - "*"
  - package-ecosystem: github-actions
    directory: '/'
    target-branch: "release-0.18"
    schedule:
      interval: monthly
    groups:
      github-actions:
        patterns:
          - "*"
@@ -1,57 +0,0 @@
 ---
 # Configuration for probot-stale - https://github.com/probot/stale
 # Number of days of inactivity before an Issue becomes stale (pull request is overridden later)
 daysUntilStale: 120
 # Number of days of inactivity before an Issue or Pull Request with the stale label is closed.
 # Set to false to disable. If disabled, issues still need to be closed manually, but will remain marked as stale.
 daysUntilClose: 7
 # Only issues or pull requests with all of these labels are check if stale. Defaults to `[]` (disabled)
 onlyLabels: []
 # Issues or Pull Requests with these labels will never be considered stale. Set to `[]` to disable
 exemptLabels:
  - security
  - confirmed
 # Set to true to ignore issues in a project (defaults to false)
 exemptProjects: false
 # Set to true to ignore issues in a milestone (defaults to false)
 exemptMilestones: false
 # Set to true to ignore issues with an assignee (defaults to false)
 exemptAssignees: false
 # Label to use when marking as stale
 staleLabel: wontfix
 # Comment to post when marking as stale. Set to `false` to disable
 markComment: >
  This issue has been automatically marked as stale because it has not had
  activity for 60 days. It will be closed if no further activity occurs.
  Please make a comment if this issue/pr is still valid. Thank you
  for your contributions.
 # Comment to post when removing the stale label.
 # unmarkComment: >
 #   Your comment here.
 # Comment to post when closing a stale Issue or Pull Request.
 # closeComment: >
 #   Your comment here.
 # Limit the number of actions per hour, from 1-30. Default is 30
 limitPerRun: 30
 # Limit to only `issues` or `pulls`
 # only: issues
 pulls:
  daysUntilStale: 30
  markComment: >
    This pull request has been automatically marked as stale because it has not had
    recent activity. It will be closed if no further activity occurs. Thank you
    for your contributions.
@@ -18,15 +18,15 @@ jobs:
      matrix:
        cable_driver: ['libreswan', 'wireguard', 'vxlan']
        globalnet: ['', 'globalnet']
-        k8s_version: ['1.25']
+        # Run most tests against the latest K8s version
        k8s_version: ['1.29']
        lighthouse: ['', 'lighthouse']
        include:
-          - k8s_version: '1.22'
+          # Bottom of supported K8s version range
-          - k8s_version: '1.23'
+          - k8s_version: '1.26'
          - k8s_version: '1.24'
    steps:
      - name: Check out the repository
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
      - name: Run E2E deployment and tests
        uses: submariner-io/shipyard/gh-actions/e2e@devel
@@ -13,7 +13,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repository
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
      - name: Run E2E deployment and tests
        uses: submariner-io/shipyard/gh-actions/e2e@devel
@@ -21,7 +21,7 @@ jobs:
        lighthouse: ['', 'lighthouse']
    steps:
      - name: Check out the repository
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
      - name: Run E2E deployment and tests
        uses: submariner-io/shipyard/gh-actions/e2e@devel
@@ -13,12 +13,12 @@ jobs:
    steps:
      - name: Get PR commits
        id: 'get-pr-commits'
-        uses: tim-actions/get-pr-commits@8673d84c368f480628607dbe21c88545811ef23a
+        uses: tim-actions/get-pr-commits@198af03565609bb4ed924d1260247b4881f09e7d
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
      - name: 'Verify no "Apply suggestions from code review" commits'
-        uses: tim-actions/commit-message-checker-with-regex@e16b08b1a7f5cafeb1f8167de05bf1d40239eb5d
+        uses: tim-actions/commit-message-checker-with-regex@094fc16ff83d04e2ec73edb5eaf6aa267db33791
        with:
          commits: ${{ steps.get-pr-commits.outputs.commits }}
          pattern: '^(?!.*(apply suggestions from code review))'
@@ -26,7 +26,7 @@ jobs:
          error: 'Commits addressing code review feedback should typically be squashed into the commits under review'
      - name: 'Verify no "fixup!" commits'
-        uses: tim-actions/commit-message-checker-with-regex@e16b08b1a7f5cafeb1f8167de05bf1d40239eb5d
+        uses: tim-actions/commit-message-checker-with-regex@094fc16ff83d04e2ec73edb5eaf6aa267db33791
        with:
          commits: ${{ steps.get-pr-commits.outputs.commits }}
          pattern: '^(?!fixup!)'
