Update Submariner dependencies to v0.17.0

Signed-off-by: Automated Release <release@submariner.io>

.github/dependabot.yml

@@ -11,7 +11,7 @@ updates:
           - "*"
   - package-ecosystem: github-actions
     directory: '/'
-    target-branch: "release-0.17"
+    target-branch: "release-0.14"
     schedule:
       interval: monthly
     groups:
@@ -20,7 +20,7 @@ updates:
           - "*"
   - package-ecosystem: github-actions
     directory: '/'
-    target-branch: "release-0.18"
+    target-branch: "release-0.15"
     schedule:
       interval: monthly
     groups:
@@ -29,34 +29,7 @@ updates:
           - "*"
   - package-ecosystem: github-actions
     directory: '/'
-    target-branch: "release-0.19"
+    target-branch: "release-0.16"
-    schedule:
-      interval: monthly
-    groups:
-      github-actions:
-        patterns:
-          - "*"
-  - package-ecosystem: github-actions
-    directory: '/'
-    target-branch: "release-0.20"
-    schedule:
-      interval: monthly
-    groups:
-      github-actions:
-        patterns:
-          - "*"
-  - package-ecosystem: github-actions
-    directory: '/'
-    target-branch: "release-0.21"
-    schedule:
-      interval: monthly
-    groups:
-      github-actions:
-        patterns:
-          - "*"
-  - package-ecosystem: github-actions
-    directory: '/'
-    target-branch: "release-0.22"
     schedule:
       interval: monthly
     groups:

.github/workflows/branch.yml

@@ -11,6 +11,6 @@ jobs:
     name: PR targets branch
     runs-on: ubuntu-latest
     steps:
-      - name: Check that the PR targets release-0.23
+      - name: Check that the PR targets release-0.17
-        if: ${{ github.base_ref != 'release-0.23' }}
+        if: ${{ github.base_ref != 'release-0.17' }}
         run: exit 1

.github/workflows/e2e-full.yml

@@ -19,21 +19,21 @@ jobs:
         cable_driver: ['libreswan', 'wireguard', 'vxlan']
         globalnet: ['', 'globalnet']
         # Run most tests against the latest K8s version
-        k8s_version: ['k8s-latest']
+        k8s_version: ['1.28']
         lighthouse: ['', 'lighthouse']
         include:
           # Bottom of supported K8s version range
-          - k8s_version: 'k8s-oldest-supported'
+          - k8s_version: '1.26'
     steps:
       - name: Check out the repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
 
       - name: Run E2E deployment and tests
-        uses: submariner-io/shipyard/gh-actions/e2e@release-0.23
+        uses: submariner-io/shipyard/gh-actions/e2e@release-0.17
         with:
           k8s_version: ${{ matrix.k8s_version }}
           using: ${{ matrix.cable_driver }} ${{ matrix.globalnet }} ${{ matrix.lighthouse }}
 
       - name: Post mortem
         if: failure()
-        uses: submariner-io/shipyard/gh-actions/post-mortem@release-0.23
+        uses: submariner-io/shipyard/gh-actions/post-mortem@release-0.17

.github/workflows/e2e.yml

@@ -13,11 +13,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
 
       - name: Run E2E deployment and tests
-        uses: submariner-io/shipyard/gh-actions/e2e@release-0.23
+        uses: submariner-io/shipyard/gh-actions/e2e@release-0.17
 
       - name: Post mortem
         if: failure()
-        uses: submariner-io/shipyard/gh-actions/post-mortem@release-0.23
+        uses: submariner-io/shipyard/gh-actions/post-mortem@release-0.17

.github/workflows/flake_finder.yml

@@ -21,13 +21,13 @@ jobs:
         lighthouse: ['', 'lighthouse']
     steps:
       - name: Check out the repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
 
       - name: Run E2E deployment and tests
-        uses: submariner-io/shipyard/gh-actions/e2e@release-0.23
+        uses: submariner-io/shipyard/gh-actions/e2e@release-0.17
         with:
           using: ${{ matrix.cable_driver }} ${{ matrix.globalnet }} ${{ matrix.lighthouse }}
 
       - name: Post mortem
         if: failure()
-        uses: submariner-io/shipyard/gh-actions/post-mortem@release-0.23
+        uses: submariner-io/shipyard/gh-actions/post-mortem@release-0.17

.github/workflows/linting.yml

@@ -13,7 +13,7 @@ jobs:
     steps:
       - name: Get PR commits
         id: 'get-pr-commits'
-        uses: tim-actions/get-pr-commits@198af03565609bb4ed924d1260247b4881f09e7d
+        uses: tim-actions/get-pr-commits@3efc1387ead42029a0d488ab98f24b7452dc3cde
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
@@ -38,20 +38,20 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
 
       - name: Set up Helm
-        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310
+        uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78
         with:
           version: v3.6.0
 
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
+        uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c
         with:
-          python-version: '3.13.x'
+          python-version: '3.x'
 
       - name: Set up helm/chart-testing
-        uses: helm/chart-testing-action@6ec842c01de15ebb84c8627d2744a0c2f2755c9f
+        uses: helm/chart-testing-action@e6669bcd63d7cb57cb4380c33043eebe5d111992
 
       - name: Set up local helm repo
         run: make local-helm-repo
@@ -64,7 +64,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
         with:
           fetch-depth: 0
       - name: Run gitlint
@@ -75,7 +75,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
 
       - name: Run helm-docs and verify docs are up-to-date
         run: make helm-docs
@@ -85,10 +85,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
 
       - name: Run markdown-link-check
-        uses: gaurav-nelson/github-action-markdown-link-check@3c3b66f1f7d0900e37b71eca45b63ea9eedfce31
+        uses: gaurav-nelson/github-action-markdown-link-check@d53a906aa6b22b8979d33bc86170567e619495ec
         with:
           config-file: ".markdownlinkcheck.json"
           check-modified-files-only: "yes"
@@ -99,7 +99,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       - name: Run markdownlint
         run: make markdownlint
 
@@ -108,6 +108,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
       - name: Run yamllint
         run: make yamllint

.github/workflows/periodic.yml

@@ -16,16 +16,16 @@ jobs:
       issues: write
     steps:
       - name: Check out the repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
 
       - name: Run markdown-link-check
-        uses: gaurav-nelson/github-action-markdown-link-check@3c3b66f1f7d0900e37b71eca45b63ea9eedfce31
+        uses: gaurav-nelson/github-action-markdown-link-check@d53a906aa6b22b8979d33bc86170567e619495ec
         with:
           config-file: ".markdownlinkcheck.json"
 
       - name: Raise an Issue to report broken links
         if: ${{ failure() }}
-        uses: peter-evans/create-issue-from-file@fca9117c27cdc29c6c4db3b86c48e4115a786710
+        uses: peter-evans/create-issue-from-file@433e51abf769039ee20ba1293a088ca19d573b7f
         with:
           title: Broken link detected by CI
           content-filepath: .github/ISSUE_TEMPLATE/broken-link.md

