Update Submariner dependencies to v0.16.7

Signed-off-by: Automated Release <release@submariner.io>
Bump actions/checkout from 4.1.4 to 4.1.6 in the github-actions group
2026-09-20 22:40:34 +00:00 · 2024-06-17 20:50:41 +03:00 · 2024-06-03 07:14:52 -04:00 · 2024-05-31 17:22:16 +03:00 · 2024-05-23 12:39:11 +03:00 · 2024-05-21 18:55:53 +02:00
28 changed files with 2689 additions and 290 deletions
@@ -5,61 +5,18 @@ updates:
    directory: '/'
    schedule:
      interval: monthly
-    groups:
-      github-actions:
-        patterns:
-          - "*"
  - package-ecosystem: github-actions
    directory: '/'
-    target-branch: "release-0.17"
+    target-branch: "release-0.13"
    schedule:
      interval: monthly
-    groups:
-      github-actions:
-        patterns:
-          - "*"
  - package-ecosystem: github-actions
    directory: '/'
-    target-branch: "release-0.18"
+    target-branch: "release-0.14"
    schedule:
      interval: monthly
-    groups:
-      github-actions:
-        patterns:
-          - "*"
  - package-ecosystem: github-actions
    directory: '/'
-    target-branch: "release-0.19"
+    target-branch: "release-0.15"
    schedule:
      interval: monthly
-    groups:
-      github-actions:
-        patterns:
-          - "*"
-  - package-ecosystem: github-actions
-    directory: '/'
-    target-branch: "release-0.20"
-    schedule:
-      interval: monthly
-    groups:
-      github-actions:
-        patterns:
-          - "*"
-  - package-ecosystem: github-actions
-    directory: '/'
-    target-branch: "release-0.21"
-    schedule:
-      interval: monthly
-    groups:
-      github-actions:
-        patterns:
-          - "*"
-  - package-ecosystem: github-actions
-    directory: '/'
-    target-branch: "release-0.22"
-    schedule:
-      interval: monthly
-    groups:
-      github-actions:
-        patterns:
-          - "*"
@@ -0,0 +1,57 @@
+---
+# Configuration for probot-stale - https://github.com/probot/stale
+
+# Number of days of inactivity before an Issue becomes stale (pull request is overridden later)
+daysUntilStale: 120
+
+# Number of days of inactivity before an Issue or Pull Request with the stale label is closed.
+# Set to false to disable. If disabled, issues still need to be closed manually, but will remain marked as stale.
+daysUntilClose: 7
+
+# Only issues or pull requests with all of these labels are check if stale. Defaults to `[]` (disabled)
+onlyLabels: []
+
+# Issues or Pull Requests with these labels will never be considered stale. Set to `[]` to disable
+exemptLabels:
+  - security
+  - confirmed
+
+# Set to true to ignore issues in a project (defaults to false)
+exemptProjects: false
+
+# Set to true to ignore issues in a milestone (defaults to false)
+exemptMilestones: false
+
+# Set to true to ignore issues with an assignee (defaults to false)
+exemptAssignees: false
+
+# Label to use when marking as stale
+staleLabel: wontfix
+
+# Comment to post when marking as stale. Set to `false` to disable
+markComment: >
+  This issue has been automatically marked as stale because it has not had
+  activity for 60 days. It will be closed if no further activity occurs.
+  Please make a comment if this issue/pr is still valid. Thank you
+  for your contributions.
+
+# Comment to post when removing the stale label.
+# unmarkComment: >
+#   Your comment here.
+
+# Comment to post when closing a stale Issue or Pull Request.
+# closeComment: >
+#   Your comment here.
+
+# Limit the number of actions per hour, from 1-30. Default is 30
+limitPerRun: 30
+
+# Limit to only `issues` or `pulls`
+# only: issues
+
+pulls:
+  daysUntilStale: 30
+  markComment: >
+    This pull request has been automatically marked as stale because it has not had
+    recent activity. It will be closed if no further activity occurs. Thank you
+    for your contributions.
@@ -11,6 +11,6 @@ jobs:
    name: PR targets branch
    runs-on: ubuntu-latest
    steps:
-      - name: Check that the PR targets release-0.23
-        if: ${{ github.base_ref != 'release-0.23' }}
+      - name: Check that the PR targets release-0.16
+        if: ${{ github.base_ref != 'release-0.16' }}
        run: exit 1
@@ -18,22 +18,22 @@ jobs:
      matrix:
        cable_driver: ['libreswan', 'wireguard', 'vxlan']
        globalnet: ['', 'globalnet']
-        # Run most tests against the latest K8s version
-        k8s_version: ['k8s-latest']
+        k8s_version: ['1.25']
        lighthouse: ['', 'lighthouse']
        include:
-          # Bottom of supported K8s version range
-          - k8s_version: 'k8s-oldest-supported'
+          - k8s_version: '1.22'
+          - k8s_version: '1.23'
+          - k8s_version: '1.24'
    steps:
      - name: Check out the repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29

      - name: Run E2E deployment and tests
-        uses: submariner-io/shipyard/gh-actions/e2e@release-0.23
+        uses: submariner-io/shipyard/gh-actions/e2e@release-0.16
        with:
          k8s_version: ${{ matrix.k8s_version }}
          using: ${{ matrix.cable_driver }} ${{ matrix.globalnet }} ${{ matrix.lighthouse }}

      - name: Post mortem
        if: failure()
-        uses: submariner-io/shipyard/gh-actions/post-mortem@release-0.23
+        uses: submariner-io/shipyard/gh-actions/post-mortem@release-0.16
@@ -13,11 +13,11 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29

      - name: Run E2E deployment and tests
-        uses: submariner-io/shipyard/gh-actions/e2e@release-0.23
+        uses: submariner-io/shipyard/gh-actions/e2e@release-0.16

      - name: Post mortem
        if: failure()
-        uses: submariner-io/shipyard/gh-actions/post-mortem@release-0.23
+        uses: submariner-io/shipyard/gh-actions/post-mortem@release-0.16
@@ -21,13 +21,13 @@ jobs:
        lighthouse: ['', 'lighthouse']
    steps:
      - name: Check out the repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29

      - name: Run E2E deployment and tests
-        uses: submariner-io/shipyard/gh-actions/e2e@release-0.23
+        uses: submariner-io/shipyard/gh-actions/e2e@release-0.16
        with:
          using: ${{ matrix.cable_driver }} ${{ matrix.globalnet }} ${{ matrix.lighthouse }}

      - name: Post mortem
        if: failure()
-        uses: submariner-io/shipyard/gh-actions/post-mortem@release-0.23
+        uses: submariner-io/shipyard/gh-actions/post-mortem@release-0.16
@@ -38,20 +38,20 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29

      - name: Set up Helm
-        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310
+        uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814
        with:
          version: v3.6.0

      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
+        uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d
        with:
-          python-version: '3.13.x'
+          python-version: '3.x'

      - name: Set up helm/chart-testing
-        uses: helm/chart-testing-action@6ec842c01de15ebb84c8627d2744a0c2f2755c9f
+        uses: helm/chart-testing-action@e6669bcd63d7cb57cb4380c33043eebe5d111992

      - name: Set up local helm repo
        run: make local-helm-repo
@@ -64,7 +64,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29
        with:
          fetch-depth: 0
      - name: Run gitlint
@@ -75,7 +75,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29

      - name: Run helm-docs and verify docs are up-to-date
        run: make helm-docs
@@ -85,10 +85,10 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29

      - name: Run markdown-link-check
-        uses: gaurav-nelson/github-action-markdown-link-check@3c3b66f1f7d0900e37b71eca45b63ea9eedfce31
+        uses: gaurav-nelson/github-action-markdown-link-check@d53a906aa6b22b8979d33bc86170567e619495ec
        with:
          config-file: ".markdownlinkcheck.json"
          check-modified-files-only: "yes"
@@ -99,7 +99,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29
      - name: Run markdownlint
        run: make markdownlint

@@ -108,6 +108,6 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29
      - name: Run yamllint
        run: make yamllint
@@ -16,16 +16,16 @@ jobs:
      issues: write
    steps:
      - name: Check out the repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29

      - name: Run markdown-link-check
-        uses: gaurav-nelson/github-action-markdown-link-check@3c3b66f1f7d0900e37b71eca45b63ea9eedfce31
+        uses: gaurav-nelson/github-action-markdown-link-check@d53a906aa6b22b8979d33bc86170567e619495ec
        with:
          config-file: ".markdownlinkcheck.json"

      - name: Raise an Issue to report broken links
        if: ${{ failure() }}
-        uses: peter-evans/create-issue-from-file@fca9117c27cdc29c6c4db3b86c48e4115a786710
+        uses: peter-evans/create-issue-from-file@24452a72d85239eacf1468b0f1982a9f3fec4c94
        with:
          title: Broken link detected by CI
          content-filepath: .github/ISSUE_TEMPLATE/broken-link.md
@@ -4,7 +4,7 @@ name: Release Charts
 on:
  push:
    branches:
-      - release-0.23
+      - release-0.16

 permissions:
  contents: write
@@ -16,7 +16,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29
        with:
          fetch-depth: 0

@@ -1,32 +0,0 @@
---
-name: Stale
-
-on:
-  schedule:
-    - cron: "0 0 * * *"
-
-permissions: {}
-
-jobs:
-  stale:
-    name: Close Stale Issues and PRs
-    if: github.repository_owner == 'submariner-io'
-    runs-on: ubuntu-latest
-    permissions:
-      issues: write
-      pull-requests: write
-    steps:
-      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93
-        with:
-          days-before-issue-stale: 120
-          days-before-pr-stale: 14
-          exempt-issue-labels: 'confirmed,security'
-          exempt-pr-labels: 'confirmed,security'
-          stale-issue-label: 'stale'
-          stale-issue-message: |
-            This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further
-            activity occurs. Thank you for your contributions.
-          stale-pr-label: 'stale'
-          stale-pr-message: |
-            This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further
-            activity occurs. Thank you for your contributions.
@@ -6,10 +6,3 @@ Makefile.dapper
 Makefile.shipyard
 Dockerfile.*
 helm_repo
-yamls/go.mod
-yamls/go.sum
-yamls/vendor
-submariner-k8s-broker/crds/crd.yaml
-submariner-k8s-broker/templates/_role.tpl
-submariner-operator/crds/crd.yaml
-submariner-operator/templates/*-rbac.yaml
@@ -1,4 +1,4 @@
-BASE_BRANCH ?= release-0.23
+BASE_BRANCH ?= release-0.16
 export BASE_BRANCH
 export HELM_REPO_LOCATION=./helm_repo

@@ -17,7 +17,7 @@ endif
 export DEPLOYTOOL = helm
 GH_URL=https://submariner-io.github.io/submariner-charts/charts
 CHARTS_DIR=charts
-CHARTS_VERSION=0.23.2
+CHARTS_VERSION=0.16.7
 HELM_DOCS_VERSION=0.15.0
 REPO_URL=$(shell git config remote.origin.url)

@@ -34,10 +34,7 @@ local-helm-repo: $(CHART_PACKAGES)
 e2e: local-helm-repo
 	$(SCRIPTS_DIR)/e2e.sh

-generate-yamls:
-	./generate-yamls.sh $(BASE_BRANCH)
-
-%.tgz: generate-yamls
+%.tgz:
 	helm dep update $(subst -$(CHARTS_VERSION),,$(basename $(@F)))
 	helm package --version $(CHARTS_VERSION) --app-version $(CHARTS_VERSION) $(subst -$(CHARTS_VERSION),,$(basename $(@F)))

@@ -1,107 +0,0 @@
-#!/bin/bash
-
-set -e
-
-BROKER_ROLE_TPL=submariner-k8s-broker/templates/_role.tpl
-OPERATOR_RBAC_YAML=submariner-operator/templates/operator-rbac.yaml
-GATEWAY_RBAC_YAML=submariner-operator/templates/gateway-rbac.yaml
-ROUTE_AGENT_RBAC_YAML=submariner-operator/templates/routeagent-rbac.yaml
-GLOBALNET_RBAC_YAML=submariner-operator/templates/globalnet-rbac.yaml
-SERVICE_DISC_RBAC_YAML=submariner-operator/templates/service-discovery-rbac.yaml
-OPENSHIFT_MONITORING_YAML=submariner-operator/templates/openshift-monitoring-rbac.yaml
-
-YAMLS_BASE=yamls/vendor
-SUBM_CRDS=${YAMLS_BASE}/github.com/submariner-io/submariner/deploy/crds
-OPERATOR_CRDS=${YAMLS_BASE}/github.com/submariner-io/submariner-operator/deploy/crds
-MCS_CRDS=${YAMLS_BASE}/sigs.k8s.io/mcs-api/config/crd
-BROKER=${YAMLS_BASE}/github.com/submariner-io/submariner-operator/config/broker/broker-client
-RBAC_BASE=${YAMLS_BASE}/github.com/submariner-io/submariner-operator/config/rbac
-OPENSHIFT=${YAMLS_BASE}/github.com/submariner-io/submariner-operator/config/openshift
-
-function add_service_acct_ns() {
-    sed -i '/- kind: ServiceAccount/a \ \ \ \ namespace: {{ .Release.Namespace }}' $1
-}
-
-cd yamls
-rm go.mod || true
-go mod init
-go get github.com/submariner-io/submariner-operator@$1
-go mod tidy
-go mod vendor
-cd ..
-
-# Generate the CRDs for the broker chart
-mkdir -p submariner-k8s-broker/crds
-cat ${SUBM_CRDS}/submariner.io_endpoints.yaml \
-	  ${SUBM_CRDS}/submariner.io_clusters.yaml \
-		${SUBM_CRDS}/submariner.io_gateways.yaml > submariner-k8s-broker/crds/crd.yaml
-echo '---' >> submariner-k8s-broker/crds/crd.yaml
-cat ${MCS_CRDS}/multicluster.x-k8s.io_serviceexports.yaml >> submariner-k8s-broker/crds/crd.yaml
-echo '---' >> submariner-k8s-broker/crds/crd.yaml
-cat ${MCS_CRDS}/multicluster.x-k8s.io_serviceimports.yaml >> submariner-k8s-broker/crds/crd.yaml
-
-# Generate the client role yaml for the broker chart
-echo '{{- define "broker-role" -}}' > ${BROKER_ROLE_TPL}
-cat ${BROKER}/role.yaml >> ${BROKER_ROLE_TPL}
-echo '{{- end -}}' >> ${BROKER_ROLE_TPL}
-sed -i -e 's/name:.*/name: {{ template "submariner-k8s-broker.fullname" \. }}-cluster/' ${BROKER_ROLE_TPL}
-
-# Generate the CRDs for the operator chart
-mkdir -p submariner-operator/crds
-cat ${OPERATOR_CRDS}/submariner.io_submariners.yaml \
-    ${OPERATOR_CRDS}/submariner.io_servicediscoveries.yaml \
-    ${OPERATOR_CRDS}/submariner.io_brokers.yaml > submariner-operator/crds/crd.yaml
-
-# Generate the operator RBAC yaml for the operator chart
-add_service_acct_ns ${RBAC_BASE}/submariner-operator/cluster_role_binding.yaml
-cat ${RBAC_BASE}/submariner-operator/service_account.yaml \
-    ${RBAC_BASE}/submariner-operator/role.yaml \
-    ${RBAC_BASE}/submariner-operator/role_binding.yaml \
-    ${RBAC_BASE}/submariner-operator/cluster_role.yaml \
-    ${RBAC_BASE}/submariner-operator/cluster_role_binding.yaml > ${OPERATOR_RBAC_YAML}
-
-# Generate the gateway RBAC yaml for the operator chart
-add_service_acct_ns ${RBAC_BASE}/submariner-gateway/cluster_role_binding.yaml
-cat ${RBAC_BASE}/submariner-gateway/service_account.yaml \
-    ${RBAC_BASE}/submariner-gateway/role.yaml \
-    ${RBAC_BASE}/submariner-gateway/role_binding.yaml \
-    ${RBAC_BASE}/submariner-gateway/cluster_role.yaml \
-    ${RBAC_BASE}/submariner-gateway/cluster_role_binding.yaml > ${GATEWAY_RBAC_YAML}
-
-# Generate the routeagent RBAC yaml for the operator chart
-add_service_acct_ns ${RBAC_BASE}/submariner-route-agent/cluster_role_binding.yaml
-cat ${RBAC_BASE}/submariner-route-agent/service_account.yaml \
-    ${RBAC_BASE}/submariner-route-agent/role.yaml \
-    ${RBAC_BASE}/submariner-route-agent/role_binding.yaml \
-    ${RBAC_BASE}/submariner-route-agent/cluster_role.yaml \
-    ${RBAC_BASE}/submariner-route-agent/cluster_role_binding.yaml > ${ROUTE_AGENT_RBAC_YAML}
-
-# Generate the globalnet RBAC yaml for the operator chart
-echo '{{- if .Values.broker.globalnet }}' > ${GLOBALNET_RBAC_YAML}
-add_service_acct_ns ${RBAC_BASE}/submariner-globalnet/cluster_role_binding.yaml
-cat ${RBAC_BASE}/submariner-globalnet/service_account.yaml \
-    ${RBAC_BASE}/submariner-globalnet/role.yaml \
-    ${RBAC_BASE}/submariner-globalnet/role_binding.yaml \
-    ${RBAC_BASE}/submariner-globalnet/cluster_role.yaml \
-    ${RBAC_BASE}/submariner-globalnet/cluster_role_binding.yaml >> ${GLOBALNET_RBAC_YAML}
-echo '{{- end -}}' >> ${GLOBALNET_RBAC_YAML}
-
-# Generate the service discovery RBAC yaml for the operator chart
-echo '{{- if .Values.submariner.serviceDiscovery }}' > ${SERVICE_DISC_RBAC_YAML}
-add_service_acct_ns ${RBAC_BASE}/lighthouse-agent/cluster_role_binding.yaml
-add_service_acct_ns ${RBAC_BASE}/lighthouse-coredns/cluster_role_binding.yaml
-cat ${RBAC_BASE}/lighthouse-agent/service_account.yaml \
-    ${RBAC_BASE}/lighthouse-agent/cluster_role.yaml \
-    ${RBAC_BASE}/lighthouse-agent/cluster_role_binding.yaml \
-    ${RBAC_BASE}/lighthouse-agent/role.yaml \
-    ${RBAC_BASE}/lighthouse-agent/role_binding.yaml \
-    ${RBAC_BASE}/lighthouse-coredns/service_account.yaml \
-    ${RBAC_BASE}/lighthouse-coredns/cluster_role.yaml \
-    ${RBAC_BASE}/lighthouse-coredns/cluster_role_binding.yaml \
-    ${RBAC_BASE}/lighthouse-coredns/role.yaml \
-    ${RBAC_BASE}/lighthouse-coredns/role_binding.yaml >> ${SERVICE_DISC_RBAC_YAML}
-echo '{{- end -}}' >> ${SERVICE_DISC_RBAC_YAML}
-
-# Generate the openshift monitoring rbac yaml for the operator chart
-cat ${OPENSHIFT}/rbac/submariner-metrics-reader/role.yaml \
-    ${OPENSHIFT}/rbac/submariner-metrics-reader/role_binding.yaml > ${OPENSHIFT_MONITORING_YAML}
@@ -13,3 +13,12 @@ Submariner Kubernetes Broker
 ## Source Code

 * <https://submariner-io.github.io/submariner-charts/charts>
+
+## Values
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| crd.create | bool | `true` |  |
+| rbac.create | bool | `true` |  |
+| serviceAccounts.client.create | bool | `true` |  |
+| serviceAccounts.client.name | string | `""` |  |
@@ -0,0 +1,560 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: clusters.submariner.io
+spec:
+  group: submariner.io
+  names:
+    kind: Cluster
+    listKind: ClusterList
+    plural: clusters
+    singular: cluster
+  scope: Namespaced
+  versions:
+  - name: v1
+    schema:
+      openAPIV3Schema:
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            properties:
+              cluster_cidr:
+                items:
+                  type: string
+                type: array
+              cluster_id:
+                type: string
+              color_codes:
+                items:
+                  type: string
+                type: array
+              global_cidr:
+                items:
+                  type: string
+                type: array
+              service_cidr:
+                items:
+                  type: string
+                type: array
+            required:
+            - cluster_cidr
+            - cluster_id
+            - color_codes
+            - global_cidr
+            - service_cidr
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: endpoints.submariner.io
+spec:
+  group: submariner.io
+  names:
+    kind: Endpoint
+    listKind: EndpointList
+    plural: endpoints
+    singular: endpoint
+  scope: Namespaced
+  versions:
+  - name: v1
+    schema:
+      openAPIV3Schema:
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            properties:
+              backend:
+                type: string
+              backend_config:
+                additionalProperties:
+                  type: string
+                type: object
+              cable_name:
+                type: string
+              cluster_id:
+                type: string
+              healthCheckIP:
+                type: string
+              hostname:
+                type: string
+              nat_enabled:
+                type: boolean
+              private_ip:
+                type: string
+              public_ip:
+                type: string
+              subnets:
+                items:
+                  type: string
+                type: array
+            required:
+            - backend
+            - cable_name
+            - cluster_id
+            - hostname
+            - nat_enabled
+            - private_ip
+            - public_ip
+            - subnets
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: gateways.submariner.io
+spec:
+  group: submariner.io
+  names:
+    kind: Gateway
+    listKind: GatewayList
+    plural: gateways
+    singular: gateway
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - description: High availability status of the Gateway
+      jsonPath: .status.haStatus
+      name: HA Status
+      type: string
+    name: v1
+    schema:
+      openAPIV3Schema:
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          status:
+            properties:
+              connections:
+                items:
+                  properties:
+                    endpoint:
+                      properties:
+                        backend:
+                          type: string
+                        backend_config:
+                          additionalProperties:
+                            type: string
+                          type: object
+                        cable_name:
+                          type: string
+                        cluster_id:
+                          type: string
+                        healthCheckIP:
+                          type: string
+                        hostname:
+                          type: string
+                        nat_enabled:
+                          type: boolean
+                        private_ip:
+                          type: string
+                        public_ip:
+                          type: string
+                        subnets:
+                          items:
+                            type: string
+                          type: array
+                      required:
+                      - backend
+                      - cable_name
+                      - cluster_id
+                      - hostname
+                      - nat_enabled
+                      - private_ip
+                      - public_ip
+                      - subnets
+                      type: object
+                    latency:
+                      description: LatencySpec describes the round trip time information
+                        in nanoseconds for a packet between the gateway pods of two
+                        clusters.
+                      properties:
+                        averageRTT:
+                          format: int64
+                          type: integer
+                        lastRTT:
+                          description: TODO This shall be deleted once the operator
+                            is using the latest. Using Optional to avoid validation
+                            errors when this field is not used.
+                          format: int64
+                          type: integer
+                        maxRTT:
+                          format: int64
+                          type: integer
+                        minRTT:
+                          format: int64
+                          type: integer
+                        stddevRTT:
+                          format: int64
+                          type: integer
+                      type: object
+                    latencyRTT:
+                      description: LatencySpec describes the round trip time information
+                        for a packet between the gateway pods of two clusters.
+                      properties:
+                        average:
+                          type: string
+                        last:
+                          type: string
+                        max:
+                          type: string
+                        min:
+                          type: string
+                        stdDev:
+                          type: string
+                      type: object
+                    status:
+                      type: string
+                    statusMessage:
+                      type: string
+                  required:
+                  - endpoint
+                  - status
+                  - statusMessage
+                  type: object
+                type: array
+              haStatus:
+                type: string
+              localEndpoint:
+                properties:
+                  backend:
+                    type: string
+                  backend_config:
+                    additionalProperties:
+                      type: string
+                    type: object
+                  cable_name:
+                    type: string
+                  cluster_id:
+                    type: string
+                  healthCheckIP:
+                    type: string
+                  hostname:
+                    type: string
+                  nat_enabled:
+                    type: boolean
+                  private_ip:
+                    type: string
+                  public_ip:
+                    type: string
+                  subnets:
+                    items:
+                      type: string
+                    type: array
+                required:
+                - backend
+                - cable_name
+                - cluster_id
+                - hostname
+                - nat_enabled
+                - private_ip
+                - public_ip
+                - subnets
+                type: object
+              statusFailure:
+                type: string
+              version:
+                type: string
+            required:
+            - connections
+            - haStatus
+            - localEndpoint
+            - statusFailure
+            - version
+            type: object
+        required:
+        - status
+        type: object
+    served: true
+    storage: true
+    subresources: {}
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: serviceexports.multicluster.x-k8s.io
+spec:
+  group: multicluster.x-k8s.io
+  scope: Namespaced
+  names:
+    plural: serviceexports
+    singular: serviceexport
+    kind: ServiceExport
+    shortNames:
+      - svcex
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      additionalPrinterColumns:
+        - name: Age
+          type: date
+          jsonPath: .metadata.creationTimestamp
+      "schema":
+        "openAPIV3Schema":
+          description: ServiceExport declares that the Service with the same name and
+            namespace as this export should be consumable from other clusters.
+          type: object
+          properties:
+            apiVersion:
+              description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+              type: string
+            kind:
+              description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+              type: string
+            metadata:
+              type: object
+            status:
+              description: status describes the current state of an exported service.
+                Service configuration comes from the Service that had the same name
+                and namespace as this ServiceExport. Populated by the multi-cluster
+                service implementation's controller.
+              type: object
+              properties:
+                conditions:
+                  type: array
+                  items:
+                    description: "ServiceExportCondition contains details for the current
+                    condition of this service export. \n Once [KEP-1623](https://github.com/kubernetes/enhancements/tree/master/keps/sig-api-machinery/1623-standardize-conditions)
+                    is implemented, this will be replaced by metav1.Condition."
+                    type: object
+                    required:
+                      - status
+                      - type
+                    properties:
+                      lastTransitionTime:
+                        type: string
+                        format: date-time
+                      message:
+                        type: string
+                      reason:
+                        type: string
+                      status:
+                        description: Status is one of {"True", "False", "Unknown"}
+                        type: string
+                        enum:
+                          - "True"
+                          - "False"
+                          - Unknown
+                      type:
+                        description: ServiceExportConditionType identifies a specific
+                          condition.
+                        type: string
+                  x-kubernetes-list-map-keys:
+                    - type
+                  x-kubernetes-list-type: map
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: serviceimports.multicluster.x-k8s.io
+spec:
+  group: multicluster.x-k8s.io
+  scope: Namespaced
+  names:
+    plural: serviceimports
+    singular: serviceimport
+    kind: ServiceImport
+    shortNames:
+      - svcim
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      additionalPrinterColumns:
+        - name: Type
+          type: string
+          description: The type of this ServiceImport
+          jsonPath: .spec.type
+        - name: IP
+          type: string
+          description: The VIP for this ServiceImport
+          jsonPath: .spec.ips
+        - name: Age
+          type: date
+          jsonPath: .metadata.creationTimestamp
+      "schema":
+        "openAPIV3Schema":
+          description: ServiceImport describes a service imported from clusters in a
+            ClusterSet.
+          type: object
+          properties:
+            apiVersion:
+              description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+              type: string
+            kind:
+              description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: spec defines the behavior of a ServiceImport.
+              type: object
+              required:
+                - ports
+                - type
+              properties:
+                ips:
+                  description: ip will be used as the VIP for this service when type
+                    is ClusterSetIP.
+                  type: array
+                  maxItems: 1
+                  items:
+                    type: string
+                ports:
+                  type: array
+                  items:
+                    description: ServicePort represents the port on which the service
+                      is exposed
+                    type: object
+                    required:
+                      - port
+                    properties:
+                      appProtocol:
+                        description: The application protocol for this port. This field
+                          follows standard Kubernetes label syntax. Un-prefixed names
+                          are reserved for IANA standard service names (as per RFC-6335
+                          and http://www.iana.org/assignments/service-names). Non-standard
+                          protocols should use prefixed names such as mycompany.com/my-custom-protocol.
+                          Field can be enabled with ServiceAppProtocol feature gate.
+                        type: string
+                      name:
+                        description: The name of this port within the service. This
+                          must be a DNS_LABEL. All ports within a ServiceSpec must have
+                          unique names. When considering the endpoints for a Service,
+                          this must match the 'name' field in the EndpointPort. Optional
+                          if only one ServicePort is defined on this service.
+                        type: string
+                      port:
+                        description: The port that will be exposed by this service.
+                        type: integer
+                        format: int32
+                      protocol:
+                        description: The IP protocol for this port. Supports "TCP",
+                          "UDP", and "SCTP". Default is TCP.
+                        type: string
+                  x-kubernetes-list-type: atomic
+                sessionAffinity:
+                  description: 'Supports "ClientIP" and "None". Used to maintain session
+                  affinity. Enable client IP based session affinity. Must be ClientIP
+                  or None. Defaults to None. Ignored when type is Headless More info:
+                  https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies'
+                  type: string
+                sessionAffinityConfig:
+                  description: sessionAffinityConfig contains session affinity configuration.
+                  type: object
+                  properties:
+                    clientIP:
+                      description: clientIP contains the configurations of Client IP
+                        based session affinity.
+                      type: object
+                      properties:
+                        timeoutSeconds:
+                          description: timeoutSeconds specifies the seconds of ClientIP
+                            type session sticky time. The value must be >0 && <=86400(for
+                            1 day) if ServiceAffinity == "ClientIP". Default value is
+                            10800(for 3 hours).
+                          type: integer
+                          format: int32
+                type:
+                  description: type defines the type of this service. Must be ClusterSetIP
+                    or Headless.
+                  type: string
+                  enum:
+                    - ClusterSetIP
+                    - Headless
+            status:
+              description: status contains information about the exported services that
+                form the multi-cluster service referenced by this ServiceImport.
+              type: object
+              properties:
+                clusters:
+                  description: clusters is the list of exporting clusters from which
+                    this service was derived.
+                  type: array
+                  items:
+                    description: ClusterStatus contains service configuration mapped
+                      to a specific source cluster
+                    type: object
+                    required:
+                      - cluster
+                    properties:
+                      cluster:
+                        description: cluster is the name of the exporting cluster. Must
+                          be a valid RFC-1123 DNS label.
+                        type: string
+                  x-kubernetes-list-map-keys:
+                    - cluster
+                  x-kubernetes-list-type: map
@@ -35,5 +35,9 @@ Create chart name and version as used by the chart label.
 Create the name of the submariner-client service account to use
 */}}
 {{- define "submariner-k8s-broker.clientServiceAccountName" -}}
-{{- printf "%s-client" (include "submariner-k8s-broker.fullname" .)}}
+{{- if .Values.serviceAccounts.client.create -}}
+    {{ default (printf "%s-client" (include "submariner-k8s-broker.fullname" .)) .Values.serviceAccounts.client.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccounts.client.name }}
+{{- end -}}
 {{- end -}}
@@ -1,4 +1,26 @@
-{{ include "broker-role" $ }}
+{{- if .Values.rbac.create -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ template "submariner-k8s-broker.fullname" . }}-cluster
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner-k8s-broker.chart" . }}
+    app: {{ template "submariner-k8s-broker.name" . }}
+rules:
+- apiGroups: ["submariner.io"]
+  resources: ["clusters", "endpoints"]
+  verbs: ["create", "get", "list", "watch", "patch", "update", "delete"]
+- apiGroups: ["lighthouse.submariner.io"]
+  resources: ["*"]
+  verbs: ["create", "get", "list", "watch", "patch", "update", "delete"]
+- apiGroups: ["discovery.k8s.io"]
+  resources: ["endpointslices", "endpointslices/restricted"]
+  verbs: ["create", "get", "list", "watch","patch", "update", "delete"]
+- apiGroups: ["multicluster.x-k8s.io"]
+  resources: ["*"]
+  verbs: ["create", "get", "list", "watch", "update", "delete"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -12,3 +34,4 @@ subjects:
 - kind: ServiceAccount
  name: {{ template "submariner-k8s-broker.clientServiceAccountName" . }}
  namespace: {{ .Release.Namespace }}
+{{- end -}}
@@ -1,3 +1,4 @@
+{{- if .Values.serviceAccounts.client.create }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
@@ -15,3 +16,4 @@ metadata:
  annotations:
    kubernetes.io/service-account.name: {{ template "submariner-k8s-broker.clientServiceAccountName" . }}
 type: kubernetes.io/service-account-token
+{{- end }}
@@ -1 +1,9 @@
 ---
+rbac:
+  create: true
+crd:
+  create: true
+serviceAccounts:
+  client:
+    create: true
+    name: ""
@@ -28,7 +28,6 @@ Submariner enables direct networking between Pods and Services in different Kube
 | ipsec.forceUDPEncaps | bool | `false` |  |
 | ipsec.ikePort | int | `500` |  |
 | ipsec.natPort | int | `4500` |  |
-| ipsec.pskSecret | string | `""` | Name of the Kubernetes Secret containing the IPsec PSK as field psk |
 | ipsec.psk | string | `""` |  |
 | leadership.leaseDuration | int | `10` |  |
 | leadership.renewDeadline | int | `5` |  |
@@ -39,6 +38,19 @@ Submariner enables direct networking between Pods and Services in different Kube
 | operator.image.tag | string | `"0.14.0"` |  |
 | operator.resources | object | `{}` |  |
 | operator.tolerations | list | `[]` |  |
+| rbac.create | bool | `true` |  |
+| serviceAccounts.gateway.create | bool | `true` |  |
+| serviceAccounts.gateway.name | string | `""` |  |
+| serviceAccounts.globalnet.create | bool | `true` |  |
+| serviceAccounts.globalnet.name | string | `""` |  |
+| serviceAccounts.lighthouseAgent.create | bool | `true` |  |
+| serviceAccounts.lighthouseAgent.name | string | `""` |  |
+| serviceAccounts.lighthouseCoreDns.create | bool | `true` |  |
+| serviceAccounts.lighthouseCoreDns.name | string | `""` |  |
+| serviceAccounts.operator.create | bool | `true` |  |
+| serviceAccounts.operator.name | string | `""` |  |
+| serviceAccounts.routeAgent.create | bool | `true` |  |
+| serviceAccounts.routeAgent.name | string | `""` |  |
 | submariner.cableDriver | string | `"libreswan"` |  |
 | submariner.clusterCidr | string | `""` |  |
 | submariner.clusterId | string | `""` |  |
@@ -46,13 +58,10 @@ Submariner enables direct networking between Pods and Services in different Kube
 | submariner.coreDNSCustomConfig | object | `{}` |  |
 | submariner.debug | bool | `false` |  |
 | submariner.globalCidr | string | `""` |  |
-| submariner.clustersetIpCidr | string | `""` |  |
-| submariner.clustersetIpEnabled | bool | `false` |  |
 | submariner.healthcheckEnabled | bool | `true` |  |
 | submariner.images.repository | string | `"quay.io/submariner"` |  |
 | submariner.images.tag | string | `"0.14.0"` |  |
 | submariner.natEnabled | bool | `false` |  |
 | submariner.serviceCidr | string | `""` |  |
-| submariner.brokerK8sSecret | string | `""` |  Name of the Kubernetes Secret containing broker credentials (ca.crt, token). |
 | submariner.serviceDiscovery | bool | `true` |  |
 | submariner.token | string | `""` |  |
@@ -1,4 +1,11 @@
 {{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "submariner.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
 {{/*
 Create a default fully qualified app name.
 We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
@@ -24,3 +31,75 @@ Create chart name and version as used by the chart label.
 {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
 {{- end -}}