@@ -38,20 +38,20 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repository
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
      - name: Set up Helm
-        uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78
+        uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814
        with:
          version: v3.6.0
      - name: Set up Python
-        uses: actions/setup-python@d27e3f3d7c64b4bbf8e4abfb9b63b83e846e0435
+        uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f
        with:
          python-version: '3.x'
      - name: Set up helm/chart-testing
-        uses: helm/chart-testing-action@afea100a513515fbd68b0e72a7bb0ae34cb62aec
+        uses: helm/chart-testing-action@e6669bcd63d7cb57cb4380c33043eebe5d111992
      - name: Set up local helm repo
        run: make local-helm-repo
@@ -64,7 +64,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repository
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
        with:
          fetch-depth: 0
      - name: Run gitlint
@@ -75,7 +75,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repository
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
      - name: Run helm-docs and verify docs are up-to-date
        run: make helm-docs
@@ -85,10 +85,10 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repository
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
      - name: Run markdown-link-check
-        uses: gaurav-nelson/github-action-markdown-link-check@3faccbcf285e2c0424212c17908f8adcfbd0c2ad
+        uses: gaurav-nelson/github-action-markdown-link-check@d53a906aa6b22b8979d33bc86170567e619495ec
        with:
          config-file: ".markdownlinkcheck.json"
          check-modified-files-only: "yes"
@@ -99,7 +99,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repository
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
      - name: Run markdownlint
        run: make markdownlint
@@ -108,6 +108,6 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repository
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
      - name: Run yamllint
        run: make yamllint
@@ -16,16 +16,16 @@ jobs:
      issues: write
    steps:
      - name: Check out the repository
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
      - name: Run markdown-link-check
-        uses: gaurav-nelson/github-action-markdown-link-check@3faccbcf285e2c0424212c17908f8adcfbd0c2ad
+        uses: gaurav-nelson/github-action-markdown-link-check@d53a906aa6b22b8979d33bc86170567e619495ec
        with:
          config-file: ".markdownlinkcheck.json"
      - name: Raise an Issue to report broken links
        if: ${{ failure() }}
-        uses: peter-evans/create-issue-from-file@433e51abf769039ee20ba1293a088ca19d573b7f
+        uses: peter-evans/create-issue-from-file@24452a72d85239eacf1468b0f1982a9f3fec4c94
        with:
          title: Broken link detected by CI
          content-filepath: .github/ISSUE_TEMPLATE/broken-link.md
@@ -16,7 +16,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
        with:
          fetch-depth: 0
@@ -0,0 +1,32 @@
 ---
 name: Stale
 on:
  schedule:
    - cron: "0 0 * * *"
 permissions: {}
 jobs:
  stale:
    name: Close Stale Issues and PRs
    if: github.repository_owner == 'submariner-io'
    runs-on: ubuntu-latest
    permissions:
      issues: write
      pull-requests: write
    steps:
      - uses: actions/stale@3f3b0175e8c66fb49b9a6d5a0cd1f8436d4c3ab6
        with:
          days-before-issue-stale: 120
          days-before-pr-stale: 14
          exempt-issue-labels: 'confirmed,security'
          exempt-pr-labels: 'confirmed,security'
          stale-issue-label: 'stale'
          stale-issue-message: |
            This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further
            activity occurs. Thank you for your contributions.
          stale-pr-label: 'stale'
          stale-pr-message: |
            This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further
            activity occurs. Thank you for your contributions.