.github/workflows/release.yml

@@ -4,7 +4,7 @@ name: Release Charts
 on:
   push:
     branches:
-      - release-0.23
+      - release-0.17
 
 permissions:
   contents: write
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
         with:
           fetch-depth: 0
 

.github/workflows/stale.yml

@@ -16,7 +16,7 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93
+      - uses: actions/stale@3f3b0175e8c66fb49b9a6d5a0cd1f8436d4c3ab6
         with:
           days-before-issue-stale: 120
           days-before-pr-stale: 14

.gitignore

@@ -3,13 +3,5 @@
 .shflags
 *.tgz
 Makefile.dapper
-Makefile.shipyard
 Dockerfile.*
 helm_repo
-yamls/go.mod
-yamls/go.sum
-yamls/vendor
-submariner-k8s-broker/crds/crd.yaml
-submariner-k8s-broker/templates/_role.tpl
-submariner-operator/crds/crd.yaml
-submariner-operator/templates/*-rbac.yaml

Makefile

@@ -1,4 +1,4 @@
-BASE_BRANCH ?= release-0.23
+BASE_BRANCH ?= release-0.17
 export BASE_BRANCH
 export HELM_REPO_LOCATION=./helm_repo
 
@@ -17,7 +17,7 @@ endif
 export DEPLOYTOOL = helm
 GH_URL=https://submariner-io.github.io/submariner-charts/charts
 CHARTS_DIR=charts
-CHARTS_VERSION=0.23.2
+CHARTS_VERSION=0.17.0
 HELM_DOCS_VERSION=0.15.0
 REPO_URL=$(shell git config remote.origin.url)
 
@@ -34,10 +34,7 @@ local-helm-repo: $(CHART_PACKAGES)
 e2e: local-helm-repo
 	$(SCRIPTS_DIR)/e2e.sh
 
-generate-yamls:
+%.tgz:
-	./generate-yamls.sh $(BASE_BRANCH)
-
-%.tgz: generate-yamls
 	helm dep update $(subst -$(CHARTS_VERSION),,$(basename $(@F)))
 	helm package --version $(CHARTS_VERSION) --app-version $(CHARTS_VERSION) $(subst -$(CHARTS_VERSION),,$(basename $(@F)))
 

generate-yamls.sh

@@ -1,107 +0,0 @@
-#!/bin/bash
-
-set -e
-
-BROKER_ROLE_TPL=submariner-k8s-broker/templates/_role.tpl
-OPERATOR_RBAC_YAML=submariner-operator/templates/operator-rbac.yaml
-GATEWAY_RBAC_YAML=submariner-operator/templates/gateway-rbac.yaml
-ROUTE_AGENT_RBAC_YAML=submariner-operator/templates/routeagent-rbac.yaml
-GLOBALNET_RBAC_YAML=submariner-operator/templates/globalnet-rbac.yaml
-SERVICE_DISC_RBAC_YAML=submariner-operator/templates/service-discovery-rbac.yaml
-OPENSHIFT_MONITORING_YAML=submariner-operator/templates/openshift-monitoring-rbac.yaml
-
-YAMLS_BASE=yamls/vendor
-SUBM_CRDS=${YAMLS_BASE}/github.com/submariner-io/submariner/deploy/crds
-OPERATOR_CRDS=${YAMLS_BASE}/github.com/submariner-io/submariner-operator/deploy/crds
-MCS_CRDS=${YAMLS_BASE}/sigs.k8s.io/mcs-api/config/crd
-BROKER=${YAMLS_BASE}/github.com/submariner-io/submariner-operator/config/broker/broker-client
-RBAC_BASE=${YAMLS_BASE}/github.com/submariner-io/submariner-operator/config/rbac
-OPENSHIFT=${YAMLS_BASE}/github.com/submariner-io/submariner-operator/config/openshift
-
-function add_service_acct_ns() {
-    sed -i '/- kind: ServiceAccount/a \ \ \ \ namespace: {{ .Release.Namespace }}' $1
-}
-
-cd yamls
-rm go.mod || true
-go mod init
-go get github.com/submariner-io/submariner-operator@$1
-go mod tidy
-go mod vendor
-cd ..
-
-# Generate the CRDs for the broker chart
-mkdir -p submariner-k8s-broker/crds
-cat ${SUBM_CRDS}/submariner.io_endpoints.yaml \
-	  ${SUBM_CRDS}/submariner.io_clusters.yaml \
-		${SUBM_CRDS}/submariner.io_gateways.yaml > submariner-k8s-broker/crds/crd.yaml
-echo '---' >> submariner-k8s-broker/crds/crd.yaml
-cat ${MCS_CRDS}/multicluster.x-k8s.io_serviceexports.yaml >> submariner-k8s-broker/crds/crd.yaml
-echo '---' >> submariner-k8s-broker/crds/crd.yaml
-cat ${MCS_CRDS}/multicluster.x-k8s.io_serviceimports.yaml >> submariner-k8s-broker/crds/crd.yaml
-
-# Generate the client role yaml for the broker chart
-echo '{{- define "broker-role" -}}' > ${BROKER_ROLE_TPL}
-cat ${BROKER}/role.yaml >> ${BROKER_ROLE_TPL}
-echo '{{- end -}}' >> ${BROKER_ROLE_TPL}
-sed -i -e 's/name:.*/name: {{ template "submariner-k8s-broker.fullname" \. }}-cluster/' ${BROKER_ROLE_TPL}
-
-# Generate the CRDs for the operator chart
-mkdir -p submariner-operator/crds
-cat ${OPERATOR_CRDS}/submariner.io_submariners.yaml \
-    ${OPERATOR_CRDS}/submariner.io_servicediscoveries.yaml \
-    ${OPERATOR_CRDS}/submariner.io_brokers.yaml > submariner-operator/crds/crd.yaml
-
-# Generate the operator RBAC yaml for the operator chart
-add_service_acct_ns ${RBAC_BASE}/submariner-operator/cluster_role_binding.yaml
-cat ${RBAC_BASE}/submariner-operator/service_account.yaml \
-    ${RBAC_BASE}/submariner-operator/role.yaml \
-    ${RBAC_BASE}/submariner-operator/role_binding.yaml \
-    ${RBAC_BASE}/submariner-operator/cluster_role.yaml \
-    ${RBAC_BASE}/submariner-operator/cluster_role_binding.yaml > ${OPERATOR_RBAC_YAML}
-
-# Generate the gateway RBAC yaml for the operator chart
-add_service_acct_ns ${RBAC_BASE}/submariner-gateway/cluster_role_binding.yaml
-cat ${RBAC_BASE}/submariner-gateway/service_account.yaml \
-    ${RBAC_BASE}/submariner-gateway/role.yaml \
-    ${RBAC_BASE}/submariner-gateway/role_binding.yaml \
-    ${RBAC_BASE}/submariner-gateway/cluster_role.yaml \
-    ${RBAC_BASE}/submariner-gateway/cluster_role_binding.yaml > ${GATEWAY_RBAC_YAML}
-
-# Generate the routeagent RBAC yaml for the operator chart
-add_service_acct_ns ${RBAC_BASE}/submariner-route-agent/cluster_role_binding.yaml
-cat ${RBAC_BASE}/submariner-route-agent/service_account.yaml \
-    ${RBAC_BASE}/submariner-route-agent/role.yaml \
-    ${RBAC_BASE}/submariner-route-agent/role_binding.yaml \
-    ${RBAC_BASE}/submariner-route-agent/cluster_role.yaml \
-    ${RBAC_BASE}/submariner-route-agent/cluster_role_binding.yaml > ${ROUTE_AGENT_RBAC_YAML}
-
-# Generate the globalnet RBAC yaml for the operator chart
-echo '{{- if .Values.broker.globalnet }}' > ${GLOBALNET_RBAC_YAML}
-add_service_acct_ns ${RBAC_BASE}/submariner-globalnet/cluster_role_binding.yaml
-cat ${RBAC_BASE}/submariner-globalnet/service_account.yaml \
-    ${RBAC_BASE}/submariner-globalnet/role.yaml \
-    ${RBAC_BASE}/submariner-globalnet/role_binding.yaml \
-    ${RBAC_BASE}/submariner-globalnet/cluster_role.yaml \
-    ${RBAC_BASE}/submariner-globalnet/cluster_role_binding.yaml >> ${GLOBALNET_RBAC_YAML}
-echo '{{- end -}}' >> ${GLOBALNET_RBAC_YAML}
-
-# Generate the service discovery RBAC yaml for the operator chart
-echo '{{- if .Values.submariner.serviceDiscovery }}' > ${SERVICE_DISC_RBAC_YAML}
-add_service_acct_ns ${RBAC_BASE}/lighthouse-agent/cluster_role_binding.yaml
-add_service_acct_ns ${RBAC_BASE}/lighthouse-coredns/cluster_role_binding.yaml
-cat ${RBAC_BASE}/lighthouse-agent/service_account.yaml \
-    ${RBAC_BASE}/lighthouse-agent/cluster_role.yaml \
-    ${RBAC_BASE}/lighthouse-agent/cluster_role_binding.yaml \
-    ${RBAC_BASE}/lighthouse-agent/role.yaml \
-    ${RBAC_BASE}/lighthouse-agent/role_binding.yaml \
-    ${RBAC_BASE}/lighthouse-coredns/service_account.yaml \
-    ${RBAC_BASE}/lighthouse-coredns/cluster_role.yaml \
-    ${RBAC_BASE}/lighthouse-coredns/cluster_role_binding.yaml \
-    ${RBAC_BASE}/lighthouse-coredns/role.yaml \
-    ${RBAC_BASE}/lighthouse-coredns/role_binding.yaml >> ${SERVICE_DISC_RBAC_YAML}
-echo '{{- end -}}' >> ${SERVICE_DISC_RBAC_YAML}
-
-# Generate the openshift monitoring rbac yaml for the operator chart
-cat ${OPENSHIFT}/rbac/submariner-metrics-reader/role.yaml \
-    ${OPENSHIFT}/rbac/submariner-metrics-reader/role_binding.yaml > ${OPENSHIFT_MONITORING_YAML}

submariner-k8s-broker/README.md

@@ -13,3 +13,12 @@ Submariner Kubernetes Broker
 ## Source Code
 
 * <https://submariner-io.github.io/submariner-charts/charts>
+
+## Values
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| crd.create | bool | `true` |  |
+| rbac.create | bool | `true` |  |
+| serviceAccounts.client.create | bool | `true` |  |
+| serviceAccounts.client.name | string | `""` |  |

submariner-k8s-broker/crds/crd.yaml

@@ -0,0 +1,560 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: clusters.submariner.io
+spec:
+  group: submariner.io
+  names:
+    kind: Cluster
+    listKind: ClusterList
+    plural: clusters
+    singular: cluster
+  scope: Namespaced
+  versions:
+  - name: v1
+    schema:
+      openAPIV3Schema:
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            properties:
+              cluster_cidr:
+                items:
+                  type: string
+                type: array
+              cluster_id:
+                type: string
+              color_codes:
+                items:
+                  type: string
+                type: array
+              global_cidr:
+                items:
+                  type: string
+                type: array
+              service_cidr:
+                items:
+                  type: string
+                type: array
+            required:
+            - cluster_cidr
+            - cluster_id
+            - color_codes
+            - global_cidr
+            - service_cidr
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: endpoints.submariner.io
+spec:
+  group: submariner.io
+  names:
+    kind: Endpoint
+    listKind: EndpointList
+    plural: endpoints
+    singular: endpoint
+  scope: Namespaced
+  versions:
+  - name: v1
+    schema:
+      openAPIV3Schema:
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            properties:
+              backend:
+                type: string
+              backend_config:
+                additionalProperties:
+                  type: string
+                type: object
+              cable_name:
+                type: string
+              cluster_id:
+                type: string
+              healthCheckIP:
+                type: string
+              hostname:
+                type: string
+              nat_enabled:
+                type: boolean
+              private_ip:
+                type: string
+              public_ip:
+                type: string
+              subnets:
+                items:
+                  type: string
+                type: array
+            required:
+            - backend
+            - cable_name
+            - cluster_id
+            - hostname
+            - nat_enabled
+            - private_ip
+            - public_ip
+            - subnets
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: gateways.submariner.io
+spec:
+  group: submariner.io
+  names:
+    kind: Gateway
+    listKind: GatewayList
+    plural: gateways
+    singular: gateway
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - description: High availability status of the Gateway
+      jsonPath: .status.haStatus
+      name: HA Status
+      type: string
+    name: v1
+    schema:
+      openAPIV3Schema:
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          status:
+            properties:
+              connections:
+                items:
+                  properties:
+                    endpoint:
+                      properties:
+                        backend:
+                          type: string
+                        backend_config:
+                          additionalProperties:
+                            type: string
+                          type: object
+                        cable_name:
+                          type: string
+                        cluster_id:
+                          type: string
+                        healthCheckIP:
+                          type: string
+                        hostname:
+                          type: string
+                        nat_enabled:
+                          type: boolean
+                        private_ip:
+                          type: string
+                        public_ip:
+                          type: string
+                        subnets:
+                          items:
+                            type: string
+                          type: array
+                      required:
+                      - backend
+                      - cable_name
+                      - cluster_id
+                      - hostname
+                      - nat_enabled
+                      - private_ip
+                      - public_ip
+                      - subnets
+                      type: object
+                    latency:
+                      description: LatencySpec describes the round trip time information
+                        in nanoseconds for a packet between the gateway pods of two
+                        clusters.
+                      properties:
+                        averageRTT:
+                          format: int64
+                          type: integer
+                        lastRTT:
+                          description: TODO This shall be deleted once the operator
+                            is using the latest. Using Optional to avoid validation
+                            errors when this field is not used.
+                          format: int64
+                          type: integer
+                        maxRTT:
+                          format: int64
+                          type: integer
+                        minRTT:
+                          format: int64
+                          type: integer
+                        stddevRTT:
+                          format: int64
+                          type: integer
+                      type: object
+                    latencyRTT:
+                      description: LatencySpec describes the round trip time information
+                        for a packet between the gateway pods of two clusters.
+                      properties:
+                        average:
+                          type: string
+                        last:
+                          type: string
+                        max:
+                          type: string
+                        min:
+                          type: string
+                        stdDev:
+                          type: string
+                      type: object
+                    status:
+                      type: string
+                    statusMessage:
+                      type: string
+                  required:
+                  - endpoint
+                  - status
+                  - statusMessage
+                  type: object
+                type: array
+              haStatus:
+                type: string
+              localEndpoint:
+                properties:
+                  backend:
+                    type: string
+                  backend_config:
+                    additionalProperties:
+                      type: string
+                    type: object
+                  cable_name:
+                    type: string
+                  cluster_id:
+                    type: string
+                  healthCheckIP:
+                    type: string
+                  hostname:
+                    type: string
+                  nat_enabled:
+                    type: boolean
+                  private_ip:
+                    type: string
+                  public_ip:
+                    type: string
+                  subnets:
+                    items:
+                      type: string
+                    type: array
+                required:
+                - backend
+                - cable_name
+                - cluster_id
+                - hostname
+                - nat_enabled
+                - private_ip
+                - public_ip
+                - subnets
+                type: object
+              statusFailure:
+                type: string
+              version:
+                type: string
+            required:
+            - connections
+            - haStatus
+            - localEndpoint
+            - statusFailure
+            - version
+            type: object
+        required:
+        - status
+        type: object
+    served: true
+    storage: true
+    subresources: {}
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: serviceexports.multicluster.x-k8s.io
+spec:
+  group: multicluster.x-k8s.io
+  scope: Namespaced
+  names:
+    plural: serviceexports
+    singular: serviceexport
+    kind: ServiceExport
+    shortNames:
+      - svcex
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      additionalPrinterColumns:
+        - name: Age
+          type: date
+          jsonPath: .metadata.creationTimestamp
+      "schema":
+        "openAPIV3Schema":
+          description: ServiceExport declares that the Service with the same name and
+            namespace as this export should be consumable from other clusters.
+          type: object
+          properties:
+            apiVersion:
+              description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+              type: string
+            kind:
+              description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+              type: string
+            metadata:
+              type: object
+            status:
+              description: status describes the current state of an exported service.
+                Service configuration comes from the Service that had the same name
+                and namespace as this ServiceExport. Populated by the multi-cluster
+                service implementation's controller.
+              type: object
+              properties:
+                conditions:
+                  type: array
+                  items:
+                    description: "ServiceExportCondition contains details for the current
+                    condition of this service export. \n Once [KEP-1623](https://github.com/kubernetes/enhancements/tree/master/keps/sig-api-machinery/1623-standardize-conditions)
+                    is implemented, this will be replaced by metav1.Condition."
+                    type: object
+                    required:
+                      - status
+                      - type
+                    properties:
+                      lastTransitionTime:
+                        type: string
+                        format: date-time
+                      message:
+                        type: string
+                      reason:
+                        type: string
+                      status:
+                        description: Status is one of {"True", "False", "Unknown"}
+                        type: string
+                        enum:
+                          - "True"
+                          - "False"
+                          - Unknown
+                      type:
+                        description: ServiceExportConditionType identifies a specific
+                          condition.
+                        type: string
+                  x-kubernetes-list-map-keys:
+                    - type
+                  x-kubernetes-list-type: map
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: serviceimports.multicluster.x-k8s.io
+spec:
+  group: multicluster.x-k8s.io
+  scope: Namespaced
+  names:
+    plural: serviceimports
+    singular: serviceimport
+    kind: ServiceImport
+    shortNames:
+      - svcim
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      additionalPrinterColumns:
+        - name: Type
+          type: string
+          description: The type of this ServiceImport
+          jsonPath: .spec.type
+        - name: IP
+          type: string
+          description: The VIP for this ServiceImport
+          jsonPath: .spec.ips
+        - name: Age
+          type: date
+          jsonPath: .metadata.creationTimestamp
+      "schema":
+        "openAPIV3Schema":
+          description: ServiceImport describes a service imported from clusters in a
+            ClusterSet.
+          type: object
+          properties:
+            apiVersion:
+              description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+              type: string
+            kind:
+              description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: spec defines the behavior of a ServiceImport.
+              type: object
+              required:
+                - ports
+                - type
+              properties:
+                ips:
+                  description: ip will be used as the VIP for this service when type
+                    is ClusterSetIP.
+                  type: array
+                  maxItems: 1
+                  items:
+                    type: string
+                ports:
+                  type: array
+                  items:
+                    description: ServicePort represents the port on which the service
+                      is exposed
+                    type: object
+                    required:
+                      - port
+                    properties:
+                      appProtocol:
+                        description: The application protocol for this port. This field
+                          follows standard Kubernetes label syntax. Un-prefixed names
+                          are reserved for IANA standard service names (as per RFC-6335
+                          and http://www.iana.org/assignments/service-names). Non-standard
+                          protocols should use prefixed names such as mycompany.com/my-custom-protocol.
+                          Field can be enabled with ServiceAppProtocol feature gate.
+                        type: string
+                      name:
+                        description: The name of this port within the service. This
+                          must be a DNS_LABEL. All ports within a ServiceSpec must have
+                          unique names. When considering the endpoints for a Service,
+                          this must match the 'name' field in the EndpointPort. Optional
+                          if only one ServicePort is defined on this service.
+                        type: string
+                      port:
+                        description: The port that will be exposed by this service.
+                        type: integer
+                        format: int32
+                      protocol:
+                        description: The IP protocol for this port. Supports "TCP",
+                          "UDP", and "SCTP". Default is TCP.
+                        type: string
+                  x-kubernetes-list-type: atomic
+                sessionAffinity:
+                  description: 'Supports "ClientIP" and "None". Used to maintain session
+                  affinity. Enable client IP based session affinity. Must be ClientIP
+                  or None. Defaults to None. Ignored when type is Headless More info:
+                  https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies'
+                  type: string
+                sessionAffinityConfig:
+                  description: sessionAffinityConfig contains session affinity configuration.
+                  type: object
+                  properties:
+                    clientIP:
+                      description: clientIP contains the configurations of Client IP
+                        based session affinity.
+                      type: object
+                      properties:
+                        timeoutSeconds:
+                          description: timeoutSeconds specifies the seconds of ClientIP
+                            type session sticky time. The value must be >0 && <=86400(for
+                            1 day) if ServiceAffinity == "ClientIP". Default value is
+                            10800(for 3 hours).
+                          type: integer
+                          format: int32
+                type:
+                  description: type defines the type of this service. Must be ClusterSetIP
+                    or Headless.
+                  type: string
+                  enum:
+                    - ClusterSetIP
+                    - Headless
+            status:
+              description: status contains information about the exported services that
+                form the multi-cluster service referenced by this ServiceImport.
+              type: object
+              properties:
+                clusters:
+                  description: clusters is the list of exporting clusters from which
+                    this service was derived.
+                  type: array
+                  items:
+                    description: ClusterStatus contains service configuration mapped
+                      to a specific source cluster
+                    type: object
+                    required:
+                      - cluster
+                    properties:
+                      cluster:
+                        description: cluster is the name of the exporting cluster. Must
+                          be a valid RFC-1123 DNS label.
+                        type: string
+                  x-kubernetes-list-map-keys:
+                    - cluster
+                  x-kubernetes-list-type: map

submariner-k8s-broker/templates/_helpers.tpl

@@ -35,5 +35,9 @@ Create chart name and version as used by the chart label.
 Create the name of the submariner-client service account to use
 */}}
 {{- define "submariner-k8s-broker.clientServiceAccountName" -}}
-{{- printf "%s-client" (include "submariner-k8s-broker.fullname" .)}}
+{{- if .Values.serviceAccounts.client.create -}}
+    {{ default (printf "%s-client" (include "submariner-k8s-broker.fullname" .)) .Values.serviceAccounts.client.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccounts.client.name }}
+{{- end -}}
 {{- end -}}

submariner-k8s-broker/templates/rbac.yaml

@@ -1,4 +1,26 @@
-{{ include "broker-role" $ }}
+{{- if .Values.rbac.create -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ template "submariner-k8s-broker.fullname" . }}-cluster
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner-k8s-broker.chart" . }}
+    app: {{ template "submariner-k8s-broker.name" . }}
+rules:
+- apiGroups: ["submariner.io"]
+  resources: ["clusters", "endpoints"]
+  verbs: ["create", "get", "list", "watch", "patch", "update", "delete"]
+- apiGroups: ["lighthouse.submariner.io"]
+  resources: ["*"]
+  verbs: ["create", "get", "list", "watch", "patch", "update", "delete"]
+- apiGroups: ["discovery.k8s.io"]
+  resources: ["endpointslices", "endpointslices/restricted"]
+  verbs: ["create", "get", "list", "watch","patch", "update", "delete"]
+- apiGroups: ["multicluster.x-k8s.io"]
+  resources: ["*"]
+  verbs: ["create", "get", "list", "watch", "update", "delete"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -12,3 +34,4 @@ subjects:
 - kind: ServiceAccount
   name: {{ template "submariner-k8s-broker.clientServiceAccountName" . }}
   namespace: {{ .Release.Namespace }}
+{{- end -}}

submariner-k8s-broker/templates/svc-acct.yaml

@@ -1,3 +1,4 @@
+{{- if .Values.serviceAccounts.client.create }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
@@ -15,3 +16,4 @@ metadata:
   annotations:
     kubernetes.io/service-account.name: {{ template "submariner-k8s-broker.clientServiceAccountName" . }}
 type: kubernetes.io/service-account-token
+{{- end }}

submariner-k8s-broker/values.yaml

@@ -1 +1,9 @@
 ---
+rbac:
+  create: true
+crd:
+  create: true
+serviceAccounts:
+  client:
+    create: true
+    name: ""

submariner-operator/README.md

@@ -28,7 +28,6 @@ Submariner enables direct networking between Pods and Services in different Kube
 | ipsec.forceUDPEncaps | bool | `false` |  |
 | ipsec.ikePort | int | `500` |  |
 | ipsec.natPort | int | `4500` |  |
-| ipsec.pskSecret | string | `""` | Name of the Kubernetes Secret containing the IPsec PSK as field psk |
 | ipsec.psk | string | `""` |  |
 | leadership.leaseDuration | int | `10` |  |
 | leadership.renewDeadline | int | `5` |  |
@@ -39,6 +38,19 @@ Submariner enables direct networking between Pods and Services in different Kube
 | operator.image.tag | string | `"0.14.0"` |  |
 | operator.resources | object | `{}` |  |
 | operator.tolerations | list | `[]` |  |
+| rbac.create | bool | `true` |  |
+| serviceAccounts.gateway.create | bool | `true` |  |
+| serviceAccounts.gateway.name | string | `""` |  |
+| serviceAccounts.globalnet.create | bool | `true` |  |
+| serviceAccounts.globalnet.name | string | `""` |  |
+| serviceAccounts.lighthouseAgent.create | bool | `true` |  |
+| serviceAccounts.lighthouseAgent.name | string | `""` |  |
+| serviceAccounts.lighthouseCoreDns.create | bool | `true` |  |
+| serviceAccounts.lighthouseCoreDns.name | string | `""` |  |
+| serviceAccounts.operator.create | bool | `true` |  |
+| serviceAccounts.operator.name | string | `""` |  |
+| serviceAccounts.routeAgent.create | bool | `true` |  |
+| serviceAccounts.routeAgent.name | string | `""` |  |
 | submariner.cableDriver | string | `"libreswan"` |  |
 | submariner.clusterCidr | string | `""` |  |
 | submariner.clusterId | string | `""` |  |
@@ -46,13 +58,10 @@ Submariner enables direct networking between Pods and Services in different Kube
 | submariner.coreDNSCustomConfig | object | `{}` |  |
 | submariner.debug | bool | `false` |  |
 | submariner.globalCidr | string | `""` |  |
-| submariner.clustersetIpCidr | string | `""` |  |
-| submariner.clustersetIpEnabled | bool | `false` |  |
 | submariner.healthcheckEnabled | bool | `true` |  |
 | submariner.images.repository | string | `"quay.io/submariner"` |  |
 | submariner.images.tag | string | `"0.14.0"` |  |
 | submariner.natEnabled | bool | `false` |  |
 | submariner.serviceCidr | string | `""` |  |
-| submariner.brokerK8sSecret | string | `""` |  Name of the Kubernetes Secret containing broker credentials (ca.crt, token). |
 | submariner.serviceDiscovery | bool | `true` |  |
 | submariner.token | string | `""` |  |

submariner-operator/templates/_helpers.tpl

@@ -1,4 +1,11 @@
 {{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "submariner.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
 {{/*
 Create a default fully qualified app name.
 We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
@@ -24,3 +31,75 @@ Create chart name and version as used by the chart label.
 {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
 {{- end -}}
 
+{{/*
+Create the name of the submariner-operator service account to use
+*/}}
+{{- define "submariner.operatorServiceAccountName" -}}
+{{- if .Values.serviceAccounts.operator.create -}}
+    {{ default (printf "%s" (include "submariner.fullname" .)) .Values.serviceAccounts.operator.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccounts.operator.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create the name of the submariner-gateway service account to use
+*/}}
+{{- define "submariner.gatewayServiceAccountName" -}}
+{{- if .Values.serviceAccounts.gateway.create -}}
+    {{ default "submariner-gateway" .Values.serviceAccounts.gateway.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccounts.gateway.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create the name of the submariner-route-agent service account to use
+*/}}
+{{- define "submariner.routeAgentServiceAccountName" -}}
+{{- if .Values.serviceAccounts.routeAgent.create -}}
+    {{ default "submariner-routeagent" .Values.serviceAccounts.routeAgent.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccounts.routeAgent.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create the name of the submariner-globalnet service account to use
+*/}}
+{{- define "submariner.globalnetServiceAccountName" -}}
+{{- if .Values.serviceAccounts.globalnet.create -}}
+    {{ default "submariner-globalnet" .Values.serviceAccounts.globalnet.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccounts.globalnet.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create the name of the submariner-lighthouse-agent service account to use
+*/}}
+{{- define "submariner.lighthouseAgentServiceAccountName" -}}
+{{- if and (.Values.submariner.serviceDiscovery ) (.Values.serviceAccounts.lighthouseAgent.create) -}}
+    {{ default "submariner-lighthouse-agent" .Values.serviceAccounts.lighthouseAgent.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccounts.lighthouseAgent.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create the name of the submariner-lighthouse-coredns service account to use
+*/}}
+{{- define "submariner.lighthouseCoreDnsServiceAccountName" -}}
+{{- if and (.Values.submariner.serviceDiscovery ) (.Values.serviceAccounts.lighthouseCoreDns.create) -}}
+    {{ default "submariner-lighthouse-coredns" .Values.serviceAccounts.lighthouseCoreDns.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccounts.lighthouseCoreDns.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create the name of the submariner-lighthouse-coredns service name to use
+*/}}
+{{- define "submariner.lighthouseDnsName" -}}
+{{- default (printf "%s-lighthouse-coredns" (include "submariner.fullname" .)) .Values.lighthouseCoredns.name }}
+{{- end -}}

submariner-operator/templates/operator-deployment.yaml

@@ -6,6 +6,7 @@ metadata:
     release: {{ .Release.Name | quote }}
     chart: {{ template "submariner.chart" . }}
     app: {{ template "submariner.fullname" . }}
+    component: gateway
   name: {{ template "submariner.fullname" . }}
 spec:
   progressDeadlineSeconds: 600
@@ -26,8 +27,8 @@ spec:
         name: {{ template "submariner.fullname" . }}
     spec:
       containers:
-      - args:
+      - command:
-        - --leader-elect
+        - submariner-operator
         env:
         - name: WATCH_NAMESPACE
           valueFrom:
@@ -51,5 +52,6 @@ spec:
       restartPolicy: Always
       schedulerName: default-scheduler
       securityContext: {}
-      serviceAccountName: submariner-operator
+      serviceAccount: {{ template "submariner.fullname" . }}
+      serviceAccountName: {{ template "submariner.fullname" . }}
       terminationGracePeriodSeconds: 30

submariner-operator/templates/rbac.yaml

@@ -0,0 +1,929 @@
+{{- if .Values.rbac.create -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ template "submariner.fullname" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - services
+  - services/finalizers
+  - endpoints
+  - persistentvolumeclaims
+  - events
+  - configmaps
+  - secrets
+  verbs:
+  - '*'
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  - daemonsets
+  - replicasets
+  - statefulsets
+  verbs:
+  - '*'
+- apiGroups:
+  - monitoring.coreos.com
+  resources:
+  - servicemonitors
+  verbs:
+  - get
+  - create
+- apiGroups:
+  - apps
+  resourceNames:
+  - {{ template "submariner.fullname" . }}
+  resources:
+  - deployments/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+- apiGroups:
+  - apps
+  resources:
+  - replicasets
+  verbs:
+  - get
+- apiGroups:
+  - submariner.io
+  resources:
+  - '*'
+  - servicediscoveries
+  verbs:
+  - '*'
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ template "submariner.fullname" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+subjects:
+- kind: ServiceAccount
+  name: {{ template "submariner.operatorServiceAccountName" . }}
+roleRef:
+  kind: Role
+  name: {{ template "submariner.fullname" . }}
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ template "submariner.fullname" . }}:gateway
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+rules:
+- apiGroups:
+    - ""
+  resources:
+    - pods
+    - services
+    - services/finalizers
+    - endpoints
+    - persistentvolumeclaims
+    - events
+    - configmaps
+    - secrets
+  verbs:
+    - '*'
+- apiGroups:
+    - apps
+  resources:
+    - deployments
+    - daemonsets
+    - replicasets
+    - statefulsets
+  verbs:
+    - '*'
+- apiGroups:
+    - monitoring.coreos.com
+  resources:
+    - servicemonitors
+  verbs:
+    - get
+    - create
+- apiGroups:
+    - apps
+  resourceNames:
+    - submariner-operator
+  resources:
+    - deployments/finalizers
+  verbs:
+    - update
+- apiGroups:
+    - ""
+  resources:
+    - pods
+  verbs:
+    - get
+- apiGroups:
+    - apps
+  resources:
+    - replicasets
+  verbs:
+    - get
+- apiGroups:
+    - submariner.io
+  resources:
+    - '*'
+    - servicediscoveries
+  verbs:
+    - '*'
+- apiGroups:
+    - lighthouse.submariner.io
+  resources:
+    - '*'
+    - serviceexports
+  verbs:
+    - create
+    - delete
+    - get
+    - list
+    - patch
+    - update
+    - watch
+- apiGroups:
+    - coordination.k8s.io
+  resources:
+    - leases
+  verbs:
+    - get
+    - list
+    - watch
+    - create
+    - update
+    - delete
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:gateway
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "submariner.fullname" . }}:gateway
+subjects:
+- kind: ServiceAccount
+  name: {{ template "submariner.gatewayServiceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ template "submariner.fullname" . }}:routeagent
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+      - services
+      - services/finalizers
+      - endpoints
+      - persistentvolumeclaims
+      - events
+      - configmaps
+      - secrets
+    verbs:
+      - '*'
+  - apiGroups:
+      - apps
+    resources:
+      - deployments
+      - daemonsets
+      - replicasets
+      - statefulsets
+    verbs:
+      - '*'
+  - apiGroups:
+      - monitoring.coreos.com
+    resources:
+      - servicemonitors
+    verbs:
+      - get
+      - create
+  - apiGroups:
+      - apps
+    resourceNames:
+      - submariner-operator
+    resources:
+      - deployments/finalizers
+    verbs:
+      - update
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - get
+  - apiGroups:
+      - apps
+    resources:
+      - replicasets
+    verbs:
+      - get
+  - apiGroups:
+      - submariner.io
+    resources:
+      - '*'
+      - servicediscoveries
+    verbs:
+      - '*'
+  - apiGroups:
+      - lighthouse.submariner.io
+    resources:
+      - '*'
+      - serviceexports
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:routeagent
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "submariner.fullname" . }}:routeagent
+subjects:
+- kind: ServiceAccount
+  name: {{ template "submariner.routeAgentServiceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+---
+{{- if .Values.broker.globalnet }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ template "submariner.fullname" . }}:globalnet
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+      - services
+      - services/finalizers
+      - endpoints
+      - persistentvolumeclaims
+      - events
+      - configmaps
+      - secrets
+    verbs:
+      - '*'
+  - apiGroups:
+      - apps
+    resources:
+      - deployments
+      - daemonsets
+      - replicasets
+      - statefulsets
+    verbs:
+      - '*'
+  - apiGroups:
+      - monitoring.coreos.com
+    resources:
+      - servicemonitors
+    verbs:
+      - get
+      - create
+  - apiGroups:
+      - apps
+    resourceNames:
+      - submariner-operator
+    resources:
+      - deployments/finalizers
+    verbs:
+      - update
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - get
+  - apiGroups:
+      - apps
+    resources:
+      - replicasets
+    verbs:
+      - get
+  - apiGroups:
+      - submariner.io
+    resources:
+      - '*'
+      - servicediscoveries
+    verbs:
+      - '*'
+  - apiGroups:
+      - lighthouse.submariner.io
+    resources:
+      - '*'
+      - serviceexports
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+  - apiGroups:
+      - coordination.k8s.io
+    resources:
+      - leases
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - delete
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:globalnet
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "submariner.fullname" . }}:globalnet
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "submariner.globalnetServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+---
+{{- end -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "submariner.fullname" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+rules:
+  # submariner-operator updates the config map of core-dns to forward requests to
+  # clusterset.local to Lighthouse DNS, also looks at existing configmaps
+  # to figure out network settings
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions
+    verbs:
+      - get
+      - list
+      - create
+      - update
+      - delete
+      - watch
+  - apiGroups:  # pods, services and nodes are looked up to figure out network settings
+      - ""
+    resources:
+      - pods
+      - services
+      - nodes
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - operator.openshift.io
+    resources:
+      - dnses
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - config.openshift.io
+    resources:
+      - networks
+    verbs:
+      - get
+      - list
+  - apiGroups:
+      - ""
+    resources:
+      - namespaces
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - monitoring.coreos.com
+    resources:
+      - servicemonitors
+    verbs:
+      - get
+      - create
+  - apiGroups:
+      - apps
+    resources:
+      - daemonsets
+    verbs:
+      - get
+      - list
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "submariner.operatorServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "submariner.fullname" . }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: submariner-metrics-reader
+  namespace: {{ .Release.Namespace }}
+rules:
+  - apiGroups: [""]
+    resources: ["pods", "services", "endpoints"]
+    verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: read-submariner-metrics
+subjects:
+  - kind: ServiceAccount
+    name: prometheus-k8s
+    namespace: openshift-monitoring
+roleRef:
+  kind: Role
+  name: submariner-metrics-reader
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "submariner.fullname" . }}:gateway
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions
+    verbs:
+      - get
+      - list
+      - create
+      - update
+      - delete
+  - apiGroups:  # pods and services are looked up to figure out network settings
+      - ""
+    resources:
+      - pods
+      - services
+      - nodes
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - operator.openshift.io
+    resources:
+      - dnses
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - config.openshift.io
+    resources:
+      - networks
+    verbs:
+      - get
+      - list
+  - apiGroups:
+      - submariner.io
+    resources:
+      - endpoints
+      - gateways
+      - clusters
+    verbs:
+      - get
+      - list
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:gateway
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "submariner.fullname" . }}:gateway
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "submariner.gatewayServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "submariner.fullname" . }}:routeagent
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions
+    verbs:
+      - get
+      - list
+      - create
+      - update
+      - delete
+  - apiGroups:  # pods and services are looked up to figure out network settings
+      - ""
+    resources:
+      - pods
+      - services
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - operator.openshift.io
+    resources:
+      - dnses
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - config.openshift.io
+    resources:
+      - networks
+    verbs:
+      - get
+      - list
+  - apiGroups:
+      - ""
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+    resources:
+      - nodes
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:routeagent
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "submariner.fullname" . }}:routeagent
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "submariner.routeAgentServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+---
+{{- if .Values.broker.globalnet }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "submariner.fullname" . }}:globalnet
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+      - namespaces
+      - nodes
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - ""
+    resources:
+      - services
+      - endpoints
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - delete
+  - apiGroups:
+      - submariner.io
+    resources:
+      - endpoints
+      - clusters
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - submariner.io
+    resources:
+      - clusterglobalegressips
+      - clusterglobalegressips/status
+      - globalegressips
+      - globalegressips/status
+      - globalingressips
+      - globalingressips/status
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - delete
+      - deletecollection
+  - apiGroups:
+      - multicluster.x-k8s.io
+    resources:
+      - "serviceexports"
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - network.openshift.io
+    resources:
+      - service/externalips
+    verbs:
+      - create
+      - get
+      - list
+      - delete
+---
+{{- end -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:globalnet
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "submariner.fullname" . }}:globalnet
+subjects:
+- kind: ServiceAccount
+  name: {{ template "submariner.globalnetServiceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+---
+{{- if .Values.submariner.serviceDiscovery }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "submariner.fullname" . }}:lighthouse-agent
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - services
+      - namespaces
+      - endpoints
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - discovery.k8s.io
+    resources:
+      - endpointslices
+      - endpointslices/restricted
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - delete
+      - deletecollection
+  - apiGroups:
+      - submariner.io
+    resources:
+      - "gateways"
+      - "globalingressips"
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - multicluster.x-k8s.io
+    resources:
+      - "*"
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - delete
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:lighthouse-agent
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "submariner.fullname" . }}:lighthouse-agent
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "submariner.lighthouseAgentServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "submariner.fullname" . }}:lighthouse-coredns
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - services
+      - namespaces
+      - endpoints
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - discovery.k8s.io
+    resources:
+      - endpointslices
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - delete
+      - deletecollection
+  - apiGroups:
+      - submariner.io
+    resources:
+      - "gateways"
+      - "submariners"
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - multicluster.x-k8s.io
+    resources:
+      - "*"
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - delete
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:lighthouse-coredns
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "submariner.fullname" . }}:lighthouse-coredns
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end -}}
+{{- end -}}

