Enable globalnet E2E matrix

Signed-off-by: Miguel Angel Ajo <majopela@redhat.com>

.github/ISSUE_TEMPLATE/broken-link.md

@@ -1,8 +1,2 @@
----
+Periodic link aliveness CI detected a broken link. Please see the [periodic job
-name: Broken link detected by CI
+results](https://github.com/submariner-io/submariner-charts/actions?query=workflow%3APeriodic) for details.
-labels: bug
----
-
-<!-- Used by automation to raise an Issue when the periodic link aliveness tests detect a broken link. -->
-
-Periodic link aliveness CI detected a broken link. Please see the job results for details.

.github/workflows/e2e.yml

@@ -11,24 +11,17 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
+      matrix:
+        globalnet: ['', 'globalnet']
     steps:
       - name: Check out the repository
         uses: actions/checkout@v2
 
-      - name: Reclaim free space
-        run: |
-          sudo swapoff -a
-          sudo rm -f /swapfile
-          df -h
-          free -h
-
       - name: Run E2E deployment and tests
-        run: |
+        uses: submariner-io/shipyard/gh-actions/e2e@devel
-          make e2e
+        with:
+          globalnet: ${{ matrix.globalnet }}
 
       - name: Post mortem
         if: failure()
-        run: |
+        uses: submariner-io/shipyard/gh-actions/post-mortem@devel
-          df -h
-          free -h
-          make post-mortem

.github/workflows/linting.yml

@@ -19,6 +19,17 @@ jobs:
         with:
           commits: ${{ steps.get-pr-commits.outputs.commits }}
 
+  gitlint:
+    name: Commit Message(s)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+      - name: Run gitlint
+        run: make gitlint
+
   markdown-link-check:
     name: Markdown Links (modified files)
     runs-on: ubuntu-latest
@@ -31,6 +42,7 @@ jobs:
         with:
           config-file: ".markdownlinkcheck.json"
           check-modified-files-only: "yes"
+          base-branch: ${{ github.base_ref }}
 
   markdownlint:
     name: Markdown
@@ -39,10 +51,7 @@ jobs:
       - name: Check out the repository
         uses: actions/checkout@v2
       - name: Run markdownlint
-        uses: nosborn/github-action-markdown-cli@v1.1.1
+        run: make markdownlint
-        with:
-          files: .
-          config_file: ".markdownlint.yml"
 
   yaml-lint:
     name: YAML

.github/workflows/periodic.yml

@@ -20,8 +20,8 @@ jobs:
 
       - name: Raise an Issue to report broken links
         if: ${{ failure() }}
-        uses: JasonEtco/create-an-issue@v2
+        uses: peter-evans/create-issue-from-file@v2.3.2
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
-          filename: .github/ISSUE_TEMPLATE/broken-link.md
+          title: Broken link detected by CI
+          content-filepath: .github/ISSUE_TEMPLATE/broken-link.md
+          labels: automated, broken link

.github/workflows/release.yml

@@ -4,7 +4,7 @@ name: Release Charts
 on:
   push:
     branches:
-      - master
+      - devel
 
 jobs:
   release:

.gitignore

@@ -1,2 +1,4 @@
+.dapper
 .idea
-*.tgz
+.shflags
+*.tgz

.gitlint

@@ -0,0 +1,9 @@
+[general]
+# body-is-missing: Allow commit messages with only a title
+# body-min-length: Allow short body lines, like "Relates-to: #issue"
+ignore=body-is-missing,body-min-length
+
+[ignore-by-body]
+# Dependabot doesn't follow our conventions, unfortunately
+regex=^Signed-off-by: dependabot\[bot\](.*)
+ignore=all

CODE-OF-CONDUCT.md

@@ -1,3 +1,3 @@
 # Code of Conduct
 
-Please see the [Code of Conduct docs on Submariner's website](https://submariner.io/contributing/code-of-conduct/).
+Please see the [Code of Conduct docs on Submariner's website](https://submariner.io/community/code-of-conduct/).

CONTRIBUTING.md

@@ -1,3 +1,3 @@
 # Contributing
 
-Please see the [Contributing docs on Submariner's website](https://submariner.io/for_developers/).
+Please see the [Development docs on Submariner's website](https://submariner.io/development/).

README.md

@@ -2,12 +2,12 @@
 
 Please see the [Helm docs on Submariner's website](https://submariner.io/operations/deployment/helm/).
 
-## Dev workflow
+## Development workflow
 
 ### Prerequisites
 
-- [helm]
+- [Helm] v3
-- [docker] or [podman]
+- [Docker] or [Podman]
 
 ### Create a fork and checkout
 
@@ -21,96 +21,36 @@ cd submariner-charts
 git checkout -b new-feature
 ```
 
-Now you can modify the helm charts according to your needs.
+Now you can modify the Helm charts according to your needs.
-
-### Serve the modified charts
-
-Before serving the modified charts, the charts must be packaged for local usage.
-
-```bash
-helm package ./submariner
-helm package ./submariner-k8s-broker
-```
-
-Note: if you just installed helm, you have to init the helm, by running
-
-```bash
-helm init --client-only
-```
-
-Serve the packaged charts through a local helm repository:
-<!-- markdownlint-disable line-length -->
-```bash
-docker run -d --rm --name helm-repo -p 8080:8080 -v $PWD:/charts -e DEBUG=true -e STORAGE=local -e STORAGE_LOCAL_ROOTDIR=/charts chartmuseum/chartmuseum
-```
-
-or
-
-```bash
-sudo podman run -d --rm --name helm-repo -p 8080:8080 -v $PWD:/charts -e DEBUG=true -e STORAGE=local -e STORAGE_LOCAL_ROOTDIR=/charts chartmuseum/chartmuseum
-```
-<!-- markdownlint-enable line-length -->
-Get the container internal ip:
-
-```bash
-docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' helm-repo
-```
-
-The local container will serve the charts locally on port 8080.
-
-Get logs for the container:
-
-```bash
-docker logs -f helm-repo
-```
 
 ### Use the modified charts
 
-Init helm
+Locally-modified charts can be installed using `helm install`,
+referring to the local path; for example:
 
 ```bash
-helm init --client-only
+helm install submariner-k8s-broker ./submariner-k8s-broker ...
 ```
 
-Add your local repository to helm
+In the base directory of this repository, a local deployment using the
+local charts can be obtained by running the following command:
 
 ```bash
-internal_ip=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' helm-repo)
+make deploy
-helm repo add test-repo http://$internal_ip:8080
 ```
 
-List the repos:
+This will start two kind clusters and deploy Submariner using the
+Broker and Operator charts.
 