+{{/*
+Create the name of the submariner-operator service account to use
+*/}}
+{{- define "submariner.operatorServiceAccountName" -}}
+{{- if .Values.serviceAccounts.operator.create -}}
+    {{ default (printf "%s" (include "submariner.fullname" .)) .Values.serviceAccounts.operator.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccounts.operator.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create the name of the submariner-gateway service account to use
+*/}}
+{{- define "submariner.gatewayServiceAccountName" -}}
+{{- if .Values.serviceAccounts.gateway.create -}}
+    {{ default "submariner-gateway" .Values.serviceAccounts.gateway.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccounts.gateway.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create the name of the submariner-route-agent service account to use
+*/}}
+{{- define "submariner.routeAgentServiceAccountName" -}}
+{{- if .Values.serviceAccounts.routeAgent.create -}}
+    {{ default "submariner-routeagent" .Values.serviceAccounts.routeAgent.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccounts.routeAgent.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create the name of the submariner-globalnet service account to use
+*/}}
+{{- define "submariner.globalnetServiceAccountName" -}}
+{{- if .Values.serviceAccounts.globalnet.create -}}
+    {{ default "submariner-globalnet" .Values.serviceAccounts.globalnet.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccounts.globalnet.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create the name of the submariner-lighthouse-agent service account to use
+*/}}
+{{- define "submariner.lighthouseAgentServiceAccountName" -}}
+{{- if and (.Values.submariner.serviceDiscovery ) (.Values.serviceAccounts.lighthouseAgent.create) -}}
+    {{ default "submariner-lighthouse-agent" .Values.serviceAccounts.lighthouseAgent.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccounts.lighthouseAgent.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create the name of the submariner-lighthouse-coredns service account to use
+*/}}
+{{- define "submariner.lighthouseCoreDnsServiceAccountName" -}}
+{{- if and (.Values.submariner.serviceDiscovery ) (.Values.serviceAccounts.lighthouseCoreDns.create) -}}
+    {{ default "submariner-lighthouse-coredns" .Values.serviceAccounts.lighthouseCoreDns.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccounts.lighthouseCoreDns.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create the name of the submariner-lighthouse-coredns service name to use
+*/}}
+{{- define "submariner.lighthouseDnsName" -}}
+{{- default (printf "%s-lighthouse-coredns" (include "submariner.fullname" .)) .Values.lighthouseCoredns.name }}
+{{- end -}}
@@ -6,6 +6,7 @@ metadata:
    release: {{ .Release.Name | quote }}
    chart: {{ template "submariner.chart" . }}
    app: {{ template "submariner.fullname" . }}
+    component: gateway
  name: {{ template "submariner.fullname" . }}
 spec:
  progressDeadlineSeconds: 600
@@ -26,8 +27,8 @@ spec:
        name: {{ template "submariner.fullname" . }}
    spec:
      containers:
-      - args:
-        - --leader-elect
+      - command:
+        - submariner-operator
        env:
        - name: WATCH_NAMESPACE
          valueFrom:
@@ -51,5 +52,6 @@ spec:
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext: {}
-      serviceAccountName: submariner-operator
+      serviceAccount: {{ template "submariner.fullname" . }}
+      serviceAccountName: {{ template "submariner.fullname" . }}
      terminationGracePeriodSeconds: 30
@@ -0,0 +1,746 @@
+{{- if .Values.rbac.create -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ template "submariner.fullname" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      # For metrics
+      - services
+    verbs:
+      - get
+      - create
+      - update
+  - apiGroups:
+      - ""
+    resources:
+      # For syncing Secrets from the broker
+      - secrets
+    verbs:
+      - get
+      - create
+      - update
+      - delete
+  - apiGroups:
+      - ""
+    resources:
+      # Temporarily needed for network-plugin syncer removal
+      - serviceaccounts
+    resourceNames:
+      - submariner-networkplugin-syncer
+    verbs:
+      - delete
+  - apiGroups:
+      - apps
+    resources:
+      - deployments
+      - daemonsets
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+  - apiGroups:
+      - monitoring.coreos.com
+    resources:
+      # Needed for openshift monitoring
+      - servicemonitors
+    verbs:
+      - get
+      - create
+  - apiGroups:
+      - apps
+    resourceNames:
+      - {{ template "submariner.fullname" . }}
+    resources:
+      - deployments/finalizers
+    verbs:
+      - update
+  - apiGroups:
+      - submariner.io
+    resources:
+      - brokers
+      - brokers/status
+      - submariners
+      - submariners/status
+      - servicediscoveries
+      - servicediscoveries/status
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - delete
+  - apiGroups:
+      - submariner.io
+    resources:
+      - gateways
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - submariner.io
+    resources:
+      - submariners/finalizers
+      - servicediscoveries/finalizers
+    verbs:
+      - update
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ template "submariner.fullname" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+subjects:
+- kind: ServiceAccount
+  name: {{ template "submariner.operatorServiceAccountName" . }}
+roleRef:
+  kind: Role
+  name: {{ template "submariner.fullname" . }}
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ template "submariner.fullname" . }}:gateway
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - get
+      - update
+      - patch
+  - apiGroups:
+      - submariner.io
+    resources:
+      - clusters
+      - endpoints
+      - gateways
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - delete
+  - apiGroups:
+      - coordination.k8s.io
+    resources:
+      - leases
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - delete
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:gateway
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "submariner.fullname" . }}:gateway
+subjects:
+- kind: ServiceAccount
+  name: {{ template "submariner.gatewayServiceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ template "submariner.fullname" . }}:routeagent
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+rules:
+  - apiGroups:
+      - submariner.io
+    resources:
+      - endpoints
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - submariner.io
+    resources:
+      - gatewayroutes
+      - nongatewayroutes
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - delete
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:routeagent
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "submariner.fullname" . }}:routeagent
+subjects:
+- kind: ServiceAccount
+  name: {{ template "submariner.routeAgentServiceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+---
+{{- if .Values.broker.globalnet }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ template "submariner.fullname" . }}:globalnet
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+rules:
+  - apiGroups:
+      - coordination.k8s.io
+    resources:
+      - leases
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - delete
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:globalnet
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "submariner.fullname" . }}:globalnet
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "submariner.globalnetServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+---
+{{- end -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "submariner.fullname" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+rules:
+  # submariner-operator updates the config map of core-dns to forward requests to
+  # clusterset.local to Lighthouse DNS, also looks at existing configmaps
+  # to figure out network settings
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions
+    verbs:
+      - get
+      - list
+      - create
+      - update
+      - delete
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      # Needed for network settings discovery
+      - pods
+      - services
+      - nodes
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - operator.openshift.io
+    resources:
+      - dnses
+    verbs:
+      - get
+      - update
+  - apiGroups:
+      - config.openshift.io
+    resources:
+      # Needed for network settings discovery
+      - networks
+    resourceNames:
+      - cluster
+    verbs:
+      - get
+  - apiGroups:
+      - monitoring.coreos.com
+    resources:
+      # Needed for openshift monitoring
+      - servicemonitors
+    verbs:
+      - get
+      - create
+  - apiGroups:
+      - apps
+    resources:
+      # Needed for Flannel CNI discovery
+      - daemonsets
+    verbs:
+      - list
+  - apiGroups:
+      - rbac.authorization.k8s.io
+    resources:
+      # Temporarily needed for network-plugin syncer removal
+      - clusterroles
+      - clusterrolebindings
+    resourceNames:
+      - ocp-submariner-networkplugin-syncer
+      - submariner-networkplugin-syncer
+    verbs:
+      - delete
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "submariner.operatorServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "submariner.fullname" . }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: submariner-metrics-reader
+  namespace: {{ .Release.Namespace }}
+rules:
+  - apiGroups: [""]
+    resources: ["pods", "services", "endpoints"]
+    verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: read-submariner-metrics
+subjects:
+  - kind: ServiceAccount
+    name: prometheus-k8s
+    namespace: openshift-monitoring
+roleRef:
+  kind: Role
+  name: submariner-metrics-reader
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "submariner.fullname" . }}:gateway
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+    verbs:
+      - get
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+      - services
+      - nodes
+    verbs:
+      - get
+      - list
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:gateway
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "submariner.fullname" . }}:gateway
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "submariner.gatewayServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "submariner.fullname" . }}:routeagent
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+      - services
+      - secrets
+      - configmaps
+      - endpoints
+    verbs:
+      - get
+      - list
+  - apiGroups:
+      - config.openshift.io
+    resources:
+      - networks
+    resourceNames:
+      - cluster
+    verbs:
+      - get
+  - apiGroups:
+      - ""
+    resources:
+      - nodes
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - projectcalico.org
+    resources:
+      - ippools
+    verbs:
+      - get
+      - create
+      - delete
+      - update
+      - deletecollection
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:routeagent
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "submariner.fullname" . }}:routeagent
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "submariner.routeAgentServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+---
+{{- if .Values.broker.globalnet }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "submariner.fullname" . }}:globalnet
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - nodes
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - services
+      - endpoints
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - delete
+  - apiGroups:
+      - submariner.io
+    resources:
+      - clusters
+      - endpoints
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - submariner.io
+    resources:
+      - clusterglobalegressips
+      - clusterglobalegressips/status
+      - globalegressips
+      - globalegressips/status
+      - globalingressips
+      - globalingressips/status
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - delete
+      - deletecollection
+  - apiGroups:
+      - multicluster.x-k8s.io
+    resources:
+      - serviceexports
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - network.openshift.io
+    resources:
+      - service/externalips
+    verbs:
+      - create
+      - get
+      - list
+      - delete
+---
+{{- end -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:globalnet
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "submariner.fullname" . }}:globalnet
+subjects:
+- kind: ServiceAccount
+  name: {{ template "submariner.globalnetServiceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+---
+{{- if .Values.submariner.serviceDiscovery }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "submariner.fullname" . }}:lighthouse-agent
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - services
+      - namespaces
+      - endpoints
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - discovery.k8s.io
+    resources:
+      - endpointslices
+      - endpointslices/restricted
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - delete
+      - deletecollection
+  - apiGroups:
+      - submariner.io
+    resources:
+      - gateways
+      - globalingressips
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - multicluster.x-k8s.io
+    resources:
+      - serviceimports
+      - serviceimports/status
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - delete
+  - apiGroups:
+      - multicluster.x-k8s.io
+    resources:
+      - serviceexports
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - multicluster.x-k8s.io
+    resources:
+      - serviceexports/status
+    verbs:
+      - update
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:lighthouse-agent
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "submariner.fullname" . }}:lighthouse-agent
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "submariner.lighthouseAgentServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "submariner.fullname" . }}:lighthouse-coredns
+rules:
+  - apiGroups:
+      - discovery.k8s.io
+    resources:
+      - endpointslices
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - submariner.io
+    resources:
+      - gateways
+      - submariners
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - multicluster.x-k8s.io
+    resources:
+      - serviceimports
+    verbs:
+      - get
+      - list
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:lighthouse-coredns
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "submariner.fullname" . }}:lighthouse-coredns
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end -}}
+{{- end -}}
@@ -6,23 +6,15 @@ metadata:
 spec:
  broker: k8s
  brokerK8sApiServer: {{ .Values.broker.server }}
-  {{- if .Values.submariner.brokerK8sSecret }}
-  brokerK8sSecret: {{ .Values.submariner.brokerK8sSecret }}
-  {{- else }}
  brokerK8sApiServerToken: {{ .Values.broker.token }}
  brokerK8sCA: {{ .Values.broker.ca }}
-  {{- end }}
  brokerK8sRemoteNamespace: {{ .Values.broker.namespace }}
  brokerK8sInsecure: {{ .Values.broker.insecure }}
  ceIPSecDebug: {{ .Values.ipsec.debug }}
  ceIPSecForceUDPEncaps: {{ .Values.ipsec.forceUDPEncaps }}
  ceIPSecIKEPort: {{ .Values.ipsec.ikePort }}
  ceIPSecNATTPort: {{ .Values.ipsec.natPort }}
-  {{- if .Values.ipsec.pskSecret }}
-  ceIPSecPSKSecret: {{ .Values.ipsec.pskSecret }}
-  {{- else }}
  ceIPSecPSK: {{ .Values.ipsec.psk }}
-  {{- end }}
  clusterCIDR: "{{ .Values.submariner.clusterCidr }}"
  clusterID: {{ .Values.submariner.clusterId }}
  colorCodes: {{ .Values.submariner.colorCodes }}
@@ -60,8 +52,6 @@ spec:
 {{- end }}
  serviceCIDR: "{{ .Values.submariner.serviceCidr }}"
  globalCIDR: "{{ .Values.submariner.globalCidr }}"
-  clustersetIPCIDR: "{{ .Values.submariner.clustersetIpCidr }}"
-  clustersetIPEnabled: {{ .Values.submariner.clustersetIpEnabled }}
  serviceDiscoveryEnabled: {{ .Values.submariner.serviceDiscovery }}
  cableDriver: {{ .Values.submariner.cableDriver }}
  connectionHealthCheck:
@@ -0,0 +1,119 @@
+{{- if .Values.serviceAccounts.operator.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "submariner.operatorServiceAccountName" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ template "submariner.operatorServiceAccountName" . }}-token
+  annotations:
+    kubernetes.io/service-account.name: {{ template "submariner.operatorServiceAccountName" . }}
+type: kubernetes.io/service-account-token
+{{- end }}
+---
+{{- if .Values.serviceAccounts.gateway.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "submariner.gatewayServiceAccountName" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ template "submariner.gatewayServiceAccountName" . }}-token
+  annotations:
+    kubernetes.io/service-account.name: {{ template "submariner.gatewayServiceAccountName" . }}
+type: kubernetes.io/service-account-token
+{{- end }}
+---
+{{- if .Values.serviceAccounts.routeAgent.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "submariner.routeAgentServiceAccountName" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ template "submariner.routeAgentServiceAccountName" . }}-token
+  annotations:
+    kubernetes.io/service-account.name: {{ template "submariner.routeAgentServiceAccountName" . }}
+type: kubernetes.io/service-account-token
+{{- end }}
+---
+{{- if .Values.serviceAccounts.globalnet.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "submariner.globalnetServiceAccountName" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ template "submariner.globalnetServiceAccountName" . }}-token
+  annotations:
+    kubernetes.io/service-account.name: {{ template "submariner.globalnetServiceAccountName" . }}
+type: kubernetes.io/service-account-token
+{{- end }}
+---
+{{- if .Values.serviceAccounts.lighthouseAgent.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "submariner.lighthouseAgentServiceAccountName" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ template "submariner.lighthouseAgentServiceAccountName" . }}-token
+  annotations:
+    kubernetes.io/service-account.name: {{ template "submariner.lighthouseAgentServiceAccountName" . }}
+type: kubernetes.io/service-account-token
+{{- end }}
+---
+  {{- if .Values.serviceAccounts.lighthouseCoreDns.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }}-token
+  annotations:
+    kubernetes.io/service-account.name: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }}
+type: kubernetes.io/service-account-token
+  {{- end }}
@@ -5,9 +5,6 @@ submariner:
  clusterCidr: ""
  serviceCidr: ""
  globalCidr: ""
-  clustersetIpCidr: ""
-  clustersetIpEnabled: false
-  brokerK8sSecret: ""
  loadBalancerEnabled: false
  natEnabled: false
  colorCodes: blue
@@ -26,10 +23,11 @@ broker:
  insecure: false
  ca: ""
  globalnet: false
+rbac:
+  create: true
 images: {}
 ipsec:
  psk: ""
-  pskSecret: ""
  debug: false
  forceUDPEncaps: false
  ikePort: 500
@@ -46,3 +44,22 @@ operator:
  resources: {}
  tolerations: []
  affinity: {}
+serviceAccounts:
+  operator:
+    create: true
+    name: ""
+  gateway:
+    create: true
+    name: ""
+  routeAgent:
+    create: true
+    name: ""
+  globalnet:
+    create: true
+    name: ""
+  lighthouseAgent:
+    create: true
+    name: ""
+  lighthouseCoreDns:
+    create: true
+    name: ""
@@ -1,38 +0,0 @@
-//go:build yamls
-
-/*
-SPDX-License-Identifier: Apache-2.0
-
-Copyright Contributors to the Submariner project.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-// Place any runtime dependencies as imports in this file.
-// Go modules will be forced to download and install them.
-
-package yamls
-
-import (
-	_ "github.com/submariner-io/submariner-operator/config/broker/broker-client"
-	_ "github.com/submariner-io/submariner-operator/config/openshift/rbac/submariner-metrics-reader"
-	_ "github.com/submariner-io/submariner-operator/config/rbac/submariner-gateway"
-	_ "github.com/submariner-io/submariner-operator/config/rbac/submariner-globalnet"
-	_ "github.com/submariner-io/submariner-operator/config/rbac/submariner-operator"
-	_ "github.com/submariner-io/submariner-operator/config/rbac/submariner-route-agent"
-	_ "github.com/submariner-io/submariner-operator/config/rbac/lighthouse-agent"
-	_ "github.com/submariner-io/submariner-operator/config/rbac/lighthouse-coredns"
-	_ "github.com/submariner-io/submariner-operator/deploy/crds"
-	_ "github.com/submariner-io/submariner/deploy/crds"
-	_ "sigs.k8s.io/mcs-api/config/crd"
-)
Author	SHA1	Message	Date
Automated ReleaseandSubmariner Bot	19b9c6fdb9	Update Submariner dependencies to v0.16.7 Signed-off-by: Automated Release <release@submariner.io>	2024-06-17 20:50:41 +03:00
dependabot[bot]andThomas Pantelis	8aec65ef6d	Bump actions/checkout from 4.1.4 to 4.1.6 in the github-actions group Bumps the github-actions group with 1 update: [actions/checkout](https://github.com/actions/checkout). Updates `actions/checkout` from 4.1.4 to 4.1.6 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/0ad4b8fadaa221de15dcec353f45205ec38ea70b...a5ac7e51b41094c92402da3b24376905380afc29) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>	2024-06-03 07:14:52 -04:00
Automated ReleaseandSubmariner Bot	46e3c825dd	Update Submariner dependencies to v0.16.6 Signed-off-by: Automated Release <release@submariner.io>	2024-05-31 17:22:16 +03:00
Automated ReleaseandSubmariner Bot	73c7b18c8a	Update Submariner dependencies to v0.16.5 Signed-off-by: Automated Release <release@submariner.io>	2024-05-23 12:39:11 +03:00
Tom PantelisandStephen Kitt	9339e9ddfa	Add RBAC access to finalizers for the operator role On Openshift, the operator failed with error "\"submariner-gateway\" is forbidden: cannot set blockOwnerDeletion if an ownerReference refers to a resource you can't set finalizers on" Openshift enables OwnerReferencesPermissionEnforcement, so in order to set blockOwnerDeletion for an object, the user needs update permission for the finalizers subresource of the referenced owner. In this case the owner is the Submariner object. Signed-off-by: Tom Pantelis <tompantelis@gmail.com>	2024-05-21 18:55:53 +02:00
Automated ReleaseandSubmariner Bot	5b9fcba3d2	Update Submariner dependencies to v0.16.4 Signed-off-by: Automated Release <release@submariner.io>	2024-05-10 04:35:13 +03:00
Tom PantelisandDaniel Farrell	4a2c0c768d	Restore CRUD Secret RBAC permissons for the operator Role Signed-off-by: Tom Pantelis <tompantelis@gmail.com>	2024-05-07 10:48:21 -04:00
Tom PantelisandDaniel Farrell	74971acb09	Reduce lighthouse-agent RBAC permissions Signed-off-by: Tom Pantelis <tompantelis@gmail.com>	2024-05-07 10:48:21 -04:00
Tom PantelisandDaniel Farrell	327a1facee	Reduce lighthouse-coredns RBAC permissions Signed-off-by: Tom Pantelis <tompantelis@gmail.com>	2024-05-07 10:48:21 -04:00
Tom PantelisandDaniel Farrell	3ac5263b93	Reduce submariner-globalnet RBAC permissions Signed-off-by: Tom Pantelis <tompantelis@gmail.com>	2024-05-07 10:48:21 -04:00
Tom PantelisandDaniel Farrell	4742d0cd22	Reduce submariner-routeagent RBAC permissions Signed-off-by: Tom Pantelis <tompantelis@gmail.com>	2024-05-07 10:48:21 -04:00
Tom PantelisandDaniel Farrell	ef40580957	Reduce submariner-gateway RBAC permissions Signed-off-by: Tom Pantelis <tompantelis@gmail.com>	2024-05-07 10:48:21 -04:00
Tom PantelisandDaniel Farrell	3893b45d4b	Reduce submariner-operator RBAC permissions Signed-off-by: Tom Pantelis <tompantelis@gmail.com>	2024-05-07 10:48:21 -04:00
Tom PantelisandDaniel Farrell	d05a0d671a	Add Makefile.shipyard to .gitignore Signed-off-by: Tom Pantelis <tompantelis@gmail.com>	2024-05-07 10:48:21 -04:00
dependabot[bot]andThomas Pantelis	d2756efa70	Bump the github-actions group with 2 updates Bumps the github-actions group with 2 updates: [actions/checkout](https://github.com/actions/checkout) and [azure/setup-helm](https://github.com/azure/setup-helm). Updates `actions/checkout` from 4.1.2 to 4.1.4 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/9bb56186c3b09b4f86b1c65136769dd318469633...0ad4b8fadaa221de15dcec353f45205ec38ea70b) Updates `azure/setup-helm` from 3.5 to 4 - [Release notes](https://github.com/azure/setup-helm/releases) - [Changelog](https://github.com/Azure/setup-helm/blob/main/CHANGELOG.md) - [Commits](https://github.com/azure/setup-helm/compare/5119fcb9089d432beecbf79bb2c7915207344b78...fe7b79cd5ee1e45176fcad797de68ecaf3ca4814) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: azure/setup-helm dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>	2024-05-01 07:58:02 -04:00
dependabot[bot]andThomas Pantelis	c57fc7eff8	Bump the github-actions group with 2 updates Bumps the github-actions group with 2 updates: [actions/checkout](https://github.com/actions/checkout) and [actions/setup-python](https://github.com/actions/setup-python). Updates `actions/checkout` from 4.1.1 to 4.1.2 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/b4ffde65f46336ab88eb53be808477a3936bae11...9bb56186c3b09b4f86b1c65136769dd318469633) Updates `actions/setup-python` from 5.0.0 to 5.1.0 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/0a5c61591373683505ea898e09a3ea4f39ef2b9c...82c7e631bb3cdc910f68e0081d67478d79c6982d) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/setup-python dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>	2024-04-02 11:08:01 -04:00
dependabot[bot]andThomas Pantelis	970fa4515a	Bump the github-actions group with 1 update Bumps the github-actions group with 1 update: [tim-actions/get-pr-commits](https://github.com/tim-actions/get-pr-commits). Updates `tim-actions/get-pr-commits` from 1.3.0 to 1.3.1 - [Release notes](https://github.com/tim-actions/get-pr-commits/releases) - [Commits](https://github.com/tim-actions/get-pr-commits/compare/3efc1387ead42029a0d488ab98f24b7452dc3cde...198af03565609bb4ed924d1260247b4881f09e7d) --- updated-dependencies: - dependency-name: tim-actions/get-pr-commits dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>	2024-03-04 10:56:55 -05:00
Daniel FarrellandThomas Pantelis	222123a42b	Add committers to Makefile To allow more folks to help make releases. Relates-to: submariner-io/submariner#2900 Signed-off-by: Daniel Farrell <dfarrell@redhat.com> (cherry picked from commit `e416a2d206`)	2024-02-09 10:19:52 -05:00
Stephen KittandThomas Pantelis	d489a61bdb	Add vthapar as code owner Signed-off-by: Stephen Kitt <skitt@redhat.com> (cherry picked from commit `7685e7ae06`)	2024-02-09 10:19:52 -05:00
dependabot[bot]andThomas Pantelis	3533fd8997	Bump the github-actions group with 1 update Bumps the github-actions group with 1 update: [peter-evans/create-issue-from-file](https://github.com/peter-evans/create-issue-from-file). Updates `peter-evans/create-issue-from-file` from 4.0.1 to 5.0.0 - [Release notes](https://github.com/peter-evans/create-issue-from-file/releases) - [Commits](https://github.com/peter-evans/create-issue-from-file/compare/433e51abf769039ee20ba1293a088ca19d573b7f...24452a72d85239eacf1468b0f1982a9f3fec4c94) --- updated-dependencies: - dependency-name: peter-evans/create-issue-from-file dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>	2024-02-01 10:30:50 -05:00
Automated ReleaseandSubmariner Bot	b6b2bd77a2	Update Submariner dependencies to v0.16.3 Signed-off-by: Automated Release <release@submariner.io>	2024-01-11 00:59:43 +02:00
dependabot[bot]andStephen Kitt	5c9787a631	Bump actions/setup-python from 4.7.1 to 5.0.0 Bumps [actions/setup-python](https://github.com/actions/setup-python) from 4.7.1 to 5.0.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236...0a5c61591373683505ea898e09a3ea4f39ef2b9c) --- updated-dependencies: - dependency-name: actions/setup-python dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2023-12-21 14:30:23 +01:00
dependabot[bot]andStephen Kitt	4b3dcbdb6b	Bump helm/chart-testing-action from 2.6.0 to 2.6.1 Bumps [helm/chart-testing-action](https://github.com/helm/chart-testing-action) from 2.6.0 to 2.6.1. - [Release notes](https://github.com/helm/chart-testing-action/releases) - [Commits](https://github.com/helm/chart-testing-action/compare/b43128a8b25298e1e7b043b78ea6613844e079b1...e6669bcd63d7cb57cb4380c33043eebe5d111992) --- updated-dependencies: - dependency-name: helm/chart-testing-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2023-12-01 13:45:43 +01:00
Automated ReleaseandSubmariner Bot	48e25395fa	Update Submariner dependencies to v0.16.2 Signed-off-by: Automated Release <release@submariner.io>	2023-11-08 00:52:50 +02:00
Tom Pantelis	fc9f576a27	Add lease RBAC perm to submariner-globalnet role Signed-off-by: Tom Pantelis <tompantelis@gmail.com>	2023-11-07 08:35:06 -05:00
Automated ReleaseandSubmariner Bot	ece52e9f15	Update Submariner dependencies to v0.16.1 Signed-off-by: Automated Release <release@submariner.io>	2023-11-06 17:07:04 +02:00
dependabot[bot]andThomas Pantelis	f5953f0440	Bump actions/checkout from 4.1.0 to 4.1.1 Bumps [actions/checkout](https://github.com/actions/checkout) from 4.1.0 to 4.1.1. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/8ade135a41bc03ea155e62e844d188df1ea18608...b4ffde65f46336ab88eb53be808477a3936bae11) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2023-11-01 17:59:26 -04:00
dependabot[bot]andThomas Pantelis	3f84dc6055	Bump actions/setup-python from 4.7.0 to 4.7.1 Bumps [actions/setup-python](https://github.com/actions/setup-python) from 4.7.0 to 4.7.1. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/61a6322f88396a6271a6ee3565807d608ecaddd1...65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236) --- updated-dependencies: - dependency-name: actions/setup-python dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2023-11-01 17:55:56 -04:00
dependabot[bot]andThomas Pantelis	2f47c2e263	Bump helm/chart-testing-action from 2.4.0 to 2.6.0 Bumps [helm/chart-testing-action](https://github.com/helm/chart-testing-action) from 2.4.0 to 2.6.0. - [Release notes](https://github.com/helm/chart-testing-action/releases) - [Commits](https://github.com/helm/chart-testing-action/compare/e8788873172cb653a90ca2e819d79d65a66d4e76...b43128a8b25298e1e7b043b78ea6613844e079b1) --- updated-dependencies: - dependency-name: helm/chart-testing-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	2023-11-01 08:11:52 -04:00
Automated ReleaseandSubmariner Bot	3c297a818a	Update Submariner dependencies to v0.16.0 Signed-off-by: Automated Release <release@submariner.io>	2023-10-02 20:20:19 +03:00
dependabot[bot]andThomas Pantelis	64d3343e91	Bump actions/checkout from 4.0.0 to 4.1.0 Bumps [actions/checkout](https://github.com/actions/checkout) from 4.0.0 to 4.1.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/3df4ab11eba7bda6032a0b82a6bb43b11571feac...8ade135a41bc03ea155e62e844d188df1ea18608) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	2023-10-01 08:32:58 -04:00
Automated ReleaseandSubmariner Bot	5c93ef310a	Update Submariner dependencies to v0.16.0-rc1 Signed-off-by: Automated Release <release@submariner.io>	2023-09-26 12:53:39 +03:00
dependabot[bot]andStephen Kitt	2a6a7ecbe2	Bump actions/checkout from 3.5.3 to 4.0.0 Bumps [actions/checkout](https://github.com/actions/checkout) from 3.5.3 to 4.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/c85c95e3d7251135ab7dc9ce3241c5835cc595a9...3df4ab11eba7bda6032a0b82a6bb43b11571feac) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2023-09-19 14:41:18 +02:00
Automated ReleaseandSubmariner Bot	353261f2e7	Update Submariner dependencies to v0.16.0-rc0 Signed-off-by: Automated Release <release@submariner.io>	2023-09-11 16:23:44 +03:00
Automated Release	a8d5a9da7b	Update base image to use stable branch 'release-0.16' Signed-off-by: Automated Release <release@submariner.io>	2023-09-11 09:36:51 +00:00