@@ -3,5 +3,6 @@
 .shflags
 *.tgz
 Makefile.dapper
 Makefile.shipyard
 Dockerfile.*
 helm_repo
@@ -1,3 +1,4 @@
 # Auto-generated, do not edit; see CODEOWNERS.in
-* @Oats87 @skitt @sridhargaddam @tpantelis
+* @Oats87 @skitt @sridhargaddam @tpantelis @vthapar
-*.md @dfarrell07 @Oats87 @skitt @sridhargaddam @tpantelis
+*.md @dfarrell07 @Oats87 @skitt @sridhargaddam @tpantelis @vthapar
 Makefile @aswinsuryan @dfarrell07 @maayanf24 @Oats87 @skitt @sridhargaddam @tpantelis @vthapar @yboaron
@@ -1,5 +1,9 @@
-@dfarrell07 *.md
+@aswinsuryan Makefile
@dfarrell07 *.md Makefile
@maayanf24 Makefile
@Oats87 *
@skitt *
@sridhargaddam *
@tpantelis *
@vthapar *
@yboaron Makefile
@@ -17,11 +17,9 @@ endif
 export DEPLOYTOOL = helm
 GH_URL=https://submariner-io.github.io/submariner-charts/charts
 CHARTS_DIR=charts
-CHARTS_VERSION=0.14.0
+CHARTS_VERSION=0.19.0-m2
 HELM_DOCS_VERSION=0.15.0
 REPO_URL=$(shell git config remote.origin.url)
 SUBCTL_VERSION=$(CHARTS_VERSION)
 export SUBCTL_VERSION
 # Targets to make
@@ -9,62 +9,84 @@ metadata:
    chart: {{ template "submariner.chart" . }}
    app: {{ template "submariner.name" . }}
 rules:
- apiGroups:
+  - apiGroups:
-  - ""
+      - ""
-  resources:
+    resources:
-  - pods
+      # For metrics
-  - services
+      - services
-  - services/finalizers
+    verbs:
-  - endpoints
+      - get
-  - persistentvolumeclaims
+      - create
-  - events
+      - update
-  - configmaps
+  - apiGroups:
-  - secrets
+      - ""
-  verbs:
+    resources:
-  - '*'
+      # Temporarily needed for network-plugin syncer removal
- apiGroups:
+      - serviceaccounts
-  - apps
+    resourceNames:
-  resources:
+      - submariner-networkplugin-syncer
-  - deployments
+    verbs:
-  - daemonsets
+      - delete
-  - replicasets
+  - apiGroups:
-  - statefulsets
+      - apps
-  verbs:
+    resources:
-  - '*'
+      - deployments
- apiGroups:
+      - daemonsets
-  - monitoring.coreos.com
+    verbs:
-  resources:
+      - create
-  - servicemonitors
+      - delete
-  verbs:
+      - get
-  - get
+      - list
-  - create
+      - patch
- apiGroups:
+      - update
-  - apps
+      - watch
-  resourceNames:
+  - apiGroups:
-  - {{ template "submariner.fullname" . }}
+      - monitoring.coreos.com
-  resources:
+    resources:
-  - deployments/finalizers
+      # Needed for openshift monitoring
-  verbs:
+      - servicemonitors
-  - update
+    verbs:
- apiGroups:
+      - get
-  - ""
+      - create
-  resources:
+  - apiGroups:
-  - pods
+      - apps
-  verbs:
+    resourceNames:
-  - get
+      - {{ template "submariner.fullname" . }}
- apiGroups:
+    resources:
-  - apps
+      - deployments/finalizers
-  resources:
+    verbs:
-  - replicasets
+      - update
-  verbs:
+  - apiGroups:
-  - get
+      - submariner.io
- apiGroups:
+    resources:
-  - submariner.io
+      - brokers
-  resources:
+      - brokers/status
-  - '*'
+      - submariners
-  - servicediscoveries
+      - submariners/status
-  verbs:
+      - servicediscoveries
-  - '*'
+      - servicediscoveries/status
    verbs:
      - get
      - list
      - watch
      - create
      - update
      - delete
  - apiGroups:
      - submariner.io
    resources:
      - gateways
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - submariner.io
    resources:
      - submariners/finalizers
      - servicediscoveries/finalizers
    verbs:
      - update
 ---
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
@@ -93,86 +115,38 @@ metadata:
    chart: {{ template "submariner.chart" . }}
    app: {{ template "submariner.name" . }}
 rules:
- apiGroups:
+  - apiGroups:
-    - ""
+      - ""
-  resources:
+    resources:
-    - pods
+      - pods
-    - services
+    verbs:
-    - services/finalizers
+      - get
-    - endpoints
+      - update
-    - persistentvolumeclaims
+      - patch
-    - events
+  - apiGroups:
-    - configmaps
+      - submariner.io
-    - secrets
+    resources:
-  verbs:
+      - clusters
-    - '*'
+      - endpoints
- apiGroups:
+      - gateways
-    - apps
+    verbs:
-  resources:
+      - get
-    - deployments
+      - list
-    - daemonsets
+      - watch
-    - replicasets
+      - create
-    - statefulsets
+      - update
-  verbs:
+      - delete
-    - '*'
+  - apiGroups:
- apiGroups:
+      - coordination.k8s.io
-    - monitoring.coreos.com
+    resources:
-  resources:
+      - leases
-    - servicemonitors
+    verbs:
-  verbs:
+      - get
-    - get
+      - list
-    - create
+      - watch
- apiGroups:
+      - create
-    - apps
+      - update
-  resourceNames:
+      - delete
    - submariner-operator
  resources:
    - deployments/finalizers
  verbs:
    - update
 - apiGroups:
    - ""
  resources:
    - pods
  verbs:
    - get
 - apiGroups:
    - apps
  resources:
    - replicasets
  verbs:
    - get