 ```bash
-helm repo list
+make e2e
 ```
 
-You should be able to see test-repo in the list
+will run the end-to-end test suite used to validate that Submariner is
-
+working correctly.
-Search the new repo for submariner charts:
-
-```bash
-helm search -l test-repo
-```
-
-### Modify submariner e2e tests helm deployment script to use your local test-repo
-
-You can test your helm-charts with e2e tests from the [shipyard](https://github.com/submariner-io/shipyard) repository.
-In the file `scripts/shared/lib/deploy_helm` change the line from:
-
-```bash
-helm repo add submariner-latest https://submariner-io.github.io/submariner-charts/charts
-```
-
-to
-
-```bash
-internal_ip=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' helm-repo)
-helm repo add submariner-latest http://$internal_ip:8080
-```
 
 <!--links-->
-[helm]: https://helm.sh/docs/using_helm/#installing-helm
+[Helm]: https://helm.sh/docs/using_helm/#installing-helm
-[docker]: https://docs.docker.com/install/
+[Docker]: https://docs.docker.com/install/
-[podman]: https://podman.io/getting-started/installation
+[Podman]: https://podman.io/getting-started/installation
 [Create a fork]: https://help.github.com/en/articles/fork-a-repo

deploy_helm

@@ -51,6 +51,7 @@ function helm_install_subm() {
         --set broker.token="${submariner_broker_token}" \
         --set broker.namespace="${SUBMARINER_BROKER_NS}" \
         --set broker.ca="${submariner_broker_ca}" \
+        --set submariner.cableDriver="${cable_driver}" \
         --set submariner.clusterId="${cluster}" \
         --set submariner.clusterCidr="${cluster_CIDRs[$cluster]}" \
         --set submariner.serviceCidr="${service_CIDRs[$cluster]}" \

submariner-operator/crds/crd.yaml

@@ -720,3 +720,158 @@ status:
     plural: ""
   conditions: []
   storedVersions: []
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.3.0
+  creationTimestamp: null
+  name: servicediscoveries.submariner.io
+spec:
+  group: submariner.io
+  names:
+    kind: ServiceDiscovery
+    listKind: ServiceDiscoveryList
+    plural: servicediscoveries
+    singular: servicediscovery
+  scope: Namespaced
+  versions:
+    - name: v1alpha1
+      schema:
+        openAPIV3Schema:
+          description: ServiceDiscovery is the Schema for the servicediscoveries API
+          properties:
+            apiVersion:
+              description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+              type: string
+            kind:
+              description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: ServiceDiscoverySpec defines the desired state of ServiceDiscovery
+              properties:
+                brokerK8sApiServer:
+                  type: string
+                brokerK8sApiServerToken:
+                  type: string
+                brokerK8sCA:
+                  type: string
+                brokerK8sRemoteNamespace:
+                  type: string
+                clusterID:
+                  type: string
+                customDomains:
+                  items:
+                    type: string
+                  type: array
+                  x-kubernetes-list-type: set
+                debug:
+                  type: boolean
+                globalnetEnabled:
+                  type: boolean
+                imageOverrides:
+                  additionalProperties:
+                    type: string
+                  type: object
+                namespace:
+                  type: string
+                repository:
+                  type: string
+                version:
+                  type: string
+              required:
+                - brokerK8sApiServer
+                - brokerK8sApiServerToken
+                - brokerK8sCA
+                - brokerK8sRemoteNamespace
+                - clusterID
+                - debug
+                - namespace
+              type: object
+            status:
+              description: ServiceDiscoveryStatus defines the observed state of ServiceDiscovery
+              type: object
+          type: object
+      served: true
+      storage: true
+      subresources:
+        status: {}
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.3.0
+  creationTimestamp: null
+  name: brokers.submariner.io
+spec:
+  group: submariner.io
+  names:
+    kind: Broker
+    listKind: BrokerList
+    plural: brokers
+    singular: broker
+  scope: Namespaced
+  versions:
+    - name: v1alpha1
+      schema:
+        openAPIV3Schema:
+          description: Broker is the Schema for the brokers API
+          properties:
+            apiVersion:
+              description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+              type: string
+            kind:
+              description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: BrokerSpec defines the desired state of Broker
+              properties:
+                components:
+                  items:
+                    type: string
+                  type: array
+                defaultCustomDomains:
+                  items:
+                    type: string
+                  type: array
+                defaultGlobalnetClusterSize:
+                  type: integer
+                globalnetCIDRRange:
+                  type: string
+                globalnetEnabled:
+                  type: boolean
+              type: object
+            status:
+              description: BrokerStatus defines the observed state of Broker
+              type: object
+          type: object
+      served: true
+      storage: true
+      subresources:
+        status: {}
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []

submariner-operator/questions.yml

@@ -92,6 +92,13 @@ questions:
   label: "Service CIDR"
   group: "CIDR Configuration"
   required: true
+- variable: submariner.globalCidr
+  default: ""
+  description: "Enter the globalnet CIDR (i.e. 169.254.1.0/24) for this cluster if using globalnet"
+  type: string
+  label: "Globalnet CIDR"
+  group: "CIDR Configuration"
+  required: false
 - variable: submariner.natEnabled
   type: boolean
   default: false

submariner-operator/templates/_helpers.tpl

@@ -47,7 +47,7 @@ Create the name of the submariner-engine service account to use
 */}}
 {{- define "submariner.engineServiceAccountName" -}}
 {{- if .Values.serviceAccounts.engine.create -}}
-    {{ default (printf "%s-engine" (include "submariner.fullname" .)) .Values.serviceAccounts.engine.name }}
+    {{ default "submariner-engine" .Values.serviceAccounts.engine.name }}
 {{- else -}}
     {{ default "default" .Values.serviceAccounts.engine.name }}
 {{- end -}}
@@ -58,7 +58,7 @@ Create the name of the submariner-route-agent service account to use
 */}}
 {{- define "submariner.routeAgentServiceAccountName" -}}
 {{- if .Values.serviceAccounts.routeAgent.create -}}
-    {{ default (printf "%s-routeagent" (include "submariner.fullname" .)) .Values.serviceAccounts.routeAgent.name }}
+    {{ default "submariner-routeagent" .Values.serviceAccounts.routeAgent.name }}
 {{- else -}}
     {{ default "default" .Values.serviceAccounts.routeAgent.name }}
 {{- end -}}
@@ -69,20 +69,31 @@ Create the name of the submariner-globalnet service account to use
 */}}
 {{- define "submariner.globalnetServiceAccountName" -}}
 {{- if .Values.serviceAccounts.globalnet.create -}}
-    {{ default (printf "%s-globalnet" (include "submariner.fullname" .)) .Values.serviceAccounts.globalnet.name }}
+    {{ default "submariner-globalnet" .Values.serviceAccounts.globalnet.name }}
 {{- else -}}
     {{ default "default" .Values.serviceAccounts.globalnet.name }}
 {{- end -}}
 {{- end -}}
 
 {{/*
-Create the name of the submariner-lighthouse service account to use
+Create the name of the submariner-lighthouse-agent service account to use
 */}}
-{{- define "submariner.lighthouseServiceAccountName" -}}
+{{- define "submariner.lighthouseAgentServiceAccountName" -}}
-{{- if .Values.submariner.serviceDiscovery -}}
+{{- if and (.Values.submariner.serviceDiscovery ) (.Values.serviceAccounts.lighthouseAgent.create) -}}
-    {{ default (printf "%s-lighthouse" (include "submariner.fullname" .)) .Values.serviceAccounts.lighthouse.name }}
+    {{ default "submariner-lighthouse-agent" .Values.serviceAccounts.lighthouseAgent.name }}
 {{- else -}}
-    {{ default "default" .Values.serviceAccounts.lighthouse.name }}
+    {{ default "default" .Values.serviceAccounts.lighthouseAgent.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create the name of the submariner-lighthouse-coredns service account to use
+*/}}
+{{- define "submariner.lighthouseCoreDnsServiceAccountName" -}}
+{{- if and (.Values.submariner.serviceDiscovery ) (.Values.serviceAccounts.lighthouseCoreDns.create) -}}
+    {{ default "submariner-lighthouse-coredns" .Values.serviceAccounts.lighthouseCoreDns.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccounts.lighthouseCoreDns.name }}
 {{- end -}}
 {{- end -}}
 

submariner-operator/templates/rbac.yaml

@@ -77,7 +77,7 @@ metadata:
     app: {{ template "submariner.name" . }}
 subjects:
 - kind: ServiceAccount
-  name: {{ template "submariner.fullname" . }}
+  name: {{ template "submariner.operatorServiceAccountName" . }}
 roleRef:
   kind: Role
   name: {{ template "submariner.fullname" . }}
@@ -93,15 +93,75 @@ metadata:
     chart: {{ template "submariner.chart" . }}
     app: {{ template "submariner.name" . }}
 rules:
-- apiGroups: [""]
+- apiGroups:
-  resources: ["configmaps"]
+    - ""
-  verbs: ["create", "get", "list", "watch", "patch", "update"]
+  resources:
-- apiGroups: ["submariner.io"]
+    - pods
-  resources: ["clusters", "endpoints", "gateways"]
+    - services
-  verbs: ["create", "get", "list", "watch", "patch", "update", "delete"]
+    - services/finalizers
-- apiGroups: [""]
+    - endpoints
-  resources: ["events"]
+    - persistentvolumeclaims
-  verbs: ["create", "patch"]
+    - events
+    - configmaps
+    - secrets
+  verbs:
+    - '*'
+- apiGroups:
+    - apps
+  resources:
+    - deployments
+    - daemonsets
+    - replicasets
+    - statefulsets
+  verbs:
+    - '*'
+- apiGroups:
+    - monitoring.coreos.com
+  resources:
+    - servicemonitors
+  verbs:
+    - get
+    - create
+- apiGroups:
+    - apps
+  resourceNames:
+    - submariner-operator
+  resources:
+    - deployments/finalizers
+  verbs:
+    - update
+- apiGroups:
+    - ""
+  resources:
+    - pods
+  verbs:
+    - get
+- apiGroups:
+    - apps
+  resources:
+    - replicasets
+  verbs:
+    - get
+- apiGroups:
+    - submariner.io
+  resources:
+    - '*'
+    - servicediscoveries
+  verbs:
+    - '*'
+- apiGroups:
+    - lighthouse.submariner.io
+  resources:
+    - '*'
+    - serviceexports
+  verbs:
+    - create
+    - delete
+    - get
+    - list
+    - patch
+    - update
+    - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -118,7 +178,7 @@ roleRef:
   name: {{ template "submariner.fullname" . }}:engine
 subjects:
 - kind: ServiceAccount
-  name: {{ template "submariner.operatorServiceAccountName" . }}
+  name: {{ template "submariner.engineServiceAccountName" . }}
   namespace: {{ .Release.Namespace }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -131,12 +191,75 @@ metadata:
     chart: {{ template "submariner.chart" . }}
     app: {{ template "submariner.name" . }}
 rules:
-- apiGroups: ["submariner.io"]
+  - apiGroups:
-  resources: ["clusters", "endpoints", "gateways"]
+      - ""
-  verbs: ["create", "get", "list", "watch", "patch", "update"]
+    resources:
-- apiGroups: [""]
+      - pods
-  resources: ["pods"]
+      - services
-  verbs: ["get", "watch", "list"]
+      - services/finalizers
+      - endpoints
+      - persistentvolumeclaims
+      - events
+      - configmaps
+      - secrets
+    verbs:
+      - '*'
+  - apiGroups:
+      - apps
+    resources:
+      - deployments
+      - daemonsets
+      - replicasets
+      - statefulsets
+    verbs:
+      - '*'
+  - apiGroups:
+      - monitoring.coreos.com
+    resources:
+      - servicemonitors
+    verbs:
+      - get
+      - create
+  - apiGroups:
+      - apps
+    resourceNames:
+      - submariner-operator
+    resources:
+      - deployments/finalizers
+    verbs:
+      - update
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - get
+  - apiGroups:
+      - apps
+    resources:
+      - replicasets
+    verbs:
+      - get
+  - apiGroups:
+      - submariner.io
+    resources:
+      - '*'
+      - servicediscoveries
+    verbs:
+      - '*'
+  - apiGroups:
+      - lighthouse.submariner.io
+    resources:
+      - '*'
+      - serviceexports
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -153,9 +276,109 @@ roleRef:
   name: {{ template "submariner.fullname" . }}:routeagent
 subjects:
 - kind: ServiceAccount
-  name: {{ template "submariner.operatorServiceAccountName" . }}
+  name: {{ template "submariner.routeAgentServiceAccountName" . }}
   namespace: {{ .Release.Namespace }}
 ---
+{{- if ne .Values.submariner.globalCidr "" }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ template "submariner.fullname" . }}:globalnet
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+      - services
+      - services/finalizers
+      - endpoints
+      - persistentvolumeclaims
+      - events
+      - configmaps
+      - secrets
+    verbs:
+      - '*'
+  - apiGroups:
+      - apps
+    resources:
+      - deployments
+      - daemonsets
+      - replicasets
+      - statefulsets
+    verbs:
+      - '*'
+  - apiGroups:
+      - monitoring.coreos.com
+    resources:
+      - servicemonitors
+    verbs:
+      - get
+      - create
+  - apiGroups:
+      - apps
+    resourceNames:
+      - submariner-operator
+    resources:
+      - deployments/finalizers
+    verbs:
+      - update
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - get
+  - apiGroups:
+      - apps
+    resources:
+      - replicasets
+    verbs:
+      - get
+  - apiGroups:
+      - submariner.io
+    resources:
+      - '*'
+      - servicediscoveries
+    verbs:
+      - '*'
+  - apiGroups:
+      - lighthouse.submariner.io
+    resources:
+      - '*'
+      - serviceexports
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:globalnet
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "submariner.fullname" . }}:globalnet
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "submariner.globalnetServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+---
+{{- end -}}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
@@ -169,24 +392,50 @@ rules:
   # submariner-operator updates the config map of core-dns to forward requests to
   # clusterset.local to Lighthouse DNS, also looks at existing configmaps
   # to figure out network settings
-  - apiGroups: [""]
+  - apiGroups:
-    resources: ["configmaps"]
+      - ""
-    verbs: ["get", "list", "watch", "update"]
+    resources:
-  - apiGroups: ["apiextensions.k8s.io"]
+      - configmaps
-    resources: ["customresourcedefinitions"]
+    verbs:
-    verbs: ["get", "list", "create", "update", "delete"]
+      - get
-  - apiGroups: [""] # pods and services are looked up to figure out network settings
+      - list
-    resources: ["pods", "services"]
+      - watch
-    verbs: ["get", "list", "watch"]
+      - update
-  - apiGroups: ["operator.openshift.io"]
+  - apiGroups:
-    resources: ["dnses"]
+      - apiextensions.k8s.io
-    verbs: ["get", "list", "watch", "update"]
+    resources:
-  - apiGroups: ["config.openshift.io"]
+      - customresourcedefinitions
-    resources: ["networks"]
+    verbs:
-    verbs: ["get", "list"]
+      - get
-  - apiGroups: ["multicluster.x-k8s.io"]
+      - list
-    resources: ["*"]
+      - create
-    verbs: ["create", "get", "list", "watch", "update", "delete"]
+      - update
+      - delete
+  - apiGroups:  # pods and services are looked up to figure out network settings
+      - ""
+    resources:
+      - pods
+      - services
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - operator.openshift.io
+    resources:
+      - dnses
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - config.openshift.io
+    resources:
+      - networks
+    verbs:
+      - get
+      - list
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -208,6 +457,91 @@ roleRef:
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
+metadata:
+  name: {{ template "submariner.fullname" . }}:engine
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions
+    verbs:
+      - get
+      - list
+      - create
+      - update
+      - delete
+  - apiGroups:  # pods and services are looked up to figure out network settings
+      - ""
+    resources:
+      - pods
+      - services
+      - nodes
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - operator.openshift.io
+    resources:
+      - dnses
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - config.openshift.io
+    resources:
+      - networks
+    verbs:
+      - get
+      - list
+  - apiGroups:
+      - submariner.io
+    resources:
+      - endpoints
+      - gateways
+      - clusters
+    verbs:
+      - get
+      - list
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:engine
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "submariner.fullname" . }}:engine
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "submariner.engineServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
 metadata:
   name: {{ template "submariner.fullname" . }}:routeagent
   labels:
@@ -216,9 +550,59 @@ metadata:
     chart: {{ template "submariner.chart" . }}
     app: {{ template "submariner.name" . }}
 rules:
-  - apiGroups: [""]
+  - apiGroups:
-    resources: ["nodes"]
+      - ""
-    verbs: ["get", "update"]
+    resources:
+      - configmaps
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions
+    verbs:
+      - get
+      - list
+      - create
+      - update
+      - delete
+  - apiGroups:  # pods and services are looked up to figure out network settings
+      - ""
+    resources:
+      - pods
+      - services
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - operator.openshift.io
+    resources:
+      - dnses
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - config.openshift.io
+    resources:
+      - networks
+    verbs:
+      - get
+      - list
+  - apiGroups:
+      - ""
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+    resources:
+      - nodes
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -235,9 +619,10 @@ roleRef:
   name: {{ template "submariner.fullname" . }}:routeagent
 subjects:
   - kind: ServiceAccount
-    name: {{ template "submariner.operatorServiceAccountName" . }}
+    name: {{ template "submariner.routeAgentServiceAccountName" . }}
     namespace: {{ .Release.Namespace }}
 ---
+{{- if ne .Values.submariner.globalCidr "" }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
@@ -248,13 +633,37 @@ metadata:
     chart: {{ template "submariner.chart" . }}
     app: {{ template "submariner.name" . }}
 rules:
-- apiGroups: [""]
+  - apiGroups:
-  resources: ["services", "namespaces", "pods", "nodes"]
+      - ""
-  verbs: ["get", "list", "watch", "update"]
+    resources:
-- apiGroups: ["submariner.io"]
+      - pods
-  resources: ["clusters", "endpoints", "gateways"]
+      - services
-  verbs: ["get", "list", "watch"]
+      - namespaces
+      - nodes
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - submariner.io
+    resources:
+      - endpoints
+      - clusters
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - multicluster.x-k8s.io
+    resources:
+      - "serviceexports"
+    verbs:
+      - get
+      - list
+      - watch
 ---
+{{- end -}}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
@@ -270,37 +679,67 @@ roleRef:
   name: {{ template "submariner.fullname" . }}:globalnet
 subjects:
 - kind: ServiceAccount
-  name: {{ template "submariner.operatorServiceAccountName" . }}
+  name: {{ template "submariner.globalnetServiceAccountName" . }}
   namespace: {{ .Release.Namespace }}
 ---
 {{- if .Values.submariner.serviceDiscovery }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: {{ template "submariner.fullname" . }}:lighthouse
+  name: {{ template "submariner.fullname" . }}:lighthouse-agent
   labels:
     heritage: {{ .Release.Service | quote }}
     release: {{ .Release.Name | quote }}
     chart: {{ template "submariner.chart" . }}
     app: {{ template "submariner.name" . }}
 rules:
-  - apiGroups: [""]
+  - apiGroups:
-    resources: ["services", "namespaces", "configmaps", "endpoints"]
+      - ""
-    verbs: ["get", "list", "watch", "update"]
+    resources:
-  - apiGroups: ["discovery.k8s.io"]
+      - services
-    resources: ["endpointslices"]
+      - namespaces
-    verbs: ["create", "get", "list", "watch", "update", "delete"]
+      - endpoints
-  - apiGroups: ["lighthouse.submariner.io"]
+    verbs:
-    resources: ["*"]
+      - get
-    verbs: ["create", "get", "list", "watch", "update", "delete"]
+      - list
-  - apiGroups: ["submariner.io"]
+      - watch
-    resources: ["gateways"]
+      - update
-    verbs: ["get", "list", "watch"]
+  - apiGroups:
+      - discovery.k8s.io
+    resources:
+      - endpointslices
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - delete
+      - deletecollection
+  - apiGroups:
+      - submariner.io
+    resources:
+      - "gateways"
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - multicluster.x-k8s.io
+    resources:
+      - "*"
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - delete
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: {{ template "submariner.fullname" . }}:lighthouse
+  name: {{ template "submariner.fullname" . }}:lighthouse-agent
   labels:
     heritage: {{ .Release.Service | quote }}
     release: {{ .Release.Name | quote }}
@@ -309,10 +748,82 @@ metadata:
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: {{ template "submariner.fullname" . }}:lighthouse
+  name: {{ template "submariner.fullname" . }}:lighthouse-agent
 subjects:
   - kind: ServiceAccount
-    name: {{ template "submariner.operatorServiceAccountName" . }}
+    name: {{ template "submariner.lighthouseAgentServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "submariner.fullname" . }}:lighthouse-coredns
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - services
+      - namespaces
+      - endpoints
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - discovery.k8s.io
+    resources:
+      - endpointslices
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - delete
+      - deletecollection
+  - apiGroups:
+      - lighthouse.submariner.io
+    resources:
+      - "*"
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - delete
+  - apiGroups:
+      - submariner.io
+    resources:
+      - "gateways"
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - multicluster.x-k8s.io
+    resources:
+      - "*"
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - delete
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:lighthouse-coredns
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "submariner.fullname" . }}:lighthouse-coredns
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }}
     namespace: {{ .Release.Namespace }}
 {{- end -}}
 {{- end -}}

submariner-operator/templates/submariner.yaml

@@ -22,3 +22,5 @@ spec:
   repository: {{ .Values.submariner.images.repository }}
   version: {{ .Values.submariner.images.tag }}
   serviceCIDR: "{{ .Values.submariner.serviceCidr }}"
+  globalCIDR: "{{ .Values.submariner.globalCidr }}"
+  serviceDiscoveryEnabled: {{ .Values.submariner.serviceDiscovery }}

submariner-operator/templates/svc-acct.yaml

@@ -46,14 +46,26 @@ metadata:
     app: {{ template "submariner.name" . }}
 {{- end }}
 ---
-{{- if .Values.serviceAccounts.lighthouse.create }}
+{{- if .Values.serviceAccounts.lighthouseAgent.create }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ template "submariner.lighthouseServiceAccountName" . }}
+  name: {{ template "submariner.lighthouseAgentServiceAccountName" . }}
   labels:
     heritage: {{ .Release.Service | quote }}
     release: {{ .Release.Name | quote }}
     chart: {{ template "submariner.chart" . }}
     app: {{ template "submariner.name" . }}
 {{- end }}
+---
+  {{- if .Values.serviceAccounts.lighthouseCoreDns.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+  {{- end }}

submariner-operator/values.yaml

@@ -54,6 +54,9 @@ serviceAccounts:
   globalnet:
     create: true
     name: ""
-  lighthouse:
+  lighthouseAgent:
-    create: false
+    create: true
+    name: ""
+  lighthouseCoreDns:
+    create: true
     name: ""

submariner/templates/_helpers.tpl

@@ -36,7 +36,7 @@ Create the name of the submariner-engine service account to use
 */}}
 {{- define "submariner.engineServiceAccountName" -}}
 {{- if .Values.serviceAccounts.engine.create -}}
-    {{ default (printf "%s-engine" (include "submariner.fullname" .)) .Values.serviceAccounts.engine.name }}
+    {{ default "submariner-engine" .Values.serviceAccounts.engine.name }}
 {{- else -}}
     {{ default "default" .Values.serviceAccounts.engine.name }}
 {{- end -}}
@@ -47,7 +47,7 @@ Create the name of the submariner-route-agent service account to use
 */}}
 {{- define "submariner.routeAgentServiceAccountName" -}}
 {{- if .Values.serviceAccounts.routeAgent.create -}}
-    {{ default (printf "%s-routeagent" (include "submariner.fullname" .)) .Values.serviceAccounts.routeAgent.name }}
+    {{ default "submariner-routeagent" .Values.serviceAccounts.routeAgent.name }}
 {{- else -}}
     {{ default "default" .Values.serviceAccounts.routeAgent.name }}
 {{- end -}}
@@ -58,20 +58,31 @@ Create the name of the submariner-globalnet service account to use
 */}}
 {{- define "submariner.globalnetServiceAccountName" -}}
 {{- if .Values.serviceAccounts.globalnet.create -}}
-    {{ default (printf "%s-globalnet" (include "submariner.fullname" .)) .Values.serviceAccounts.globalnet.name }}
+    {{ default "submariner-globalnet" .Values.serviceAccounts.globalnet.name }}
 {{- else -}}
     {{ default "default" .Values.serviceAccounts.globalnet.name }}
 {{- end -}}
 {{- end -}}
 
 {{/*
-Create the name of the submariner-lighthouse service account to use
+Create the name of the submariner-lighthouse-agent service account to use
 */}}
-{{- define "submariner.lighthouseServiceAccountName" -}}
+{{- define "submariner.lighthouseAgentServiceAccountName" -}}
-{{- if .Values.submariner.serviceDiscovery -}}
+{{- if and (.Values.submariner.serviceDiscovery ) (.Values.serviceAccounts.lighthouseAgent.create) -}}
-    {{ default (printf "%s-lighthouse" (include "submariner.fullname" .)) .Values.serviceAccounts.lighthouse.name }}
+    {{ default "submariner-lighthouse-agent" .Values.serviceAccounts.lighthouseAgent.name }}
 {{- else -}}
-    {{ default "default" .Values.serviceAccounts.lighthouse.name }}
+    {{ default "default" .Values.serviceAccounts.lighthouseAgent.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create the name of the submariner-lighthouse-coredns service account to use
+*/}}
+{{- define "submariner.lighthouseCoreDnsServiceAccountName" -}}
+{{- if and (.Values.submariner.serviceDiscovery ) (.Values.serviceAccounts.lighthouseCoreDns.create) -}}
+    {{ default "submariner-lighthouse-coredns" .Values.serviceAccounts.lighthouseCoreDns.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccounts.lighthouseCoreDns.name }}
 {{- end -}}
 {{- end -}}
 

submariner/templates/engine-deploy.yaml

@@ -108,6 +108,10 @@ spec:
           value: "{{ .Values.leadership.renewDeadline }}"
         - name: LEADERSHIP_RETRYPERIOD
           value: "{{ .Values.leadership.retryPeriod }}"
+        - name: NODE_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: "spec.nodeName"
         image: {{ .Values.engine.image.repository }}:{{ default .Chart.AppVersion .Values.engine.image.tag }}
         imagePullPolicy: {{ .Values.engine.image.pullPolicy }}
         name: submariner

submariner/templates/globalnet.yaml

@@ -29,29 +29,33 @@ spec:
       nodeSelector:
         submariner.io/gateway: 'true'
       containers:
-        - name: {{ template "submariner.fullname" . }}-globalnet
+      - name: {{ template "submariner.fullname" . }}-globalnet
-          image: {{ .Values.globalnet.image.repository }}:{{  default .Chart.AppVersion .Values.globalnet.image.tag }}
+        image: {{ .Values.globalnet.image.repository }}:{{  default .Chart.AppVersion .Values.globalnet.image.tag }}
-          imagePullPolicy: {{ .Values.globalnet.image.pullPolicy }}
+        imagePullPolicy: {{ .Values.globalnet.image.pullPolicy }}
-          env:
+        env:
-            - name: SUBMARINER_CLUSTERID
+          - name: SUBMARINER_CLUSTERID
-              value: '{{ .Values.submariner.clusterId }}'
+            value: '{{ .Values.submariner.clusterId }}'
-            - name: SUBMARINER_EXCLUDENS
+          - name: SUBMARINER_EXCLUDENS
-              value: 'submariner-operator,kube-system,operators,openshift-monitoring,openshift-dns'
+            value: 'submariner-operator,kube-system,operators,openshift-monitoring,openshift-dns'
-            - name: SUBMARINER_NAMESPACE
+          - name: SUBMARINER_NAMESPACE
-              value: '{{ .Release.Namespace }}'
+            value: '{{ .Release.Namespace }}'
-          securityContext:
+          - name: NODE_NAME
-            allowPrivilegeEscalation: true
+            valueFrom:
-            capabilities:
+              fieldRef:
-              add:
+                fieldPath: "spec.nodeName"
-                - ALL
+        securityContext:
-            privileged: true
+          allowPrivilegeEscalation: true
-            readOnlyRootFilesystem: false
+          capabilities:
-            runAsNonRoot: false
+            add:
-          volumeMounts:
+              - ALL
-            # Because we don't actually run iptables locally, but chroot in to the host
+          privileged: true
-            - mountPath: /host
+          readOnlyRootFilesystem: false
-              name: host-slash
+          runAsNonRoot: false
-              readOnly: true
+        volumeMounts:
+          # Because we don't actually run iptables locally, but chroot in to the host
+          - mountPath: /host
+            name: host-slash
+            readOnly: true
       volumes:
         - name: host-slash
           hostPath:

submariner/templates/lighthouse-coredns.yaml

@@ -30,7 +30,7 @@ spec:
             - mountPath: /etc/coredns
               name: config-volume
               readOnly: true
-      serviceAccountName: {{ template "submariner.lighthouseServiceAccountName" . }}
+      serviceAccountName: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }}
       volumes:
         - configMap:
             defaultMode: 420

submariner/templates/lighthouse.yaml

@@ -19,7 +19,7 @@ spec:
       labels:
         app: {{ template "submariner.fullname" . }}-lighthouse-agent
     spec:
-      serviceAccountName: {{ template "submariner.lighthouseServiceAccountName" . }}
+      serviceAccountName: {{ template "submariner.lighthouseAgentServiceAccountName" . }}
       containers:
       - command:
         - lighthouse-agent.sh

submariner/templates/rbac.yaml

@@ -9,15 +9,93 @@ metadata:
     chart: {{ template "submariner.chart" . }}
     app: {{ template "submariner.name" . }}
 rules:
-- apiGroups: [""]
+  - apiGroups:
-  resources: ["configmaps"]
+      - ""
-  verbs: ["create", "get", "list", "watch", "patch", "update"]
+    resources:
-- apiGroups: ["submariner.io"]
+      - pods
-  resources: ["clusters", "endpoints", "gateways"]
+      - services
-  verbs: ["create", "get", "list", "watch", "patch", "update", "delete"]
+      - services/finalizers
-- apiGroups: [""]
+      - endpoints
-  resources: ["events"]
+      - persistentvolumeclaims
-  verbs: ["create", "patch"]
+      - events
+      - configmaps
+      - secrets
+    verbs:
+      - '*'
+  - apiGroups:
+      - apps
+    resources:
+      - deployments
+      - daemonsets
+      - replicasets
+      - statefulsets
+    verbs:
+      - '*'
+  - apiGroups:
+      - monitoring.coreos.com
+    resources:
+      - servicemonitors
+    verbs:
+      - get
+      - create
+  - apiGroups:
+      - apps
+    resourceNames:
+      - submariner-operator
+    resources:
+      - deployments/finalizers
+    verbs:
+      - update
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - get
+  - apiGroups:
+      - apps
+    resources:
+      - replicasets
+    verbs:
+      - get
+  - apiGroups:
+      - submariner.io
+    resources:
+      - '*'
+      - servicediscoveries
+    verbs:
+      - '*'
+  - apiGroups:
+      - lighthouse.submariner.io
+    resources:
+      - '*'
+      - serviceexports
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:engine
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "submariner.fullname" . }}:engine
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "submariner.engineServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
@@ -29,52 +107,353 @@ metadata:
     chart: {{ template "submariner.chart" . }}
     app: {{ template "submariner.name" . }}
 rules:
-- apiGroups: ["submariner.io"]
+  - apiGroups:
-  resources: ["clusters", "endpoints", "gateways"]
+      - ""
-  verbs: ["create", "get", "list", "watch", "patch", "update"]
+    resources:
-- apiGroups: [""]
+      - pods
-  resources: ["pods"]
+      - services
-  verbs: ["get", "watch", "list"]
+      - services/finalizers
----
+      - endpoints
-apiVersion: rbac.authorization.k8s.io/v1
+      - persistentvolumeclaims
-kind: RoleBinding
+      - events
-metadata:
+      - configmaps
-  name: {{ template "submariner.fullname" . }}:engine
+      - secrets
-roleRef:
+    verbs:
-  apiGroup: rbac.authorization.k8s.io
+      - '*'
-  kind: Role
+  - apiGroups:
-  name: {{ template "submariner.fullname" . }}:engine
+      - apps
-subjects:
+    resources:
-- kind: ServiceAccount
+      - deployments
-  name: {{ template "submariner.engineServiceAccountName" . }}
+      - daemonsets
-  namespace: {{ .Release.Namespace }}
+      - replicasets
+      - statefulsets
+    verbs:
+      - '*'
+  - apiGroups:
+      - monitoring.coreos.com
+    resources:
+      - servicemonitors
+    verbs:
+      - get
+      - create
+  - apiGroups:
+      - apps
+    resourceNames:
+      - submariner-operator
+    resources:
+      - deployments/finalizers
+    verbs:
+      - update
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - get
+  - apiGroups:
+      - apps
+    resources:
+      - replicasets
+    verbs:
+      - get
+  - apiGroups:
+      - submariner.io
+    resources:
+      - '*'
+      - servicediscoveries
+    verbs:
+      - '*'
+  - apiGroups:
+      - lighthouse.submariner.io
+    resources:
+      - '*'
+      - serviceexports
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   name: {{ template "submariner.fullname" . }}:routeagent
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
   name: {{ template "submariner.fullname" . }}:routeagent
 subjects:
-- kind: ServiceAccount
+  - kind: ServiceAccount
-  name: {{ template "submariner.routeAgentServiceAccountName" . }}
+    name: {{ template "submariner.routeAgentServiceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
+    namespace: {{ .Release.Namespace }}
+---
+{{- if ne .Values.submariner.globalCidr "" }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ template "submariner.fullname" . }}:globalnet
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+      - services
+      - services/finalizers
+      - endpoints
+      - persistentvolumeclaims
+      - events
+      - configmaps
+      - secrets
+    verbs:
+      - '*'
+  - apiGroups:
+      - apps
+    resources:
+      - deployments
+      - daemonsets
+      - replicasets
+      - statefulsets
+    verbs:
+      - '*'
+  - apiGroups:
+      - monitoring.coreos.com
+    resources:
+      - servicemonitors
+    verbs:
+      - get
+      - create
+  - apiGroups:
+      - apps
+    resourceNames:
+      - submariner-operator
+    resources:
+      - deployments/finalizers
+    verbs:
+      - update
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - get
+  - apiGroups:
+      - apps
+    resources:
+      - replicasets
+    verbs:
+      - get
+  - apiGroups:
+      - submariner.io
+    resources:
+      - '*'
+      - servicediscoveries
+    verbs:
+      - '*'
+  - apiGroups:
+      - lighthouse.submariner.io
+    resources:
+      - '*'
+      - serviceexports
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:globalnet
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "submariner.fullname" . }}:globalnet
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "submariner.globalnetServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+---
+{{- end -}}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "submariner.fullname" . }}:engine
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions
+    verbs:
+      - get
+      - list
+      - create
+      - update
+      - delete
+  - apiGroups:  # pods and services are looked up to figure out network settings
+      - ""
+    resources:
+      - pods
+      - services
+      - nodes
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - operator.openshift.io
+    resources:
+      - dnses
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - config.openshift.io
+    resources:
+      - networks
+    verbs:
+      - get
+      - list
+  - apiGroups:
+      - submariner.io
+    resources:
+      - endpoints
+      - gateways
+      - clusters
+    verbs:
+      - get
+      - list
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:engine
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "submariner.fullname" . }}:engine
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "submariner.engineServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: {{ template "submariner.fullname" . }}:routeagent
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
 rules:
-  - apiGroups: [""]
+  - apiGroups:
-    resources: ["nodes"]
+      - ""
-    verbs: ["get", "list", "watch", "update"]
+    resources:
+      - configmaps
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions
+    verbs:
+      - get
+      - list
+      - create
+      - update
+      - delete
+  - apiGroups:  # pods and services are looked up to figure out network settings
+      - ""
+    resources:
+      - pods
+      - services
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - operator.openshift.io
+    resources:
+      - dnses
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - config.openshift.io
+    resources:
+      - networks
+    verbs:
+      - get
+      - list
+  - apiGroups:
+      - ""
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+    resources:
+      - nodes
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: {{ template "submariner.fullname" . }}:routeagent
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
@@ -89,61 +468,203 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: {{ template "submariner.fullname" . }}:globalnet
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
 rules:
-- apiGroups: [""]
+  - apiGroups:
-  resources: ["services", "namespaces", "pods", "nodes"]
+      - ""
-  verbs: ["get", "list", "watch", "update"]
+    resources:
-- apiGroups: ["submariner.io"]
+      - pods
-  resources: ["clusters", "endpoints", "gateways"]
+      - services
-  verbs: ["get", "list", "watch"]
+      - namespaces
+      - nodes
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - submariner.io
+    resources:
+      - endpoints
+      - clusters
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - multicluster.x-k8s.io
+    resources:
+      - "serviceexports"
+    verbs:
+      - get
+      - list
+      - watch
 ---
+{{- end -}}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   name: {{ template "submariner.fullname" . }}:globalnet
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
   name: {{ template "submariner.fullname" . }}:globalnet
 subjects:
-- kind: ServiceAccount
+  - kind: ServiceAccount
-  name: {{ template "submariner.globalnetServiceAccountName" . }}
+    name: {{ template "submariner.globalnetServiceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
+    namespace: {{ .Release.Namespace }}
 ---
-{{- end -}}
 {{- if .Values.submariner.serviceDiscovery }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: {{ template "submariner.fullname" . }}:lighthouse
+  name: {{ template "submariner.fullname" . }}:lighthouse-agent
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
 rules:
-  - apiGroups: [""]
+  - apiGroups:
-    resources: ["services", "namespaces", "configmaps", "endpoints"]
+      - ""
-    verbs: ["get", "list", "watch", "update"]
+    resources:
-  - apiGroups: ["discovery.k8s.io"]
+      - services
-    resources: ["endpointslices"]
+      - namespaces
-    verbs: ["create", "get", "list", "watch", "update", "delete", "deletecollection"]
+      - endpoints
-  - apiGroups: ["lighthouse.submariner.io"]
+    verbs:
-    resources: ["*"]
+      - get
-    verbs: ["create", "get", "list", "watch", "update", "delete"]
+      - list
-  - apiGroups: ["submariner.io"]
+      - watch
-    resources: ["gateways"]
+      - update
-    verbs: ["get", "list", "watch"]
+  - apiGroups:
-  - apiGroups: ["multicluster.x-k8s.io"]
+      - discovery.k8s.io
-    resources: ["*"]
+    resources:
-    verbs: ["create", "get", "list", "watch", "update", "delete"]
+      - endpointslices
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - delete
+      - deletecollection
+  - apiGroups:
+      - submariner.io
+    resources:
+      - "gateways"
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - multicluster.x-k8s.io
+    resources:
+      - "*"
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - delete
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: {{ template "submariner.fullname" . }}:lighthouse
+  name: {{ template "submariner.fullname" . }}:lighthouse-agent
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: {{ template "submariner.fullname" . }}:lighthouse
+  name: {{ template "submariner.fullname" . }}:lighthouse-agent
 subjects:
   - kind: ServiceAccount
-    name: {{ template "submariner.lighthouseServiceAccountName" . }}
+    name: {{ template "submariner.lighthouseAgentServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "submariner.fullname" . }}:lighthouse-coredns
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - services
+      - namespaces
+      - endpoints
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - discovery.k8s.io
+    resources:
+      - endpointslices
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - delete
+      - deletecollection
+  - apiGroups:
+      - lighthouse.submariner.io
+    resources:
+      - "*"
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - delete
+  - apiGroups:
+      - submariner.io
+    resources:
+      - "gateways"
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - multicluster.x-k8s.io
+    resources:
+      - "*"
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - delete
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:lighthouse-coredns
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "submariner.fullname" . }}:lighthouse-coredns
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }}
     namespace: {{ .Release.Namespace }}
 {{- end -}}
 {{- end -}}

submariner/templates/svc-acct.yaml

@@ -34,14 +34,26 @@ metadata:
     app: {{ template "submariner.name" . }}
 {{- end }}
 ---
-{{- if .Values.serviceAccounts.lighthouse.create }}
+{{- if .Values.serviceAccounts.lighthouseAgent.create }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ template "submariner.lighthouseServiceAccountName" . }}
+  name: {{ template "submariner.lighthouseAgentServiceAccountName" . }}
   labels:
     heritage: {{ .Release.Service | quote }}
     release: {{ .Release.Name | quote }}
     chart: {{ template "submariner.chart" . }}
     app: {{ template "submariner.name" . }}
 {{- end }}
+---
+{{- if .Values.serviceAccounts.lighthouseCoreDns.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+  {{- end }}

submariner/values.yaml

@@ -72,8 +72,11 @@ serviceAccounts:
     create: true
     name: ""
   globalnet:
-    create: false
+    create: true
     name: ""
-  lighthouse:
+  lighthouseAgent:
-    create: false
+    create: true
+    name: ""
+  lighthouseCoreDns:
+    create: true
     name: ""