submariner-operator/templates/submariner.yaml

@@ -6,23 +6,15 @@ metadata:
 spec:
   broker: k8s
   brokerK8sApiServer: {{ .Values.broker.server }}
-  {{- if .Values.submariner.brokerK8sSecret }}
-  brokerK8sSecret: {{ .Values.submariner.brokerK8sSecret }}
-  {{- else }}
   brokerK8sApiServerToken: {{ .Values.broker.token }}
   brokerK8sCA: {{ .Values.broker.ca }}
-  {{- end }}
   brokerK8sRemoteNamespace: {{ .Values.broker.namespace }}
   brokerK8sInsecure: {{ .Values.broker.insecure }}
   ceIPSecDebug: {{ .Values.ipsec.debug }}
   ceIPSecForceUDPEncaps: {{ .Values.ipsec.forceUDPEncaps }}
   ceIPSecIKEPort: {{ .Values.ipsec.ikePort }}
   ceIPSecNATTPort: {{ .Values.ipsec.natPort }}
-  {{- if .Values.ipsec.pskSecret }}
-  ceIPSecPSKSecret: {{ .Values.ipsec.pskSecret }}
-  {{- else }}
   ceIPSecPSK: {{ .Values.ipsec.psk }}
-  {{- end }}
   clusterCIDR: "{{ .Values.submariner.clusterCidr }}"
   clusterID: {{ .Values.submariner.clusterId }}
   colorCodes: {{ .Values.submariner.colorCodes }}
@@ -60,8 +52,6 @@ spec:
 {{- end }}
   serviceCIDR: "{{ .Values.submariner.serviceCidr }}"
   globalCIDR: "{{ .Values.submariner.globalCidr }}"
-  clustersetIPCIDR: "{{ .Values.submariner.clustersetIpCidr }}"
-  clustersetIPEnabled: {{ .Values.submariner.clustersetIpEnabled }}
   serviceDiscoveryEnabled: {{ .Values.submariner.serviceDiscovery }}
   cableDriver: {{ .Values.submariner.cableDriver }}
   connectionHealthCheck:

submariner-operator/templates/svc-acct.yaml

@@ -0,0 +1,119 @@
+{{- if .Values.serviceAccounts.operator.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "submariner.operatorServiceAccountName" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ template "submariner.operatorServiceAccountName" . }}-token
+  annotations:
+    kubernetes.io/service-account.name: {{ template "submariner.operatorServiceAccountName" . }}
+type: kubernetes.io/service-account-token
+{{- end }}
+---
+{{- if .Values.serviceAccounts.gateway.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "submariner.gatewayServiceAccountName" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ template "submariner.gatewayServiceAccountName" . }}-token
+  annotations:
+    kubernetes.io/service-account.name: {{ template "submariner.gatewayServiceAccountName" . }}
+type: kubernetes.io/service-account-token
+{{- end }}
+---
+{{- if .Values.serviceAccounts.routeAgent.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "submariner.routeAgentServiceAccountName" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ template "submariner.routeAgentServiceAccountName" . }}-token
+  annotations:
+    kubernetes.io/service-account.name: {{ template "submariner.routeAgentServiceAccountName" . }}
+type: kubernetes.io/service-account-token
+{{- end }}
+---
+{{- if .Values.serviceAccounts.globalnet.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "submariner.globalnetServiceAccountName" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ template "submariner.globalnetServiceAccountName" . }}-token
+  annotations:
+    kubernetes.io/service-account.name: {{ template "submariner.globalnetServiceAccountName" . }}
+type: kubernetes.io/service-account-token
+{{- end }}
+---
+{{- if .Values.serviceAccounts.lighthouseAgent.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "submariner.lighthouseAgentServiceAccountName" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ template "submariner.lighthouseAgentServiceAccountName" . }}-token
+  annotations:
+    kubernetes.io/service-account.name: {{ template "submariner.lighthouseAgentServiceAccountName" . }}
+type: kubernetes.io/service-account-token
+{{- end }}
+---
+  {{- if .Values.serviceAccounts.lighthouseCoreDns.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }}-token
+  annotations:
+    kubernetes.io/service-account.name: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }}
+type: kubernetes.io/service-account-token
+  {{- end }}

submariner-operator/values.yaml

@@ -5,9 +5,6 @@ submariner:
   clusterCidr: ""
   serviceCidr: ""
   globalCidr: ""
-  clustersetIpCidr: ""
-  clustersetIpEnabled: false
-  brokerK8sSecret: ""
   loadBalancerEnabled: false
   natEnabled: false
   colorCodes: blue
@@ -26,10 +23,11 @@ broker:
   insecure: false
   ca: ""
   globalnet: false
+rbac:
+  create: true
 images: {}
 ipsec:
   psk: ""
-  pskSecret: ""
   debug: false
   forceUDPEncaps: false
   ikePort: 500
@@ -46,3 +44,22 @@ operator:
   resources: {}
   tolerations: []
   affinity: {}
+serviceAccounts:
+  operator:
+    create: true
+    name: ""
+  gateway:
+    create: true
+    name: ""
+  routeAgent:
+    create: true
+    name: ""
+  globalnet:
+    create: true
+    name: ""
+  lighthouseAgent:
+    create: true
+    name: ""
+  lighthouseCoreDns:
+    create: true
+    name: ""

yamls/generate-yamls.go

@@ -1,38 +0,0 @@
-//go:build yamls
-
-/*
-SPDX-License-Identifier: Apache-2.0
-
-Copyright Contributors to the Submariner project.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Place any runtime dependencies as imports in this file.
-// Go modules will be forced to download and install them.
-
-package yamls
-
-import (
-	_ "github.com/submariner-io/submariner-operator/config/broker/broker-client"
-	_ "github.com/submariner-io/submariner-operator/config/openshift/rbac/submariner-metrics-reader"
-	_ "github.com/submariner-io/submariner-operator/config/rbac/submariner-gateway"
-	_ "github.com/submariner-io/submariner-operator/config/rbac/submariner-globalnet"
-	_ "github.com/submariner-io/submariner-operator/config/rbac/submariner-operator"
-	_ "github.com/submariner-io/submariner-operator/config/rbac/submariner-route-agent"
-	_ "github.com/submariner-io/submariner-operator/config/rbac/lighthouse-agent"
-	_ "github.com/submariner-io/submariner-operator/config/rbac/lighthouse-coredns"
-	_ "github.com/submariner-io/submariner-operator/deploy/crds"
-	_ "github.com/submariner-io/submariner/deploy/crds"
-	_ "sigs.k8s.io/mcs-api/config/crd"
-)