 - apiGroups:
    - submariner.io
  resources:
    - '*'
    - servicediscoveries
  verbs:
    - '*'
 - apiGroups:
    - lighthouse.submariner.io
  resources:
    - '*'
    - serviceexports
  verbs:
    - create
    - delete
    - get
    - list
    - patch
    - update
    - watch
 - apiGroups:
    - coordination.k8s.io
  resources:
    - leases
  verbs:
    - get
    - list
    - watch
    - create
    - update
    - delete
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -203,74 +177,25 @@ metadata:
    app: {{ template "submariner.name" . }}
 rules:
  - apiGroups:
-      - ""
+      - submariner.io
    resources:
      - pods
      - services
      - services/finalizers
      - endpoints
      - persistentvolumeclaims
      - events
      - configmaps
      - secrets
    verbs:
      - '*'
  - apiGroups:
      - apps
    resources:
      - deployments
      - daemonsets
      - replicasets
      - statefulsets
    verbs:
      - '*'
  - apiGroups:
      - monitoring.coreos.com
    resources:
      - servicemonitors
    verbs:
      - get
      - create
  - apiGroups:
      - apps
    resourceNames:
      - submariner-operator
    resources:
      - deployments/finalizers
    verbs:
      - update
  - apiGroups:
      - ""
    resources:
      - pods
    verbs:
      - get
  - apiGroups:
      - apps
    resources:
      - replicasets
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - submariner.io
    resources:
-      - '*'
+      - gatewayroutes
-      - servicediscoveries
+      - nongatewayroutes
    verbs:
      - '*'
  - apiGroups:
      - lighthouse.submariner.io
    resources:
      - '*'
      - serviceexports
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
      - create
      - update
      - delete
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -301,75 +226,26 @@ metadata:
    chart: {{ template "submariner.chart" . }}
    app: {{ template "submariner.name" . }}
 rules:
  - apiGroups:
      - ""
    resources:
      - pods
      - services
      - services/finalizers
      - endpoints
      - persistentvolumeclaims
      - events
      - configmaps
      - secrets
    verbs:
      - '*'
  - apiGroups:
      - apps
    resources:
      - deployments
      - daemonsets
      - replicasets
      - statefulsets
    verbs:
      - '*'
  - apiGroups:
      - monitoring.coreos.com
    resources:
      - servicemonitors
    verbs:
      - get
      - create
  - apiGroups:
      - apps
    resourceNames:
      - submariner-operator
    resources:
      - deployments/finalizers
    verbs:
      - update
  - apiGroups:
      - ""
    resources:
      - pods
    verbs:
      - get
  - apiGroups:
      - apps
    resources:
      - replicasets
    verbs:
      - get
  - apiGroups:
      - submariner.io
    resources:
-      - '*'
+      - gateways
      - servicediscoveries
    verbs:
      - '*'
  - apiGroups:
      - lighthouse.submariner.io
    resources:
      - '*'
      - serviceexports
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
      - update
  - apiGroups:
      - coordination.k8s.io
    resources:
      - leases
    verbs:
      - get
      - list
      - watch
      - create
      - update
      - delete
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -424,9 +300,10 @@ rules:
      - update
      - delete
      - watch
-  - apiGroups:  # pods, services and nodes are looked up to figure out network settings
+  - apiGroups:
      - ""
    resources:
      # Needed for network settings discovery
      - pods
      - services
      - nodes
@@ -440,27 +317,20 @@ rules:
      - dnses
    verbs:
      - get
      - list
      - watch
      - update
  - apiGroups:
      - config.openshift.io
    resources:
      # Needed for network settings discovery
      - networks
    resourceNames:
      - cluster
    verbs:
      - get
      - list
  - apiGroups:
      - ""
    resources:
      - namespaces
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - monitoring.coreos.com
    resources:
      # Needed for openshift monitoring
      - servicemonitors
    verbs:
      - get
@@ -468,11 +338,21 @@ rules:
  - apiGroups:
      - apps
    resources:
      # Needed for Flannel CNI discovery
      - daemonsets
    verbs:
      - get
      - list
-      - watch
+  - apiGroups:
      - rbac.authorization.k8s.io
    resources:
      # Temporarily needed for network-plugin syncer removal
      - clusterroles
      - clusterrolebindings
    resourceNames:
      - ocp-submariner-networkplugin-syncer
      - submariner-networkplugin-syncer
    verbs:
      - delete
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -531,21 +411,7 @@ rules:
      - configmaps
    verbs:
      - get
      - list
      - watch
      - create
      - update
  - apiGroups:
      - apiextensions.k8s.io
    resources:
      - customresourcedefinitions
    verbs:
      - get
      - list
      - create
      - update
      - delete
  - apiGroups:  # pods and services are looked up to figure out network settings
      - ""
    resources:
      - pods
@@ -555,32 +421,6 @@ rules:
      - get
      - list
      - watch
  - apiGroups:
      - operator.openshift.io
    resources:
      - dnses
    verbs:
      - get
      - list
      - watch
      - update
  - apiGroups:
      - config.openshift.io
    resources:
      - networks
    verbs:
      - get
      - list
  - apiGroups:
      - submariner.io
    resources:
      - endpoints
      - gateways
      - clusters
    verbs:
      - get
      - list
      - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -612,57 +452,41 @@ metadata:
 rules:
  - apiGroups:
      - ""
    resources:
      - configmaps
    verbs:
      - get
      - list
      - watch
      - update
  - apiGroups:
      - apiextensions.k8s.io
    resources:
      - customresourcedefinitions
    verbs:
      - get
      - list
      - create
      - update
      - delete
  - apiGroups:  # pods and services are looked up to figure out network settings
      - ""
    resources:
      - pods
      - services
      - secrets
      - configmaps
      - endpoints
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - operator.openshift.io
    resources:
      - dnses
    verbs:
      - get
      - list
      - watch
      - update
  - apiGroups:
      - config.openshift.io
    resources:
      - networks
    resourceNames:
      - cluster
    verbs:
      - get
      - list
  - apiGroups:
      - ""
    resources:
      - nodes
    verbs:
      - get
      - list
      - watch
-      - update
+  - apiGroups:
      - projectcalico.org
    resources:
-      - nodes
+      - ippools
    verbs:
      - get
      - create
      - delete
      - update
      - deletecollection
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -697,18 +521,15 @@ rules:
      - ""
    resources:
      - pods
      - namespaces
      - nodes
      - endpoints
    verbs:
      - get
      - list
      - watch
      - update
  - apiGroups:
      - ""
    resources:
      - services
      - endpoints
    verbs:
      - create
      - get
@@ -719,8 +540,8 @@ rules:
  - apiGroups:
      - submariner.io
    resources:
      - endpoints
      - clusters
      - endpoints
    verbs:
      - get
      - list
@@ -729,17 +550,11 @@ rules:
      - submariner.io
    resources:
      - clusterglobalegressips
      - clusterglobalegressips/status
      - globalegressips
-    verbs:
+      - globalegressips/status
      - create
      - get
      - list
      - watch
      - update
  - apiGroups:
      - submariner.io
    resources:
      - globalingressips
      - globalingressips/status
    verbs:
      - create
      - get
@@ -751,7 +566,7 @@ rules:
  - apiGroups:
      - multicluster.x-k8s.io
    resources:
-      - "serviceexports"
+      - serviceexports
    verbs:
      - get
      - list
@@ -806,7 +621,6 @@ rules:
      - get
      - list
      - watch
      - update
  - apiGroups:
      - discovery.k8s.io
    resources:
@@ -823,8 +637,8 @@ rules:
  - apiGroups:
      - submariner.io
    resources:
-      - "gateways"
+      - gateways
-      - "globalingressips"
+      - globalingressips
    verbs:
      - get
      - list
@@ -832,7 +646,8 @@ rules:
  - apiGroups:
      - multicluster.x-k8s.io
    resources:
-      - "*"
+      - serviceimports
      - serviceimports/status
    verbs:
      - create
      - get
@@ -840,6 +655,20 @@ rules:
      - watch
      - update
      - delete
  - apiGroups:
      - multicluster.x-k8s.io
    resources:
      - serviceexports
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - multicluster.x-k8s.io
    resources:
      - serviceexports/status
    verbs:
      - update
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -864,34 +693,19 @@ kind: ClusterRole
 metadata:
  name: {{ template "submariner.fullname" . }}:lighthouse-coredns
 rules:
  - apiGroups:
      - ""
    resources:
      - services
      - namespaces
      - endpoints
    verbs:
      - get
      - list
      - watch
      - update
  - apiGroups:
      - discovery.k8s.io
    resources:
      - endpointslices
    verbs:
      - create
      - get
      - list
      - watch
      - update
      - delete
      - deletecollection
  - apiGroups:
      - submariner.io
    resources:
-      - "gateways"
+      - gateways
-      - "submariners"
+      - submariners
    verbs:
      - get
      - list
@@ -899,14 +713,11 @@ rules:
  - apiGroups:
      - multicluster.x-k8s.io
    resources:
-      - "*"
+      - serviceimports
    verbs:
      - create
      - get
      - list
      - watch
      - update
      - delete
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding