Enable globalnet E2E matrix

Signed-off-by: Miguel Angel Ajo <majopela@redhat.com>
Add globalCidr mappings to the submariner template
2026-09-21 04:30:34 +00:00 · 2021-02-24 14:39:49 +01:00 · 2021-02-24 14:29:16 +01:00 · 2021-02-24 12:45:03 +01:00 · 2021-02-24 12:45:03 +01:00 · 2021-02-23 16:08:55 +01:00
37 changed files with 2268 additions and 688 deletions
@@ -1,8 +1,2 @@
---
-name: Broken link detected by CI
-labels: bug
---
-
-<!-- Used by automation to raise an Issue when the periodic link aliveness tests detect a broken link. -->
-
-Periodic link aliveness CI detected a broken link. Please see the job results for details.
+Periodic link aliveness CI detected a broken link. Please see the [periodic job
+results](https://github.com/submariner-io/submariner-charts/actions?query=workflow%3APeriodic) for details.
@@ -0,0 +1,33 @@
+---
+name: Bug Report
+about: Report a bug in Helm Charts
+labels: bug
+
+---
+
+<!-- Please use this template while reporting a bug and provide as much info as
+possible. Not doing so may result in your bug not being addressed in a timely
+manner. Thanks!
+
+If the matter is security related, please disclose it privately to the
+Submariner Owners: https://github.com/orgs/submariner-io/teams/submariner-core
+-->
+
+
+**What happened**:
+
+**What you expected to happen**:
+
+**How to reproduce it (as minimally and precisely as possible)**:
+
+**Anything else we need to know?**:
+
+**Environment**:
+- Submariner version (use `subctl version`):
+- Kubernetes version (use `kubectl version`):
+- Cloud provider or hardware configuration:
+- OS (e.g: `cat /etc/os-release`):
+- Kernel (e.g. `uname -a`):
+- Install tools:
+- Network plugin and version (if this is a network-related bug):
+- Others:
@@ -0,0 +1,11 @@
+---
+name: Enhancement Request
+about: Suggest an enhancement to the Helm Charts project
+labels: enhancement
+
+---
+<!-- Please only use this template for submitting enhancement requests -->
+
+**What would you like to be added**:
+
+**Why is this needed**:
@@ -0,0 +1,18 @@
+---
+name: Support Request
+about: Support request or question relating to Helm Charts
+labels: support
+
+---
+
+<!--
+GitHub may not the right place for support requests.
+
+You can also post your question on the [Submariner
+Slack](https://kubernetes.slack.com/archives/C010RJV694M) or the Submariner
+[users](https://bit.ly/submariner-users) or
+[developers](https://bit.ly/submariner-dev) mailing lists.
+
+If the matter is security related, please disclose it privately to the
+Submariner Owners: https://github.com/orgs/submariner-io/teams/submariner-core
+-->
@@ -11,24 +11,17 @@ jobs:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
+      matrix:
+        globalnet: ['', 'globalnet']
    steps:
      - name: Check out the repository
        uses: actions/checkout@v2

-      - name: Reclaim free space
-        run: |
-          sudo swapoff -a
-          sudo rm -f /swapfile
-          df -h
-          free -h
-
      - name: Run E2E deployment and tests
-        run: |
-          make e2e
+        uses: submariner-io/shipyard/gh-actions/e2e@devel
+        with:
+          globalnet: ${{ matrix.globalnet }}

      - name: Post mortem
        if: failure()
-        run: |
-          df -h
-          free -h
-          make post-mortem
+        uses: submariner-io/shipyard/gh-actions/post-mortem@devel
@@ -19,6 +19,17 @@ jobs:
        with:
          commits: ${{ steps.get-pr-commits.outputs.commits }}

+  gitlint:
+    name: Commit Message(s)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+      - name: Run gitlint
+        run: make gitlint
+
  markdown-link-check:
    name: Markdown Links (modified files)
    runs-on: ubuntu-latest
@@ -31,6 +42,7 @@ jobs:
        with:
          config-file: ".markdownlinkcheck.json"
          check-modified-files-only: "yes"
+          base-branch: ${{ github.base_ref }}

  markdownlint:
    name: Markdown
@@ -39,10 +51,7 @@ jobs:
      - name: Check out the repository
        uses: actions/checkout@v2
      - name: Run markdownlint
-        uses: nosborn/github-action-markdown-cli@v1.1.1
-        with:
-          files: .
-          config_file: ".markdownlint.yml"
+        run: make markdownlint

  yaml-lint:
    name: YAML
@@ -20,8 +20,8 @@ jobs:

      - name: Raise an Issue to report broken links
        if: ${{ failure() }}
-        uses: JasonEtco/create-an-issue@v2
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        uses: peter-evans/create-issue-from-file@v2.3.2
        with:
-          filename: .github/ISSUE_TEMPLATE/broken-link.md
+          title: Broken link detected by CI
+          content-filepath: .github/ISSUE_TEMPLATE/broken-link.md
+          labels: automated, broken link
@@ -0,0 +1,32 @@
+---
+name: Release Charts
+
+on:
+  push:
+    branches:
+      - devel
+
+jobs:
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - name: Configure Git
+        run: |
+          git config user.name "$GITHUB_ACTOR"
+          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
+
+      - name: Update the charts
+        run: |
+          make release
+
+      - name: Push the charts
+        run: |
+          git add charts/*
+          git commit -m "Chart update"
+          git push
@@ -1,2 +1,4 @@
+.dapper
 .idea
-*.tgz
+.shflags
+*.tgz
@@ -0,0 +1,9 @@
+[general]
+# body-is-missing: Allow commit messages with only a title
+# body-min-length: Allow short body lines, like "Relates-to: #issue"
+ignore=body-is-missing,body-min-length
+
+[ignore-by-body]
+# Dependabot doesn't follow our conventions, unfortunately
+regex=^Signed-off-by: dependabot\[bot\](.*)
+ignore=all
@@ -1,47 +0,0 @@
-language: python
-
-env:
-  global:
-    - HELM_URL=https://storage.googleapis.com/kubernetes-helm
-    - HELM_TGZ=helm-v2.14.3-linux-amd64.tar.gz
-    - TARGET_BR=gh-pages
-    - GH_URL=https://submariner-io.github.io/submariner-charts/charts
-    - CHARTS_DIR=charts
-    - YAMLLINT_VERSION=1.17.0
-    - HELM_FLAGS='--set submariner.serviceDiscovery=true,serviceAccounts.globalnet.create=true,globalCidr="169.254.0.0/16"'
-
-install:
-  - wget -q ${HELM_URL}/${HELM_TGZ}
-  - tar xzfv ${HELM_TGZ}
-  - PATH=`pwd`/linux-amd64/:$PATH
-  - helm init --client-only
-  - sudo pip install yamllint=="${YAMLLINT_VERSION}"
-
-script:
-  - for dir in submariner submariner-k8s-broker submariner-operator; do helm lint $dir $HELM_FLAGS; done
-  - yamllint -c .yamllint.yml -s $(find . -type f -name "Chart.yaml")
-  - yamllint -c .yamllint.yml -s $(find . -type f -name "values.yaml")
-
-after_success:
-  - >
-    if [ $TRAVIS_BRANCH = 'master' ] && [ $TRAVIS_PULL_REQUEST = 'false' ]; then
-      set -e
-      for dir in submariner submariner-k8s-broker submariner-operator; do
-        helm dep update $dir
-        helm package $dir
-      done
-      REPO_URL=`git config remote.origin.url`
-      git clone ${REPO_URL} out && cd out && git checkout gh-pages && mkdir -p ${CHARTS_DIR}
-      cp -f ../submariner-*.tgz ${CHARTS_DIR}/
-      if [ -f charts/index.yaml ]; then
-        helm repo index ${CHARTS_DIR} --url ${GH_URL} --merge index.yaml
-      else
-        helm repo index ${CHARTS_DIR} --url ${GH_URL}
-      fi
-      git config user.name "Travis CI"
-      git config user.email "travis@travis-ci.org"
-      git add -f ${CHARTS_DIR}/*
-      git commit -m "Travis build: $TRAVIS_BUILD_NUMBER"
-      git remote add origin-pages https://${GH_TOKEN}@github.com/submariner-io/submariner-charts.git > /dev/null 2>&1
-      git push --quiet -f -u origin-pages gh-pages
-    fi
@@ -0,0 +1,3 @@
+# Code of Conduct
+
+Please see the [Code of Conduct docs on Submariner's website](https://submariner.io/community/code-of-conduct/).
@@ -1 +1 @@
-* @mangelajo @tpantelis @Oats87
+* @mangelajo @Oats87 @skitt @tpantelis
@@ -0,0 +1,3 @@
+# Contributing
+
+Please see the [Development docs on Submariner's website](https://submariner.io/development/).
@@ -6,8 +6,12 @@ include $(SHIPYARD_DIR)/Makefile.inc

 CLUSTER_SETTINGS_FLAG = --cluster_settings $(DAPPER_SOURCE)/cluster_settings
 override CLUSTERS_ARGS += $(CLUSTER_SETTINGS_FLAG)
-override DEPLOY_ARGS += $(CLUSTER_SETTINGS_FLAG) --deploytool helm
+override DEPLOY_ARGS += $(CLUSTER_SETTINGS_FLAG) --deploytool helm --deploytool_broker_args '--set submariner.serviceDiscovery=true'
 export DEPLOY_ARGS
+GH_URL=https://submariner-io.github.io/submariner-charts/charts
+CHARTS_DIR=charts
+CHARTS_VERSION=0.7.0
+REPO_URL=$(shell git config remote.origin.url)

 # Targets to make

@@ -24,7 +28,20 @@ preload-images:
 		import_image quay.io/submariner/$${image}; \
 	done

-.PHONY: preload-images
+%.tgz:
+	helm dep update $(subst -$(CHARTS_VERSION),,$(basename $(@F)))
+	helm package --version $(CHARTS_VERSION) $(subst -$(CHARTS_VERSION),,$(basename $(@F)))
+
+release: submariner-$(CHARTS_VERSION).tgz submariner-k8s-broker-$(CHARTS_VERSION).tgz submariner-operator-$(CHARTS_VERSION).tgz
+	git checkout gh-pages
+	mv *.tgz $(CHARTS_DIR)
+	if [ -f $(CHARTS_DIR)/index.yaml ]; then \
+	  helm repo index $(CHARTS_DIR) --url $(GH_URL) --merge $(CHARTS_DIR)/index.yaml; \
+	else \
+	  helm repo index $(CHARTS_DIR) --url $(GH_URL); \
+	fi
+
+.PHONY: preload-images release

 else

@@ -1,13 +1,13 @@
 # submariner-charts

-Please see the [Helm docs on Submariner's website](https://submariner.io/deployment/helm/).
+Please see the [Helm docs on Submariner's website](https://submariner.io/operations/deployment/helm/).

-## Dev workflow
+## Development workflow

 ### Prerequisites

- [helm]
- [docker] or [podman]
+- [Helm] v3
+- [Docker] or [Podman]

 ### Create a fork and checkout

@@ -21,96 +21,36 @@ cd submariner-charts
 git checkout -b new-feature
 ```

-Now you can modify the helm charts according to your needs.
-
-### Serve the modified charts
-
-Before serving the modified charts, the charts must be packaged for local usage.
-
-```bash
-helm package ./submariner
-helm package ./submariner-k8s-broker
-```
-
-Note: if you just installed helm, you have to init the helm, by running
-
-```bash
-helm init --client-only
-```
-
-Serve the packaged charts through a local helm repository:
-
-```bash
-docker run -d --rm --name helm-repo -p 8080:8080 -v $PWD:/charts -e DEBUG=true -e STORAGE=local -e STORAGE_LOCAL_ROOTDIR=/charts chartmuseum/chartmuseum
-```
-
-or
-
-```bash
-sudo podman run -d --rm --name helm-repo -p 8080:8080 -v $PWD:/charts -e DEBUG=true -e STORAGE=local -e STORAGE_LOCAL_ROOTDIR=/charts chartmuseum/chartmuseum
-```
-
-Get the container internal ip:
-
-```bash
-docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' helm-repo
-```
-
-The local container will serve the charts locally on port 8080.
-
-Get logs for the container:
-
-```bash
-docker logs -f helm-repo
-```
+Now you can modify the Helm charts according to your needs.

 ### Use the modified charts

-Init helm
+Locally-modified charts can be installed using `helm install`,
+referring to the local path; for example:

 ```bash
-helm init --client-only
+helm install submariner-k8s-broker ./submariner-k8s-broker ...
 ```

-Add your local repository to helm
+In the base directory of this repository, a local deployment using the
+local charts can be obtained by running the following command:

 ```bash
-internal_ip=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' helm-repo)
-helm repo add test-repo http://$internal_ip:8080
+make deploy
 ```

-List the repos:
+This will start two kind clusters and deploy Submariner using the
+Broker and Operator charts.

 ```bash
-helm repo list
+make e2e
 ```

-You should be able to see test-repo in the list
-
-Search the new repo for submariner charts:
-
-```bash
-helm search -l test-repo
-```
-
-### Modify submariner e2e tests helm deployment script to use your local test-repo
-
-You can test your helm-charts with e2e tests from the [shipyard](https://github.com/submariner-io/shipyard) repository.
-In the file `scripts/shared/lib/deploy_helm` change the line from:
-
-```bash
-helm repo add submariner-latest https://submariner-io.github.io/submariner-charts/charts
-```
-
-to
-
-```bash
-internal_ip=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' helm-repo)
-helm repo add submariner-latest http://$internal_ip:8080
-```
+will run the end-to-end test suite used to validate that Submariner is
+working correctly.

 <!--links-->
-[helm]: https://helm.sh/docs/using_helm/#installing-helm
-[docker]: https://docs.docker.com/install/
-[podman]: https://podman.io/getting-started/installation
+[Helm]: https://helm.sh/docs/using_helm/#installing-helm
+[Docker]: https://docs.docker.com/install/
+[Podman]: https://podman.io/getting-started/installation
 [Create a fork]: https://help.github.com/en/articles/fork-a-repo
@@ -9,22 +9,8 @@ readonly SUBMARINER_PSK=$(LC_CTYPE=C tr -dc 'a-zA-Z0-9' < /dev/urandom | fold -w

 ### Functions ###

-function install_helm() {
-    if kubectl -n kube-system rollout status deploy/tiller-deploy --timeout=3s > /dev/null 2>&1; then
-        echo "Helm already installed, skipping helm installation..."
-        return
-    fi
-
-    echo "Installing helm..."
-    kubectl -n kube-system create serviceaccount tiller
-    kubectl create clusterrolebinding tiller --clusterrole=cluster-admin --serviceaccount=kube-system:tiller
-    helm --kube-context "${cluster}" init --service-account tiller
-    kubectl -n kube-system rollout status deploy/tiller-deploy --timeout=30s
-}
-
 function deploytool_prereqs() {
-    helm init --client-only
-    run_all_clusters install_helm
+    helm version
 }

 function setup_broker() {
@@ -33,9 +19,9 @@ function setup_broker() {
    else
        echo "Installing submariner broker..."
        # shellcheck disable=SC2086 # Split on purpose
-        helm install ./submariner-k8s-broker \
+        helm install "${SUBMARINER_BROKER_NS}" ./submariner-k8s-broker \
+             --create-namespace \
             --kube-context "${cluster}" \
-             --name "${SUBMARINER_BROKER_NS}" \
             --namespace "${SUBMARINER_BROKER_NS}" \
             ${deploytool_broker_args}
    fi
@@ -56,14 +42,16 @@ function helm_install_subm() {

    echo "Installing Submariner..."
    # shellcheck disable=SC2086 # Split on purpose
-    helm --kube-context "${cluster}" install ./submariner-operator \
-        --name submariner-operator \
+    helm --kube-context "${cluster}" install submariner-operator \
+        ./submariner-operator \
+        --create-namespace \
        --namespace "${SUBM_NS}" \
        --set ipsec.psk="${SUBMARINER_PSK}" \
        --set broker.server="${submariner_broker_url}" \
        --set broker.token="${submariner_broker_token}" \
        --set broker.namespace="${SUBMARINER_BROKER_NS}" \
        --set broker.ca="${submariner_broker_ca}" \
+        --set submariner.cableDriver="${cable_driver}" \
        --set submariner.clusterId="${cluster}" \
        --set submariner.clusterCidr="${cluster_CIDRs[$cluster]}" \
        --set submariner.serviceCidr="${service_CIDRs[$cluster]}" \
@@ -0,0 +1,324 @@
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: clusters.submariner.io
+spec:
+  group: submariner.io
+  version: v1
+  names:
+    kind: Cluster
+    plural: clusters
+  scope: Namespaced
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: endpoints.submariner.io
+spec:
+  group: submariner.io
+  version: v1
+  names:
+    kind: Endpoint
+    plural: endpoints
+  scope: Namespaced
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: gateways.submariner.io
+spec:
+  group: submariner.io
+  version: v1
+  names:
+    kind: Gateway
+    plural: gateways
+  scope: Namespaced
+  additionalPrinterColumns:
+    - name: ha-status
+      type: string
+      description: High Availability Status of the Gateway
+      JSONPath: .status.haStatus
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: multiclusterservices.lighthouse.submariner.io
+spec:
+  group: lighthouse.submariner.io
+  version: v1
+  names:
+    kind: MultiClusterService
+    plural: multiclusterservices
+    singular: multiclusterservice
+  scope: Namespaced
+  validation:
+    openAPIV3Schema:
+      properties:
+        spec:
+          properties:
+            clusterServiceInfo:
+              properties:
+                clusterID:
+                  type: "string"
+                clusterDomain:
+                  type: "string"
+                serviceIP:
+                  type: "string"
+                port:
+                  type: "integer"
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: serviceexports.lighthouse.submariner.io
+spec:
+  group: lighthouse.submariner.io
+  version: v2alpha1
+  names:
+    kind: ServiceExport
+    plural: serviceexports
+    singular: serviceexport
+  scope: Namespaced
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: serviceimports.lighthouse.submariner.io
+spec:
+  group: lighthouse.submariner.io
+  version: v2alpha1
+  names:
+    kind: ServiceImport
+    plural: serviceimports
+    singular: serviceimport
+  scope: Namespaced
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: serviceexports.multicluster.x-k8s.io
+spec:
+  group: multicluster.x-k8s.io
+  scope: Namespaced
+  names:
+    plural: serviceexports
+    singular: serviceexport
+    kind: ServiceExport
+    shortNames:
+      - svcex
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      additionalPrinterColumns:
+        - name: Age
+          type: date
+          jsonPath: .metadata.creationTimestamp
+      "schema":
+        "openAPIV3Schema":
+          description: ServiceExport declares that the Service with the same name and
+            namespace as this export should be consumable from other clusters.
+          type: object
+          properties:
+            apiVersion:
+              description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+              type: string
+            kind:
+              description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+              type: string
+            metadata:
+              type: object
+            status:
+              description: status describes the current state of an exported service.
+                Service configuration comes from the Service that had the same name
+                and namespace as this ServiceExport. Populated by the multi-cluster
+                service implementation's controller.
+              type: object
+              properties:
+                conditions:
+                  type: array
+                  items:
+                    description: "ServiceExportCondition contains details for the current
+                    condition of this service export. \n Once [KEP-1623](https://github.com/kubernetes/enhancements/tree/master/keps/sig-api-machinery/1623-standardize-conditions)
+                    is implemented, this will be replaced by metav1.Condition."
+                    type: object
+                    required:
+                      - status
+                      - type
+                    properties:
+                      lastTransitionTime:
+                        type: string
+                        format: date-time
+                      message:
+                        type: string
+                      reason:
+                        type: string
+                      status:
+                        description: Status is one of {"True", "False", "Unknown"}
+                        type: string
+                        enum:
+                          - "True"
+                          - "False"
+                          - Unknown
+                      type:
+                        description: ServiceExportConditionType identifies a specific
+                          condition.
+                        type: string
+                  x-kubernetes-list-map-keys:
+                    - type
+                  x-kubernetes-list-type: map
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: serviceimports.multicluster.x-k8s.io
+spec:
+  group: multicluster.x-k8s.io
+  scope: Namespaced
+  names:
+    plural: serviceimports
+    singular: serviceimport
+    kind: ServiceImport
+    shortNames:
+      - svcim
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      additionalPrinterColumns:
+        - name: Type
+          type: string
+          description: The type of this ServiceImport
+          jsonPath: .spec.type
+        - name: IP
+          type: string
+          description: The VIP for this ServiceImport
+          jsonPath: .spec.ips
+        - name: Age
+          type: date
+          jsonPath: .metadata.creationTimestamp
+      "schema":
+        "openAPIV3Schema":
+          description: ServiceImport describes a service imported from clusters in a
+            ClusterSet.
+          type: object
+          properties:
+            apiVersion:
+              description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+              type: string
+            kind:
+              description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: spec defines the behavior of a ServiceImport.
+              type: object
+              required:
+                - ports
+                - type
+              properties:
+                ips:
+                  description: ip will be used as the VIP for this service when type
+                    is ClusterSetIP.
+                  type: array
+                  maxItems: 1
+                  items:
+                    type: string
+                ports:
+                  type: array
+                  items:
+                    description: ServicePort represents the port on which the service
+                      is exposed
+                    type: object
+                    required:
+                      - port
+                    properties:
+                      appProtocol:
+                        description: The application protocol for this port. This field
+                          follows standard Kubernetes label syntax. Un-prefixed names
+                          are reserved for IANA standard service names (as per RFC-6335
+                          and http://www.iana.org/assignments/service-names). Non-standard
+                          protocols should use prefixed names such as mycompany.com/my-custom-protocol.
+                          Field can be enabled with ServiceAppProtocol feature gate.
+                        type: string
+                      name:
+                        description: The name of this port within the service. This
+                          must be a DNS_LABEL. All ports within a ServiceSpec must have
+                          unique names. When considering the endpoints for a Service,
+                          this must match the 'name' field in the EndpointPort. Optional
+                          if only one ServicePort is defined on this service.
+                        type: string
+                      port:
+                        description: The port that will be exposed by this service.
+                        type: integer
+                        format: int32
+                      protocol:
+                        description: The IP protocol for this port. Supports "TCP",
+                          "UDP", and "SCTP". Default is TCP.
+                        type: string
+                  x-kubernetes-list-type: atomic
+                sessionAffinity:
+                  description: 'Supports "ClientIP" and "None". Used to maintain session
+                  affinity. Enable client IP based session affinity. Must be ClientIP
+                  or None. Defaults to None. Ignored when type is Headless More info:
+                  https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies'
+                  type: string
+                sessionAffinityConfig:
+                  description: sessionAffinityConfig contains session affinity configuration.
+                  type: object
+                  properties:
+                    clientIP:
+                      description: clientIP contains the configurations of Client IP
+                        based session affinity.
+                      type: object
+                      properties:
+                        timeoutSeconds:
+                          description: timeoutSeconds specifies the seconds of ClientIP
+                            type session sticky time. The value must be >0 && <=86400(for
+                            1 day) if ServiceAffinity == "ClientIP". Default value is
+                            10800(for 3 hours).
+                          type: integer
+                          format: int32
+                type:
+                  description: type defines the type of this service. Must be ClusterSetIP
+                    or Headless.
+                  type: string
+                  enum:
+                    - ClusterSetIP
+                    - Headless
+            status:
+              description: status contains information about the exported services that
+                form the multi-cluster service referenced by this ServiceImport.
+              type: object
+              properties:
+                clusters:
+                  description: clusters is the list of exporting clusters from which
+                    this service was derived.
+                  type: array
+                  items:
+                    description: ClusterStatus contains service configuration mapped
+                      to a specific source cluster
+                    type: object
+                    required:
+                      - cluster
+                    properties:
+                      cluster:
+                        description: cluster is the name of the exporting cluster. Must
+                          be a valid RFC-1123 DNS label.
+                        type: string
+                  x-kubernetes-list-map-keys:
+                    - cluster
+                  x-kubernetes-list-type: map
@@ -1,166 +0,0 @@
-{{- if .Values.crd.create -}}
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: clusters.submariner.io
-  annotations:
-    "helm.sh/hook": crd-install
-spec:
-  group: submariner.io
-  version: v1
-  names:
-    kind: Cluster
-    plural: clusters
-  scope: Namespaced
---
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: endpoints.submariner.io
-  annotations:
-    "helm.sh/hook": crd-install
-spec:
-  group: submariner.io
-  version: v1
-  names:
-    kind: Endpoint
-    plural: endpoints
-  scope: Namespaced
---
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: gateways.submariner.io
-  annotations:
-    "helm.sh/hook": crd-install
-spec:
-  group: submariner.io
-  version: v1
-  names:
-    kind: Gateway
-    plural: gateways
-  scope: Namespaced
-  additionalPrinterColumns:
-    - name: ha-status
-      type: string
-      description: High Availability Status of the Gateway
-      JSONPath: .status.haStatus
---
-{{- if .Values.submariner.serviceDiscovery }}
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: multiclusterservices.lighthouse.submariner.io
-  annotations:
-    "helm.sh/hook": crd-install
-spec:
-  group: lighthouse.submariner.io
-  version: v1
-  names:
-    kind: MultiClusterService
-    plural: multiclusterservices
-    singular: multiclusterservice
-  scope: Namespaced
-  validation:
-    openAPIV3Schema:
-      properties:
-        spec:
-          properties:
-            clusterServiceInfo:
-              properties:
-                clusterID:
-                  type: "string"
-                clusterDomain:
-                  type: "string"
-                serviceIP:
-                  type: "string"
-                port:
-                  type: "integer"
---
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: serviceexports.lighthouse.submariner.io
-  annotations:
-    "helm.sh/hook": crd-install
-spec:
-  group: lighthouse.submariner.io
-  version: v2alpha1
-  names:
-    kind: ServiceExport
-    plural: serviceexports
-    singular: serviceexport
-  scope: Namespaced
---
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: serviceimports.lighthouse.submariner.io
-  annotations:
-    "helm.sh/hook": crd-install
-spec:
-  group: lighthouse.submariner.io
-  version: v2alpha1
-  names:
-    kind: ServiceImport
-    plural: serviceimports
-    singular: serviceimport
-  scope: Namespaced
---
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  name: serviceexports.multicluster.x-k8s.io
-  annotations:
-    "helm.sh/hook": crd-install
-spec:
-  group: multicluster.x-k8s.io
-  scope: Namespaced
-  names:
-    plural: serviceexports
-    singular: serviceexport
-    kind: ServiceExport
-    shortNames:
-      - svcex
-  versions:
-    - name: v1alpha1
-      served: true
-      storage: true
-  additionalPrinterColumns:
-    - name: Age
-      type: date
-      jsonPath: .metadata.creationTimestamp
---
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  name: serviceimports.multicluster.x-k8s.io
-  annotations:
-    "helm.sh/hook": crd-install
-spec:
-  group: multicluster.x-k8s.io
-  scope: Namespaced
-  names:
-    plural: serviceimports
-    singular: serviceimport
-    kind: ServiceImport
-    shortNames:
-      - svcim
-  versions:
-    - name: v1alpha1
-      served: true
-      storage: true
-  additionalPrinterColumns:
-    - name: Type
-      type: string
-      description: The type of this ServiceImport
-      jsonPath: .spec.type
-    - name: IP
-      type: string
-      description: The VIP for this ServiceImport
-      jsonPath: .spec.ips
-    - name: Age
-      type: date
-      jsonPath: .metadata.creationTimestamp
-{{- end -}}
-{{- end -}}
@@ -4,7 +4,6 @@ kind: CustomResourceDefinition
 metadata:
  name: submariners.submariner.io
  annotations:
-    "helm.sh/hook": crd-install
    controller-gen.kubebuilder.io/version: v0.3.0
 spec:
  group: submariner.io
@@ -721,3 +720,158 @@ status:
    plural: ""
  conditions: []
  storedVersions: []
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.3.0
+  creationTimestamp: null
+  name: servicediscoveries.submariner.io
+spec:
+  group: submariner.io
+  names:
+    kind: ServiceDiscovery
+    listKind: ServiceDiscoveryList
+    plural: servicediscoveries
+    singular: servicediscovery
+  scope: Namespaced
+  versions:
+    - name: v1alpha1
+      schema:
+        openAPIV3Schema:
+          description: ServiceDiscovery is the Schema for the servicediscoveries API
+          properties:
+            apiVersion:
+              description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+              type: string
+            kind:
+              description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: ServiceDiscoverySpec defines the desired state of ServiceDiscovery
+              properties:
+                brokerK8sApiServer:
+                  type: string
+                brokerK8sApiServerToken:
+                  type: string
+                brokerK8sCA:
+                  type: string
+                brokerK8sRemoteNamespace:
+                  type: string
+                clusterID:
+                  type: string
+                customDomains:
+                  items:
+                    type: string
+                  type: array
+                  x-kubernetes-list-type: set
+                debug:
+                  type: boolean
+                globalnetEnabled:
+                  type: boolean
+                imageOverrides:
+                  additionalProperties:
+                    type: string
+                  type: object
+                namespace:
+                  type: string
+                repository:
+                  type: string
+                version:
+                  type: string
+              required:
+                - brokerK8sApiServer
+                - brokerK8sApiServerToken
+                - brokerK8sCA
+                - brokerK8sRemoteNamespace
+                - clusterID
+                - debug
+                - namespace
+              type: object
+            status:
+              description: ServiceDiscoveryStatus defines the observed state of ServiceDiscovery
+              type: object
+          type: object
+      served: true
+      storage: true
+      subresources:
+        status: {}
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.3.0
+  creationTimestamp: null
+  name: brokers.submariner.io
+spec:
+  group: submariner.io
+  names:
+    kind: Broker
+    listKind: BrokerList
+    plural: brokers
+    singular: broker
+  scope: Namespaced
+  versions:
+    - name: v1alpha1
+      schema:
+        openAPIV3Schema:
+          description: Broker is the Schema for the brokers API
+          properties:
+            apiVersion:
+              description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+              type: string
+            kind:
+              description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: BrokerSpec defines the desired state of Broker
+              properties:
+                components:
+                  items:
+                    type: string
+                  type: array
+                defaultCustomDomains:
+                  items:
+                    type: string
+                  type: array
+                defaultGlobalnetClusterSize:
+                  type: integer
+                globalnetCIDRRange:
+                  type: string
+                globalnetEnabled:
+                  type: boolean
+              type: object
+            status:
+              description: BrokerStatus defines the observed state of Broker
+              type: object
+          type: object
+      served: true
+      storage: true
+      subresources:
+        status: {}
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: []
+  storedVersions: []
@@ -92,6 +92,13 @@ questions:
  label: "Service CIDR"
  group: "CIDR Configuration"
  required: true
+- variable: submariner.globalCidr
+  default: ""
+  description: "Enter the globalnet CIDR (i.e. 169.254.1.0/24) for this cluster if using globalnet"
+  type: string
+  label: "Globalnet CIDR"
+  group: "CIDR Configuration"
+  required: false
 - variable: submariner.natEnabled
  type: boolean
  default: false
@@ -47,7 +47,7 @@ Create the name of the submariner-engine service account to use
 */}}
 {{- define "submariner.engineServiceAccountName" -}}
 {{- if .Values.serviceAccounts.engine.create -}}
-    {{ default (printf "%s-engine" (include "submariner.fullname" .)) .Values.serviceAccounts.engine.name }}
+    {{ default "submariner-engine" .Values.serviceAccounts.engine.name }}
 {{- else -}}
    {{ default "default" .Values.serviceAccounts.engine.name }}
 {{- end -}}
@@ -58,7 +58,7 @@ Create the name of the submariner-route-agent service account to use
 */}}
 {{- define "submariner.routeAgentServiceAccountName" -}}
 {{- if .Values.serviceAccounts.routeAgent.create -}}
-    {{ default (printf "%s-routeagent" (include "submariner.fullname" .)) .Values.serviceAccounts.routeAgent.name }}
+    {{ default "submariner-routeagent" .Values.serviceAccounts.routeAgent.name }}
 {{- else -}}
    {{ default "default" .Values.serviceAccounts.routeAgent.name }}
 {{- end -}}
@@ -69,20 +69,31 @@ Create the name of the submariner-globalnet service account to use
 */}}
 {{- define "submariner.globalnetServiceAccountName" -}}
 {{- if .Values.serviceAccounts.globalnet.create -}}
-    {{ default (printf "%s:globalnet" (include "submariner.fullname" .)) .Values.serviceAccounts.globalnet.name }}
+    {{ default "submariner-globalnet" .Values.serviceAccounts.globalnet.name }}
 {{- else -}}
    {{ default "default" .Values.serviceAccounts.globalnet.name }}
 {{- end -}}
 {{- end -}}

 {{/*
-Create the name of the submariner-lighthouse service account to use
+Create the name of the submariner-lighthouse-agent service account to use
 */}}
-{{- define "submariner.lighthouseServiceAccountName" -}}
-{{- if .Values.submariner.serviceDiscovery -}}
-    {{ default (printf "%s-lighthouse" (include "submariner.fullname" .)) .Values.serviceAccounts.lighthouse.name }}
+{{- define "submariner.lighthouseAgentServiceAccountName" -}}
+{{- if and (.Values.submariner.serviceDiscovery ) (.Values.serviceAccounts.lighthouseAgent.create) -}}
+    {{ default "submariner-lighthouse-agent" .Values.serviceAccounts.lighthouseAgent.name }}
 {{- else -}}
-    {{ default "default" .Values.serviceAccounts.lighthouse.name }}
+    {{ default "default" .Values.serviceAccounts.lighthouseAgent.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create the name of the submariner-lighthouse-coredns service account to use
+*/}}
+{{- define "submariner.lighthouseCoreDnsServiceAccountName" -}}
+{{- if and (.Values.submariner.serviceDiscovery ) (.Values.serviceAccounts.lighthouseCoreDns.create) -}}
+    {{ default "submariner-lighthouse-coredns" .Values.serviceAccounts.lighthouseCoreDns.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccounts.lighthouseCoreDns.name }}
 {{- end -}}
 {{- end -}}

@@ -77,7 +77,7 @@ metadata:
    app: {{ template "submariner.name" . }}
 subjects:
 - kind: ServiceAccount
-  name: {{ template "submariner.fullname" . }}
+  name: {{ template "submariner.operatorServiceAccountName" . }}
 roleRef:
  kind: Role
  name: {{ template "submariner.fullname" . }}
@@ -93,15 +93,75 @@ metadata:
    chart: {{ template "submariner.chart" . }}
    app: {{ template "submariner.name" . }}
 rules:
- apiGroups: [""]
-  resources: ["configmaps"]
-  verbs: ["create", "get", "list", "watch", "patch", "update"]
- apiGroups: ["submariner.io"]
-  resources: ["clusters", "endpoints", "gateways"]
-  verbs: ["create", "get", "list", "watch", "patch", "update", "delete"]
- apiGroups: [""]
-  resources: ["events"]
-  verbs: ["create", "patch"]
+- apiGroups:
+    - ""
+  resources:
+    - pods
+    - services
+    - services/finalizers
+    - endpoints
+    - persistentvolumeclaims
+    - events
+    - configmaps
+    - secrets
+  verbs:
+    - '*'
+- apiGroups:
+    - apps
+  resources:
+    - deployments
+    - daemonsets
+    - replicasets
+    - statefulsets
+  verbs:
+    - '*'
+- apiGroups:
+    - monitoring.coreos.com
+  resources:
+    - servicemonitors
+  verbs:
+    - get
+    - create
+- apiGroups:
+    - apps
+  resourceNames:
+    - submariner-operator
+  resources:
+    - deployments/finalizers
+  verbs:
+    - update
+- apiGroups:
+    - ""
+  resources:
+    - pods
+  verbs:
+    - get
+- apiGroups:
+    - apps
+  resources:
+    - replicasets
+  verbs:
+    - get
+- apiGroups:
+    - submariner.io
+  resources:
+    - '*'
+    - servicediscoveries
+  verbs:
+    - '*'
+- apiGroups:
+    - lighthouse.submariner.io
+  resources:
+    - '*'
+    - serviceexports
+  verbs:
+    - create
+    - delete
+    - get
+    - list
+    - patch
+    - update
+    - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -118,7 +178,7 @@ roleRef:
  name: {{ template "submariner.fullname" . }}:engine
 subjects:
 - kind: ServiceAccount
-  name: {{ template "submariner.operatorServiceAccountName" . }}
+  name: {{ template "submariner.engineServiceAccountName" . }}
  namespace: {{ .Release.Namespace }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -131,12 +191,75 @@ metadata:
    chart: {{ template "submariner.chart" . }}
    app: {{ template "submariner.name" . }}
 rules:
- apiGroups: ["submariner.io"]
-  resources: ["clusters", "endpoints", "gateways"]
-  verbs: ["create", "get", "list", "watch", "patch", "update"]
- apiGroups: [""]
-  resources: ["pods"]
-  verbs: ["get", "watch", "list"]
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+      - services
+      - services/finalizers
+      - endpoints
+      - persistentvolumeclaims
+      - events
+      - configmaps
+      - secrets
+    verbs:
+      - '*'
+  - apiGroups:
+      - apps
+    resources:
+      - deployments
+      - daemonsets
+      - replicasets
+      - statefulsets
+    verbs:
+      - '*'
+  - apiGroups:
+      - monitoring.coreos.com
+    resources:
+      - servicemonitors
+    verbs:
+      - get
+      - create
+  - apiGroups:
+      - apps
+    resourceNames:
+      - submariner-operator
+    resources:
+      - deployments/finalizers
+    verbs:
+      - update
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - get
+  - apiGroups:
+      - apps
+    resources:
+      - replicasets
+    verbs:
+      - get
+  - apiGroups:
+      - submariner.io
+    resources:
+      - '*'
+      - servicediscoveries
+    verbs:
+      - '*'
+  - apiGroups:
+      - lighthouse.submariner.io
+    resources:
+      - '*'
+      - serviceexports
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -153,9 +276,109 @@ roleRef:
  name: {{ template "submariner.fullname" . }}:routeagent
 subjects:
 - kind: ServiceAccount
-  name: {{ template "submariner.operatorServiceAccountName" . }}
+  name: {{ template "submariner.routeAgentServiceAccountName" . }}
  namespace: {{ .Release.Namespace }}
 ---
+{{- if ne .Values.submariner.globalCidr "" }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ template "submariner.fullname" . }}:globalnet
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+      - services
+      - services/finalizers
+      - endpoints
+      - persistentvolumeclaims
+      - events
+      - configmaps
+      - secrets
+    verbs:
+      - '*'
+  - apiGroups:
+      - apps
+    resources:
+      - deployments
+      - daemonsets
+      - replicasets
+      - statefulsets
+    verbs:
+      - '*'
+  - apiGroups:
+      - monitoring.coreos.com
+    resources:
+      - servicemonitors
+    verbs:
+      - get
+      - create
+  - apiGroups:
+      - apps
+    resourceNames:
+      - submariner-operator
+    resources:
+      - deployments/finalizers
+    verbs:
+      - update
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - get
+  - apiGroups:
+      - apps
+    resources:
+      - replicasets
+    verbs:
+      - get
+  - apiGroups:
+      - submariner.io
+    resources:
+      - '*'
+      - servicediscoveries
+    verbs:
+      - '*'
+  - apiGroups:
+      - lighthouse.submariner.io
+    resources:
+      - '*'
+      - serviceexports
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:globalnet
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "submariner.fullname" . }}:globalnet
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "submariner.globalnetServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+---
+{{- end -}}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
@@ -169,24 +392,50 @@ rules:
  # submariner-operator updates the config map of core-dns to forward requests to
  # clusterset.local to Lighthouse DNS, also looks at existing configmaps
  # to figure out network settings
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    verbs: ["get", "list", "watch", "update"]
-  - apiGroups: ["apiextensions.k8s.io"]
-    resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "create", "update", "delete"]
-  - apiGroups: [""] # pods and services are looked up to figure out network settings
-    resources: ["pods", "services"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["operator.openshift.io"]
-    resources: ["dnses"]
-    verbs: ["get", "list", "watch", "update"]
-  - apiGroups: ["config.openshift.io"]
-    resources: ["networks"]
-    verbs: ["get", "list"]
-  - apiGroups: ["multicluster.x-k8s.io"]
-    resources: ["*"]
-    verbs: ["create", "get", "list", "watch", "update", "delete"]
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions
+    verbs:
+      - get
+      - list
+      - create
+      - update
+      - delete
+  - apiGroups:  # pods and services are looked up to figure out network settings
+      - ""
+    resources:
+      - pods
+      - services
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - operator.openshift.io
+    resources:
+      - dnses
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - config.openshift.io
+    resources:
+      - networks
+    verbs:
+      - get
+      - list
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -208,6 +457,91 @@ roleRef:
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
+metadata:
+  name: {{ template "submariner.fullname" . }}:engine
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions
+    verbs:
+      - get
+      - list
+      - create
+      - update
+      - delete
+  - apiGroups:  # pods and services are looked up to figure out network settings
+      - ""
+    resources:
+      - pods
+      - services
+      - nodes
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - operator.openshift.io
+    resources:
+      - dnses
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - config.openshift.io
+    resources:
+      - networks
+    verbs:
+      - get
+      - list
+  - apiGroups:
+      - submariner.io
+    resources:
+      - endpoints
+      - gateways
+      - clusters
+    verbs:
+      - get
+      - list
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:engine
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "submariner.fullname" . }}:engine
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "submariner.engineServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
 metadata:
  name: {{ template "submariner.fullname" . }}:routeagent
  labels:
@@ -216,9 +550,59 @@ metadata:
    chart: {{ template "submariner.chart" . }}
    app: {{ template "submariner.name" . }}
 rules:
-  - apiGroups: [""]
-    resources: ["nodes"]
-    verbs: ["get", "update"]
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions
+    verbs:
+      - get
+      - list
+      - create
+      - update
+      - delete
+  - apiGroups:  # pods and services are looked up to figure out network settings
+      - ""
+    resources:
+      - pods
+      - services
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - operator.openshift.io
+    resources:
+      - dnses
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - config.openshift.io
+    resources:
+      - networks
+    verbs:
+      - get
+      - list
+  - apiGroups:
+      - ""
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+    resources:
+      - nodes
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -235,9 +619,10 @@ roleRef:
  name: {{ template "submariner.fullname" . }}:routeagent
 subjects:
  - kind: ServiceAccount
-    name: {{ template "submariner.operatorServiceAccountName" . }}
+    name: {{ template "submariner.routeAgentServiceAccountName" . }}
    namespace: {{ .Release.Namespace }}
 ---
+{{- if ne .Values.submariner.globalCidr "" }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
@@ -248,13 +633,37 @@ metadata:
    chart: {{ template "submariner.chart" . }}
    app: {{ template "submariner.name" . }}
 rules:
- apiGroups: [""]
-  resources: ["services", "namespaces", "pods", "nodes"]
-  verbs: ["get", "list", "watch", "update"]
- apiGroups: ["submariner.io"]
-  resources: ["clusters", "endpoints", "gateways"]
-  verbs: ["get", "list", "watch"]
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+      - services
+      - namespaces
+      - nodes
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - submariner.io
+    resources:
+      - endpoints
+      - clusters
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - multicluster.x-k8s.io
+    resources:
+      - "serviceexports"
+    verbs:
+      - get
+      - list
+      - watch
 ---
+{{- end -}}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
@@ -270,37 +679,67 @@ roleRef:
  name: {{ template "submariner.fullname" . }}:globalnet
 subjects:
 - kind: ServiceAccount
-  name: {{ template "submariner.operatorServiceAccountName" . }}
+  name: {{ template "submariner.globalnetServiceAccountName" . }}
  namespace: {{ .Release.Namespace }}
 ---
 {{- if .Values.submariner.serviceDiscovery }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: {{ template "submariner.fullname" . }}:lighthouse
+  name: {{ template "submariner.fullname" . }}:lighthouse-agent
  labels:
    heritage: {{ .Release.Service | quote }}
    release: {{ .Release.Name | quote }}
    chart: {{ template "submariner.chart" . }}
    app: {{ template "submariner.name" . }}
 rules:
-  - apiGroups: [""]
-    resources: ["services", "namespaces", "configmaps", "endpoints"]
-    verbs: ["get", "list", "watch", "update"]
-  - apiGroups: ["discovery.k8s.io"]
-    resources: ["endpointslices"]
-    verbs: ["create", "get", "list", "watch", "update", "delete"]
-  - apiGroups: ["lighthouse.submariner.io"]
-    resources: ["*"]
-    verbs: ["create", "get", "list", "watch", "update", "delete"]
-  - apiGroups: ["submariner.io"]
-    resources: ["gateways"]
-    verbs: ["get", "list", "watch"]
+  - apiGroups:
+      - ""
+    resources:
+      - services
+      - namespaces
+      - endpoints
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - discovery.k8s.io
+    resources:
+      - endpointslices
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - delete
+      - deletecollection
+  - apiGroups:
+      - submariner.io
+    resources:
+      - "gateways"
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - multicluster.x-k8s.io
+    resources:
+      - "*"
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - delete
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: {{ template "submariner.fullname" . }}:lighthouse
+  name: {{ template "submariner.fullname" . }}:lighthouse-agent
  labels:
    heritage: {{ .Release.Service | quote }}
    release: {{ .Release.Name | quote }}
@@ -309,10 +748,82 @@ metadata:
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
-  name: {{ template "submariner.fullname" . }}:lighthouse
+  name: {{ template "submariner.fullname" . }}:lighthouse-agent
 subjects:
  - kind: ServiceAccount
-    name: {{ template "submariner.operatorServiceAccountName" . }}
+    name: {{ template "submariner.lighthouseAgentServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "submariner.fullname" . }}:lighthouse-coredns
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - services
+      - namespaces
+      - endpoints
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - discovery.k8s.io
+    resources:
+      - endpointslices
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - delete
+      - deletecollection
+  - apiGroups:
+      - lighthouse.submariner.io
+    resources:
+      - "*"
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - delete
+  - apiGroups:
+      - submariner.io
+    resources:
+      - "gateways"
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - multicluster.x-k8s.io
+    resources:
+      - "*"
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - delete
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:lighthouse-coredns
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "submariner.fullname" . }}:lighthouse-coredns
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }}
    namespace: {{ .Release.Namespace }}
 {{- end -}}
 {{- end -}}
@@ -22,3 +22,5 @@ spec:
  repository: {{ .Values.submariner.images.repository }}
  version: {{ .Values.submariner.images.tag }}
  serviceCIDR: "{{ .Values.submariner.serviceCidr }}"
+  globalCIDR: "{{ .Values.submariner.globalCidr }}"
+  serviceDiscoveryEnabled: {{ .Values.submariner.serviceDiscovery }}
@@ -46,14 +46,26 @@ metadata:
    app: {{ template "submariner.name" . }}
 {{- end }}
 ---
-{{- if .Values.serviceAccounts.lighthouse.create }}
+{{- if .Values.serviceAccounts.lighthouseAgent.create }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ template "submariner.lighthouseServiceAccountName" . }}
+  name: {{ template "submariner.lighthouseAgentServiceAccountName" . }}
  labels:
    heritage: {{ .Release.Service | quote }}
    release: {{ .Release.Name | quote }}
    chart: {{ template "submariner.chart" . }}
    app: {{ template "submariner.name" . }}
 {{- end }}
+---
+  {{- if .Values.serviceAccounts.lighthouseCoreDns.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+  {{- end }}
@@ -54,6 +54,9 @@ serviceAccounts:
  globalnet:
    create: true
    name: ""
-  lighthouse:
-    create: false
+  lighthouseAgent:
+    create: true
+    name: ""
+  lighthouseCoreDns:
+    create: true
    name: ""
@@ -0,0 +1,324 @@
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: clusters.submariner.io
+spec:
+  group: submariner.io
+  version: v1
+  names:
+    kind: Cluster
+    plural: clusters
+  scope: Namespaced
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: endpoints.submariner.io
+spec:
+  group: submariner.io
+  version: v1
+  names:
+    kind: Endpoint
+    plural: endpoints
+  scope: Namespaced
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: gateways.submariner.io
+spec:
+  group: submariner.io
+  version: v1
+  names:
+    kind: Gateway
+    plural: gateways
+  scope: Namespaced
+  additionalPrinterColumns:
+  - name: ha-status
+    type: string
+    description: High Availability Status of the Gateway
+    JSONPath: .status.haStatus
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: multiclusterservices.lighthouse.submariner.io
+spec:
+  group: lighthouse.submariner.io
+  version: v1
+  names:
+    kind: MultiClusterService
+    plural: multiclusterservices
+    singular: multiclusterservice
+  scope: Namespaced
+  validation:
+    openAPIV3Schema:
+      properties:
+        spec:
+          properties:
+            clusterServiceInfo:
+              properties:
+                clusterID:
+                  type: "string"
+                clusterDomain:
+                  type: "string"
+                serviceIP:
+                  type: "string"
+                port:
+                  type: "integer"
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: serviceexports.lighthouse.submariner.io
+spec:
+  group: lighthouse.submariner.io
+  version: v2alpha1
+  names:
+    kind: ServiceExport
+    plural: serviceexports
+    singular: serviceexport
+  scope: Namespaced
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: serviceimports.lighthouse.submariner.io
+spec:
+  group: lighthouse.submariner.io
+  version: v2alpha1
+  names:
+    kind: ServiceImport
+    plural: serviceimports
+    singular: serviceimport
+  scope: Namespaced
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: serviceexports.multicluster.x-k8s.io
+spec:
+  group: multicluster.x-k8s.io
+  scope: Namespaced
+  names:
+    plural: serviceexports
+    singular: serviceexport
+    kind: ServiceExport
+    shortNames:
+      - svcex
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      additionalPrinterColumns:
+        - name: Age
+          type: date
+          jsonPath: .metadata.creationTimestamp
+      "schema":
+        "openAPIV3Schema":
+          description: ServiceExport declares that the Service with the same name and
+            namespace as this export should be consumable from other clusters.
+          type: object
+          properties:
+            apiVersion:
+              description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+              type: string
+            kind:
+              description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+              type: string
+            metadata:
+              type: object
+            status:
+              description: status describes the current state of an exported service.
+                Service configuration comes from the Service that had the same name
+                and namespace as this ServiceExport. Populated by the multi-cluster
+                service implementation's controller.
+              type: object
+              properties:
+                conditions:
+                  type: array
+                  items:
+                    description: "ServiceExportCondition contains details for the current
+                    condition of this service export. \n Once [KEP-1623](https://github.com/kubernetes/enhancements/tree/master/keps/sig-api-machinery/1623-standardize-conditions)
+                    is implemented, this will be replaced by metav1.Condition."
+                    type: object
+                    required:
+                      - status
+                      - type
+                    properties:
+                      lastTransitionTime:
+                        type: string
+                        format: date-time
+                      message:
+                        type: string
+                      reason:
+                        type: string
+                      status:
+                        description: Status is one of {"True", "False", "Unknown"}
+                        type: string
+                        enum:
+                          - "True"
+                          - "False"
+                          - Unknown
+                      type:
+                        description: ServiceExportConditionType identifies a specific
+                          condition.
+                        type: string
+                  x-kubernetes-list-map-keys:
+                    - type
+                  x-kubernetes-list-type: map
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: serviceimports.multicluster.x-k8s.io
+spec:
+  group: multicluster.x-k8s.io
+  scope: Namespaced
+  names:
+    plural: serviceimports
+    singular: serviceimport
+    kind: ServiceImport
+    shortNames:
+      - svcim
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      additionalPrinterColumns:
+        - name: Type
+          type: string
+          description: The type of this ServiceImport
+          jsonPath: .spec.type
+        - name: IP
+          type: string
+          description: The VIP for this ServiceImport
+          jsonPath: .spec.ips
+        - name: Age
+          type: date
+          jsonPath: .metadata.creationTimestamp
+      "schema":
+        "openAPIV3Schema":
+          description: ServiceImport describes a service imported from clusters in a
+            ClusterSet.
+          type: object
+          properties:
+            apiVersion:
+              description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+              type: string
+            kind:
+              description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: spec defines the behavior of a ServiceImport.
+              type: object
+              required:
+                - ports
+                - type
+              properties:
+                ips:
+                  description: ip will be used as the VIP for this service when type
+                    is ClusterSetIP.
+                  type: array
+                  maxItems: 1
+                  items:
+                    type: string
+                ports:
+                  type: array
+                  items:
+                    description: ServicePort represents the port on which the service
+                      is exposed
+                    type: object
+                    required:
+                      - port
+                    properties:
+                      appProtocol:
+                        description: The application protocol for this port. This field
+                          follows standard Kubernetes label syntax. Un-prefixed names
+                          are reserved for IANA standard service names (as per RFC-6335
+                          and http://www.iana.org/assignments/service-names). Non-standard
+                          protocols should use prefixed names such as mycompany.com/my-custom-protocol.
+                          Field can be enabled with ServiceAppProtocol feature gate.
+                        type: string
+                      name:
+                        description: The name of this port within the service. This
+                          must be a DNS_LABEL. All ports within a ServiceSpec must have
+                          unique names. When considering the endpoints for a Service,
+                          this must match the 'name' field in the EndpointPort. Optional
+                          if only one ServicePort is defined on this service.
+                        type: string
+                      port:
+                        description: The port that will be exposed by this service.
+                        type: integer
+                        format: int32
+                      protocol:
+                        description: The IP protocol for this port. Supports "TCP",
+                          "UDP", and "SCTP". Default is TCP.
+                        type: string
+                  x-kubernetes-list-type: atomic
+                sessionAffinity:
+                  description: 'Supports "ClientIP" and "None". Used to maintain session
+                  affinity. Enable client IP based session affinity. Must be ClientIP
+                  or None. Defaults to None. Ignored when type is Headless More info:
+                  https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies'
+                  type: string
+                sessionAffinityConfig:
+                  description: sessionAffinityConfig contains session affinity configuration.
+                  type: object
+                  properties:
+                    clientIP:
+                      description: clientIP contains the configurations of Client IP
+                        based session affinity.
+                      type: object
+                      properties:
+                        timeoutSeconds:
+                          description: timeoutSeconds specifies the seconds of ClientIP
+                            type session sticky time. The value must be >0 && <=86400(for
+                            1 day) if ServiceAffinity == "ClientIP". Default value is
+                            10800(for 3 hours).
+                          type: integer
+                          format: int32
+                type:
+                  description: type defines the type of this service. Must be ClusterSetIP
+                    or Headless.
+                  type: string
+                  enum:
+                    - ClusterSetIP
+                    - Headless
+            status:
+              description: status contains information about the exported services that
+                form the multi-cluster service referenced by this ServiceImport.
+              type: object
+              properties:
+                clusters:
+                  description: clusters is the list of exporting clusters from which
+                    this service was derived.
+                  type: array
+                  items:
+                    description: ClusterStatus contains service configuration mapped
+                      to a specific source cluster
+                    type: object
+                    required:
+                      - cluster
+                    properties:
+                      cluster:
+                        description: cluster is the name of the exporting cluster. Must
+                          be a valid RFC-1123 DNS label.
+                        type: string
+                  x-kubernetes-list-map-keys:
+                    - cluster
+                  x-kubernetes-list-type: map
@@ -36,7 +36,7 @@ Create the name of the submariner-engine service account to use
 */}}
 {{- define "submariner.engineServiceAccountName" -}}
 {{- if .Values.serviceAccounts.engine.create -}}
-    {{ default (printf "%s-engine" (include "submariner.fullname" .)) .Values.serviceAccounts.engine.name }}
+    {{ default "submariner-engine" .Values.serviceAccounts.engine.name }}
 {{- else -}}
    {{ default "default" .Values.serviceAccounts.engine.name }}
 {{- end -}}
@@ -47,7 +47,7 @@ Create the name of the submariner-route-agent service account to use
 */}}
 {{- define "submariner.routeAgentServiceAccountName" -}}
 {{- if .Values.serviceAccounts.routeAgent.create -}}
-    {{ default (printf "%s-routeagent" (include "submariner.fullname" .)) .Values.serviceAccounts.routeAgent.name }}
+    {{ default "submariner-routeagent" .Values.serviceAccounts.routeAgent.name }}
 {{- else -}}
    {{ default "default" .Values.serviceAccounts.routeAgent.name }}
 {{- end -}}
@@ -58,20 +58,31 @@ Create the name of the submariner-globalnet service account to use
 */}}
 {{- define "submariner.globalnetServiceAccountName" -}}
 {{- if .Values.serviceAccounts.globalnet.create -}}
-    {{ default (printf "%s-globalnet" (include "submariner.fullname" .)) .Values.serviceAccounts.globalnet.name }}
+    {{ default "submariner-globalnet" .Values.serviceAccounts.globalnet.name }}
 {{- else -}}
    {{ default "default" .Values.serviceAccounts.globalnet.name }}
 {{- end -}}
 {{- end -}}

 {{/*
-Create the name of the submariner-lighthouse service account to use
+Create the name of the submariner-lighthouse-agent service account to use
 */}}
-{{- define "submariner.lighthouseServiceAccountName" -}}
-{{- if .Values.submariner.serviceDiscovery -}}
-    {{ default (printf "%s-lighthouse" (include "submariner.fullname" .)) .Values.serviceAccounts.lighthouse.name }}
+{{- define "submariner.lighthouseAgentServiceAccountName" -}}
+{{- if and (.Values.submariner.serviceDiscovery ) (.Values.serviceAccounts.lighthouseAgent.create) -}}
+    {{ default "submariner-lighthouse-agent" .Values.serviceAccounts.lighthouseAgent.name }}
 {{- else -}}
-    {{ default "default" .Values.serviceAccounts.lighthouse.name }}
+    {{ default "default" .Values.serviceAccounts.lighthouseAgent.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create the name of the submariner-lighthouse-coredns service account to use
+*/}}
+{{- define "submariner.lighthouseCoreDnsServiceAccountName" -}}
+{{- if and (.Values.submariner.serviceDiscovery ) (.Values.serviceAccounts.lighthouseCoreDns.create) -}}
+    {{ default "submariner-lighthouse-coredns" .Values.serviceAccounts.lighthouseCoreDns.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccounts.lighthouseCoreDns.name }}
 {{- end -}}
 {{- end -}}

@@ -1,166 +0,0 @@
-{{- if .Values.crd.create -}}
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: clusters.submariner.io
-  annotations:
-    "helm.sh/hook": crd-install
-spec:
-  group: submariner.io
-  version: v1
-  names:
-    kind: Cluster
-    plural: clusters
-  scope: Namespaced
---
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: endpoints.submariner.io
-  annotations:
-    "helm.sh/hook": crd-install
-spec:
-  group: submariner.io
-  version: v1
-  names:
-    kind: Endpoint
-    plural: endpoints
-  scope: Namespaced
---
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: gateways.submariner.io
-  annotations:
-    "helm.sh/hook": crd-install
-spec:
-  group: submariner.io
-  version: v1
-  names:
-    kind: Gateway
-    plural: gateways
-  scope: Namespaced
-  additionalPrinterColumns:
-  - name: ha-status
-    type: string
-    description: High Availability Status of the Gateway
-    JSONPath: .status.haStatus
---
-{{- if .Values.submariner.serviceDiscovery }}
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: multiclusterservices.lighthouse.submariner.io
-  annotations:
-    "helm.sh/hook": crd-install
-spec:
-  group: lighthouse.submariner.io
-  version: v1
-  names:
-    kind: MultiClusterService
-    plural: multiclusterservices
-    singular: multiclusterservice
-  scope: Namespaced
-  validation:
-    openAPIV3Schema:
-      properties:
-        spec:
-          properties:
-            clusterServiceInfo:
-              properties:
-                clusterID:
-                  type: "string"
-                clusterDomain:
-                  type: "string"
-                serviceIP:
-                  type: "string"
-                port:
-                  type: "integer"
---
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: serviceexports.lighthouse.submariner.io
-  annotations:
-    "helm.sh/hook": crd-install
-spec:
-  group: lighthouse.submariner.io
-  version: v2alpha1
-  names:
-    kind: ServiceExport
-    plural: serviceexports
-    singular: serviceexport
-  scope: Namespaced
---
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: serviceimports.lighthouse.submariner.io
-  annotations:
-    "helm.sh/hook": crd-install
-spec:
-  group: lighthouse.submariner.io
-  version: v2alpha1
-  names:
-    kind: ServiceImport
-    plural: serviceimports
-    singular: serviceimport
-  scope: Namespaced
---
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  name: serviceexports.multicluster.x-k8s.io
-  annotations:
-    "helm.sh/hook": crd-install
-spec:
-  group: multicluster.x-k8s.io
-  scope: Namespaced
-  names:
-    plural: serviceexports
-    singular: serviceexport
-    kind: ServiceExport
-    shortNames:
-      - svcex
-  versions:
-    - name: v1alpha1
-      served: true
-      storage: true
-  additionalPrinterColumns:
-    - name: Age
-      type: date
-      jsonPath: .metadata.creationTimestamp
---
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  name: serviceimports.multicluster.x-k8s.io
-  annotations:
-    "helm.sh/hook": crd-install
-spec:
-  group: multicluster.x-k8s.io
-  scope: Namespaced
-  names:
-    plural: serviceimports
-    singular: serviceimport
-    kind: ServiceImport
-    shortNames:
-      - svcim
-  versions:
-    - name: v1alpha1
-      served: true
-      storage: true
-  additionalPrinterColumns:
-    - name: Type
-      type: string
-      description: The type of this ServiceImport
-      jsonPath: .spec.type
-    - name: IP
-      type: string
-      description: The VIP for this ServiceImport
-      jsonPath: .spec.ips
-    - name: Age
-      type: date
-      jsonPath: .metadata.creationTimestamp
-{{- end }}
-{{- end -}}
@@ -108,6 +108,10 @@ spec:
          value: "{{ .Values.leadership.renewDeadline }}"
        - name: LEADERSHIP_RETRYPERIOD
          value: "{{ .Values.leadership.retryPeriod }}"
+        - name: NODE_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: "spec.nodeName"
        image: {{ .Values.engine.image.repository }}:{{ default .Chart.AppVersion .Values.engine.image.tag }}
        imagePullPolicy: {{ .Values.engine.image.pullPolicy }}
        name: submariner
@@ -29,29 +29,33 @@ spec:
      nodeSelector:
        submariner.io/gateway: 'true'
      containers:
-        - name: {{ template "submariner.fullname" . }}-globalnet
-          image: {{ .Values.globalnet.image.repository }}:{{  default .Chart.AppVersion .Values.globalnet.image.tag }}
-          imagePullPolicy: {{ .Values.globalnet.image.pullPolicy }}
-          env:
-            - name: SUBMARINER_CLUSTERID
-              value: '{{ .Values.submariner.clusterId }}'
-            - name: SUBMARINER_EXCLUDENS
-              value: 'submariner-operator,kube-system,operators'
-            - name: SUBMARINER_NAMESPACE
-              value: '{{ .Release.Namespace }}'
-          securityContext:
-            allowPrivilegeEscalation: true
-            capabilities:
-              add:
-                - ALL
-            privileged: true
-            readOnlyRootFilesystem: false
-            runAsNonRoot: false
-          volumeMounts:
-            # Because we don't actually run iptables locally, but chroot in to the host
-            - mountPath: /host
-              name: host-slash
-              readOnly: true
+      - name: {{ template "submariner.fullname" . }}-globalnet
+        image: {{ .Values.globalnet.image.repository }}:{{  default .Chart.AppVersion .Values.globalnet.image.tag }}
+        imagePullPolicy: {{ .Values.globalnet.image.pullPolicy }}
+        env:
+          - name: SUBMARINER_CLUSTERID
+            value: '{{ .Values.submariner.clusterId }}'
+          - name: SUBMARINER_EXCLUDENS
+            value: 'submariner-operator,kube-system,operators,openshift-monitoring,openshift-dns'
+          - name: SUBMARINER_NAMESPACE
+            value: '{{ .Release.Namespace }}'
+          - name: NODE_NAME
+            valueFrom:
+              fieldRef:
+                fieldPath: "spec.nodeName"
+        securityContext:
+          allowPrivilegeEscalation: true
+          capabilities:
+            add:
+              - ALL
+          privileged: true
+          readOnlyRootFilesystem: false
+          runAsNonRoot: false
+        volumeMounts:
+          # Because we don't actually run iptables locally, but chroot in to the host
+          - mountPath: /host
+            name: host-slash
+            readOnly: true
      volumes:
        - name: host-slash
          hostPath:
@@ -30,7 +30,7 @@ spec:
            - mountPath: /etc/coredns
              name: config-volume
              readOnly: true
-      serviceAccountName: {{ template "submariner.lighthouseServiceAccountName" . }}
+      serviceAccountName: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }}
      volumes:
        - configMap:
            defaultMode: 420
@@ -19,7 +19,7 @@ spec:
      labels:
        app: {{ template "submariner.fullname" . }}-lighthouse-agent
    spec:
-      serviceAccountName: {{ template "submariner.lighthouseServiceAccountName" . }}
+      serviceAccountName: {{ template "submariner.lighthouseAgentServiceAccountName" . }}
      containers:
      - command:
        - lighthouse-agent.sh
@@ -9,15 +9,93 @@ metadata:
    chart: {{ template "submariner.chart" . }}
    app: {{ template "submariner.name" . }}
 rules:
- apiGroups: [""]
-  resources: ["configmaps"]
-  verbs: ["create", "get", "list", "watch", "patch", "update"]
- apiGroups: ["submariner.io"]
-  resources: ["clusters", "endpoints", "gateways"]
-  verbs: ["create", "get", "list", "watch", "patch", "update", "delete"]
- apiGroups: [""]
-  resources: ["events"]
-  verbs: ["create", "patch"]
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+      - services
+      - services/finalizers
+      - endpoints
+      - persistentvolumeclaims
+      - events
+      - configmaps
+      - secrets
+    verbs:
+      - '*'
+  - apiGroups:
+      - apps
+    resources:
+      - deployments
+      - daemonsets
+      - replicasets
+      - statefulsets
+    verbs:
+      - '*'
+  - apiGroups:
+      - monitoring.coreos.com
+    resources:
+      - servicemonitors
+    verbs:
+      - get
+      - create
+  - apiGroups:
+      - apps
+    resourceNames:
+      - submariner-operator
+    resources:
+      - deployments/finalizers
+    verbs:
+      - update
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - get
+  - apiGroups:
+      - apps
+    resources:
+      - replicasets
+    verbs:
+      - get
+  - apiGroups:
+      - submariner.io
+    resources:
+      - '*'
+      - servicediscoveries
+    verbs:
+      - '*'
+  - apiGroups:
+      - lighthouse.submariner.io
+    resources:
+      - '*'
+      - serviceexports
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:engine
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "submariner.fullname" . }}:engine
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "submariner.engineServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
@@ -29,52 +107,353 @@ metadata:
    chart: {{ template "submariner.chart" . }}
    app: {{ template "submariner.name" . }}
 rules:
- apiGroups: ["submariner.io"]
-  resources: ["clusters", "endpoints", "gateways"]
-  verbs: ["create", "get", "list", "watch", "patch", "update"]
- apiGroups: [""]
-  resources: ["pods"]
-  verbs: ["get", "watch", "list"]
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ template "submariner.fullname" . }}:engine
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ template "submariner.fullname" . }}:engine
-subjects:
- kind: ServiceAccount
-  name: {{ template "submariner.engineServiceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+      - services
+      - services/finalizers
+      - endpoints
+      - persistentvolumeclaims
+      - events
+      - configmaps
+      - secrets
+    verbs:
+      - '*'
+  - apiGroups:
+      - apps
+    resources:
+      - deployments
+      - daemonsets
+      - replicasets
+      - statefulsets
+    verbs:
+      - '*'
+  - apiGroups:
+      - monitoring.coreos.com
+    resources:
+      - servicemonitors
+    verbs:
+      - get
+      - create
+  - apiGroups:
+      - apps
+    resourceNames:
+      - submariner-operator
+    resources:
+      - deployments/finalizers
+    verbs:
+      - update
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - get
+  - apiGroups:
+      - apps
+    resources:
+      - replicasets
+    verbs:
+      - get
+  - apiGroups:
+      - submariner.io
+    resources:
+      - '*'
+      - servicediscoveries
+    verbs:
+      - '*'
+  - apiGroups:
+      - lighthouse.submariner.io
+    resources:
+      - '*'
+      - serviceexports
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
  name: {{ template "submariner.fullname" . }}:routeagent
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: {{ template "submariner.fullname" . }}:routeagent
 subjects:
- kind: ServiceAccount
-  name: {{ template "submariner.routeAgentServiceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
+  - kind: ServiceAccount
+    name: {{ template "submariner.routeAgentServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+---
+{{- if ne .Values.submariner.globalCidr "" }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ template "submariner.fullname" . }}:globalnet
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+      - services
+      - services/finalizers
+      - endpoints
+      - persistentvolumeclaims
+      - events
+      - configmaps
+      - secrets
+    verbs:
+      - '*'
+  - apiGroups:
+      - apps
+    resources:
+      - deployments
+      - daemonsets
+      - replicasets
+      - statefulsets
+    verbs:
+      - '*'
+  - apiGroups:
+      - monitoring.coreos.com
+    resources:
+      - servicemonitors
+    verbs:
+      - get
+      - create
+  - apiGroups:
+      - apps
+    resourceNames:
+      - submariner-operator
+    resources:
+      - deployments/finalizers
+    verbs:
+      - update
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - get
+  - apiGroups:
+      - apps
+    resources:
+      - replicasets
+    verbs:
+      - get
+  - apiGroups:
+      - submariner.io
+    resources:
+      - '*'
+      - servicediscoveries
+    verbs:
+      - '*'
+  - apiGroups:
+      - lighthouse.submariner.io
+    resources:
+      - '*'
+      - serviceexports
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:globalnet
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "submariner.fullname" . }}:globalnet
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "submariner.globalnetServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+---
+{{- end -}}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "submariner.fullname" . }}:engine
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions
+    verbs:
+      - get
+      - list
+      - create
+      - update
+      - delete
+  - apiGroups:  # pods and services are looked up to figure out network settings
+      - ""
+    resources:
+      - pods
+      - services
+      - nodes
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - operator.openshift.io
+    resources:
+      - dnses
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - config.openshift.io
+    resources:
+      - networks
+    verbs:
+      - get
+      - list
+  - apiGroups:
+      - submariner.io
+    resources:
+      - endpoints
+      - gateways
+      - clusters
+    verbs:
+      - get
+      - list
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:engine
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "submariner.fullname" . }}:engine
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "submariner.engineServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
  name: {{ template "submariner.fullname" . }}:routeagent
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
 rules:
-  - apiGroups: [""]
-    resources: ["nodes"]
-    verbs: ["get", "update"]
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions
+    verbs:
+      - get
+      - list
+      - create
+      - update
+      - delete
+  - apiGroups:  # pods and services are looked up to figure out network settings
+      - ""
+    resources:
+      - pods
+      - services
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - operator.openshift.io
+    resources:
+      - dnses
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - config.openshift.io
+    resources:
+      - networks
+    verbs:
+      - get
+      - list
+  - apiGroups:
+      - ""
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+    resources:
+      - nodes
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
  name: {{ template "submariner.fullname" . }}:routeagent
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
@@ -89,61 +468,203 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
  name: {{ template "submariner.fullname" . }}:globalnet
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
 rules:
- apiGroups: [""]
-  resources: ["services", "namespaces", "pods", "nodes"]
-  verbs: ["get", "list", "watch", "update"]
- apiGroups: ["submariner.io"]
-  resources: ["clusters", "endpoints", "gateways"]
-  verbs: ["get", "list", "watch"]
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+      - services
+      - namespaces
+      - nodes
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - submariner.io
+    resources:
+      - endpoints
+      - clusters
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - multicluster.x-k8s.io
+    resources:
+      - "serviceexports"
+    verbs:
+      - get
+      - list
+      - watch
 ---
+{{- end -}}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
  name: {{ template "submariner.fullname" . }}:globalnet
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: {{ template "submariner.fullname" . }}:globalnet
 subjects:
- kind: ServiceAccount
-  name: {{ template "submariner.globalnetServiceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
+  - kind: ServiceAccount
+    name: {{ template "submariner.globalnetServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
 ---
-{{- end -}}
 {{- if .Values.submariner.serviceDiscovery }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: {{ template "submariner.fullname" . }}:lighthouse
+  name: {{ template "submariner.fullname" . }}:lighthouse-agent
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
 rules:
-  - apiGroups: [""]
-    resources: ["services", "namespaces", "configmaps", "endpoints"]
-    verbs: ["get", "list", "watch", "update"]
-  - apiGroups: ["discovery.k8s.io"]
-    resources: ["endpointslices"]
-    verbs: ["create", "get", "list", "watch", "update", "delete", "deletecollection"]
-  - apiGroups: ["lighthouse.submariner.io"]
-    resources: ["*"]
-    verbs: ["create", "get", "list", "watch", "update", "delete"]
-  - apiGroups: ["submariner.io"]
-    resources: ["gateways"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["multicluster.x-k8s.io"]
-    resources: ["*"]
-    verbs: ["create", "get", "list", "watch", "update", "delete"]
+  - apiGroups:
+      - ""
+    resources:
+      - services
+      - namespaces
+      - endpoints
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - discovery.k8s.io
+    resources:
+      - endpointslices
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - delete
+      - deletecollection
+  - apiGroups:
+      - submariner.io
+    resources:
+      - "gateways"
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - multicluster.x-k8s.io
+    resources:
+      - "*"
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - delete
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: {{ template "submariner.fullname" . }}:lighthouse
+  name: {{ template "submariner.fullname" . }}:lighthouse-agent
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
-  name: {{ template "submariner.fullname" . }}:lighthouse
+  name: {{ template "submariner.fullname" . }}:lighthouse-agent
 subjects:
  - kind: ServiceAccount
-    name: {{ template "submariner.lighthouseServiceAccountName" . }}
+    name: {{ template "submariner.lighthouseAgentServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "submariner.fullname" . }}:lighthouse-coredns
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - services
+      - namespaces
+      - endpoints
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - discovery.k8s.io
+    resources:
+      - endpointslices
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - delete
+      - deletecollection
+  - apiGroups:
+      - lighthouse.submariner.io
+    resources:
+      - "*"
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - delete
+  - apiGroups:
+      - submariner.io
+    resources:
+      - "gateways"
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - multicluster.x-k8s.io
+    resources:
+      - "*"
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - delete
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "submariner.fullname" . }}:lighthouse-coredns
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "submariner.fullname" . }}:lighthouse-coredns
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }}
    namespace: {{ .Release.Namespace }}
 {{- end -}}
 {{- end -}}
@@ -41,10 +41,14 @@ spec:
          value: "{{ .Values.submariner.clusterId }}"
        - name: SUBMARINER_DEBUG
          value: "{{ .Values.submariner.debug }}"
-        - name: SUBMARINER_CLUSTERCIDR                                                                                                                                                        
+        - name: SUBMARINER_CLUSTERCIDR
          value: "{{ .Values.submariner.clusterCidr }}"
        - name: SUBMARINER_SERVICECIDR
          value: "{{ .Values.submariner.serviceCidr }}"
+        - name: NODE_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: "spec.nodeName"
        resources:
 {{ toYaml .Values.routeAgent.resources | indent 10 }}
        securityContext:
@@ -34,14 +34,26 @@ metadata:
    app: {{ template "submariner.name" . }}
 {{- end }}
 ---
-{{- if .Values.serviceAccounts.lighthouse.create }}
+{{- if .Values.serviceAccounts.lighthouseAgent.create }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ template "submariner.lighthouseServiceAccountName" . }}
+  name: {{ template "submariner.lighthouseAgentServiceAccountName" . }}
  labels:
    heritage: {{ .Release.Service | quote }}
    release: {{ .Release.Name | quote }}
    chart: {{ template "submariner.chart" . }}
    app: {{ template "submariner.name" . }}
 {{- end }}
+---
+{{- if .Values.serviceAccounts.lighthouseCoreDns.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "submariner.chart" . }}
+    app: {{ template "submariner.name" . }}
+  {{- end }}
@@ -72,8 +72,11 @@ serviceAccounts:
    create: true
    name: ""
  globalnet:
-    create: false
+    create: true
    name: ""
-  lighthouse:
-    create: false
+  lighthouseAgent:
+    create: true
+    name: ""
+  lighthouseCoreDns:
+    create: true
    name: ""
Author	SHA1	Message	Date
Miguel Angel Ajo	f8dc2dc5d1	Enable globalnet E2E matrix Signed-off-by: Miguel Angel Ajo <majopela@redhat.com>	2021-02-24 14:39:49 +01:00
Miguel Angel Ajo	d7b3ab6204	Add globalCidr mappings to the submariner template also includes the questions.yaml which is UI. Signed-off-by: Miguel Angel Ajo <majopela@redhat.com>	2021-02-24 14:29:16 +01:00
Steve MattarandMiguel Angel Ajo Pelayo	cce1bf6494	fix(crd): add the missing service discovery crd Signed-off-by: Steve Mattar <smattar@redhat.com>	2021-02-24 12:45:03 +01:00
Steve MattarandMiguel Angel Ajo Pelayo	83177c8083	fix(crd): add the broker crd Signed-off-by: Steve Mattar <smattar@redhat.com>	2021-02-24 12:45:03 +01:00
Steve MattarandGitHub	7f2d832e6f	fix(rbac): sa and rbac definitions (#117 ) Sync the SA and RBAC definitions with what we have in submariner-operator. Signed-off-by: Steve Mattar <smattar@redhat.com>	2021-02-23 16:08:55 +01:00
Daniel FarrellandStephen Kitt	c1177daa36	Use shared GHAs from Shipyard Run the E2E tests using Submariner's custom GitHub Actions. Signed-off-by: Daniel Farrell <dfarrell@redhat.com>	2021-02-08 09:47:58 +01:00
Stephen KittandThomas Pantelis	af9332cb53	Track the devel branch for release Signed-off-by: Stephen Kitt <skitt@redhat.com>	2021-02-05 08:23:55 -05:00
Daniel FarrellandDaniel Farrell	ad064a97b2	Add git commit message linting As implemented and configured in other Submariner repos. Signed-off-by: Daniel Farrell <dfarrell@redhat.com>	2021-02-02 08:49:25 -06:00
Daniel FarrellandStephen Kitt	8754508eb0	Add .dapper and .shflags to gitignore Both are generated by our standard make commands, both are ignored in other Submariner repos. Signed-off-by: Daniel Farrell <dfarrell@redhat.com>	2021-02-02 14:02:52 +01:00
Daniel FarrellandThomas Pantelis	472ad44a87	Use markdownlint from Shipyard Instead of an external GitHub action, use the same markdownlint make target from Shipyard that we use in other repos. Signed-off-by: Daniel Farrell <dfarrell@redhat.com>	2021-02-01 16:42:35 -05:00
Stephen KittandThomas Pantelis	0d566a4104	Use the PR base branch as reference when linting To determine the changed files, the Markdown linter needs to know the base branch; instead of using the default everywhere, use the base branch set in the PR. Signed-off-by: Stephen Kitt <skitt@redhat.com>	2021-01-21 09:49:13 -05:00
Aswin SuryanarayananandGitHub	83aeade0cc	Add a cluster role for submariner-engine serivce-account The submainer-engine now access the node object as part of golbalnet-healthcheck support and the required roles are added Signed-off-by: Aswin Surayanarayanan <asuryana@redhat.com>	2021-01-14 10:33:21 +01:00
Sridhar GaddamandStephen Kitt	69a435efb3	Update GatewayEngine Pod env with the host nodeName Related to: https://github.com/submariner-io/submariner/issues/1068 Signed-Off-by: Sridhar Gaddam <sgaddam@redhat.com>	2021-01-12 11:11:34 +01:00
Sridhar GaddamandStephen Kitt	54b9fab7f0	Fix broken globalnet helm jobs Signed-Off-by: Sridhar Gaddam <sgaddam@redhat.com>	2021-01-04 09:09:39 +01:00
Sridhar GaddamandStephen Kitt	9946eeb071	Update Globalnet Pod env with the host nodeName Related to: https://github.com/submariner-io/submariner/issues/970 Signed-Off-by: Sridhar Gaddam <sgaddam@redhat.com>	2020-12-24 14:06:14 +01:00
Daniel FarrellandStephen Kitt	6edd0a2f10	Fix all broken links Signed-off-by: Daniel Farrell <dfarrell@redhat.com>	2020-12-17 15:44:34 +01:00
Daniel FarrellandStephen Kitt	701ad09f63	Fix periodic broken link test issue reporting Use new GHA for reporting issues when broken links are detected. This logic was verified to work by the frequently-run flaky test finder. Signed-off-by: Daniel Farrell <dfarrell@redhat.com>	2020-12-17 15:10:59 +01:00
Stephen KittandThomas Pantelis	8a670ad49d	Set the serviceDiscoveryEnabled flag This allows the e2e tests to complete successfully. Signed-off-by: Stephen Kitt <skitt@redhat.com>	2020-12-17 08:21:41 -05:00
Stephen KittandThomas Pantelis	59bc056f99	Update the instructions for Helm v3 With v3, we no longer need to initialise Helm or even provide a local repository; the charts can be installed directly. We now support make deploy and make e2e too, document that. Signed-off-by: Stephen Kitt <skitt@redhat.com>	2020-12-09 13:07:07 -05:00
Daniel FarrellandStephen Kitt	433ff8347e	Set cable driver flag passed from Shipyard Relates-to: submariner-io/shipyard#364 Signed-off-by: Daniel Farrell <dfarrell@redhat.com>	2020-12-09 15:26:10 +01:00
nyechielandStephen Kitt	c22af2a996	Update README file Signed-off-by: nyechiel <nyechiel@redhat.com>	2020-11-23 11:51:43 +01:00
Sridhar GaddamandThomas Pantelis	c5ab3dd7d7	Include ClusterRole for routeagent to list nodes In the new event framework we use node listeners to support certain use-cases. Currently in helm, routeagent does not have that role, so e2e tests are failing. This PR enables it. Related to: https://github.com/submariner-io/submariner/issues/858 Signed-Off-by: Sridhar Gaddam <sgaddam@redhat.com>	2020-11-20 12:35:59 -05:00
Stephen KittandThomas Pantelis	33cbc85f50	Ensure we overwrite charts when necessary Currently, we lose updated charts when we check the gh-pages branch out. This patch generates the charts in the base directory, and moves them into place after checking the target branch out. Signed-off-by: Stephen Kitt <skitt@redhat.com>	2020-11-18 12:32:01 -05:00
Sridhar GaddamandThomas Pantelis	f108705710	Update route-agent Pod env with the host nodeName Related to: https://github.com/submariner-io/submariner-operator/issues/835 Signed-Off-by: Sridhar Gaddam <sgaddam@redhat.com>	2020-11-18 09:38:26 -05:00
Sridhar GaddamandStephen Kitt	8f2bed6191	Exclude openshift-dns namespace in Globalnet In an OCP Cluster, openshift-dns namespace has dns-default service and this is controlled by its operator. When Globalnet is deployed on OCP, it was seen that globalip annotation added to it is periodically getting deleted by the operator, so Globalnet tries to re-add the annotation and this goes on forever. This will cause Globalnet to consume CPU unnecessarily and could affect user-experience with Submariner Globalnet. We have plans to enhance Globalnet to improve its scalability, but until then we can exclude annotating services in openshift-dns namespace. Signed-Off-by: Sridhar Gaddam <sgaddam@redhat.com>	2020-11-18 14:21:11 +01:00
Sridhar GaddamandStephen Kitt	5407e97cd3	Exclude openshift-monitoring namespace in Globalnet In an OCP Cluster, openshift-monitoring namespace has couple of services and these are controlled by their respective operators. When Globalnet is deployed on OCP, it was seen that globalip annotation added to such services are periodically getting deleted by the operators, so Globalnet tries to re-add the annotation and this goes on forever. This will cause Globalnet to consume CPU unnecessarily and could affect user-experience with Submariner Globalnet. We have plans to enhance Globalnet to improve its scalability, but until then we can exclude annotating services in openshift-monitoring namespace. Signed-Off-by: Sridhar Gaddam <sgaddam@redhat.com>	2020-11-18 14:21:11 +01:00
Stephen KittandMiguel Angel Ajo Pelayo	672e55f528	Revert to the default Helm version Now that Shipyard ships Helm 3, remove our overrides. Signed-off-by: Stephen Kitt <skitt@redhat.com>	2020-11-18 11:47:58 +01:00
Stephen KittandThomas Pantelis	03e931d203	Release charts manually This replicates the process used in the old Travis configuration to publish updated charts. Signed-off-by: Stephen Kitt <skitt@redhat.com>	2020-11-16 09:56:28 -05:00
Stephen KittandThomas Pantelis	ca2e3cd29a	Add myself as a code owner Following https://groups.google.com/u/1/g/submariner-dev/c/1lAmi0IwDgc Signed-off-by: Stephen Kitt <skitt@redhat.com>	2020-11-13 16:49:13 -05:00
Stephen KittandMiguel Angel Ajo Pelayo	5906cfb3dc	Switch to Helm v3 This allows us to deploy v1 CRDs such as the upstream MCS API CRDs. Fixes: #47 Signed-off-by: Stephen Kitt <skitt@redhat.com>	2020-11-13 12:31:30 +01:00
Vishal ThaparandMiguel Angel Ajo Pelayo	44374a709c	Enable serviceDiscovery for broker install This is to test installation of MCS API CRDs on broker Signed-off-by: Vishal Thapar <5137689+vthapar@users.noreply.github.com>	2020-11-13 12:31:30 +01:00
Vishal ThaparandMiguel Angel Ajo Pelayo	59ab112b29	Fix MCS API CRDs Update the MCS API CRDs as per definition in https://github.com/kubernetes-sigs/mcs-api/tree/master/config/crd Signed-off-by: Vishal Thapar <5137689+vthapar@users.noreply.github.com>	2020-11-13 12:31:30 +01:00
Stephen KittandThomas Pantelis	34cd37c4c0	Check out the full history for chart-releaser chart-releaser looks at the project history to determine whether a chart changed, we mustn't limit the fetch depth. Signed-off-by: Stephen Kitt <skitt@redhat.com>	2020-11-12 14:03:55 -05:00
Stephen KittandThomas Pantelis	aa2cd102f1	Fix the chart-releaser-action version Signed-off-by: Stephen Kitt <skitt@redhat.com>	2020-11-12 07:26:28 -05:00
Stephen KittandMiguel Angel Ajo Pelayo	1ae567356b	Fix the globalnet SAs SA names can't include ':', revert to '-' as used in the old charts. Signed-off-by: Stephen Kitt <skitt@redhat.com>	2020-11-12 12:04:20 +01:00
Stephen KittandStephen Kitt	7ffc2bb663	Add an e2e GHA For now this only uses the default deployment. Signed-off-by: Stephen Kitt <skitt@redhat.com>	2020-11-10 18:45:33 +01:00
Daniel FarrellandThomas Pantelis	c31bf71824	Remove Travis CI All tests and release work has been transferred to run on GitHub Actions, like the rest of Subariner's repos. Signed-off-by: Daniel Farrell <dfarrell@redhat.com>	2020-11-10 12:33:30 -05:00
Daniel FarrellandThomas Pantelis	7ead45df85	Release Helm charts via helm/chart-releaser GHA Use the official Helm chart releasing GitHub Action instead of our custom bash. Travis CI can be removed after this commit, as all tests will have equivalents for GHAs. Closes: #71 Signed-off-by: Daniel Farrell <dfarrell@redhat.com>	2020-11-10 12:33:30 -05:00
Daniel FarrellandStephen Kitt	ea49a9c47a	Add CODE-OF-CONDUCT.md, point to website It seems most CNCF projects provide a CODE-OF-CONDUCT.md file at the root of their repositories, even if they have their Code of Conduct on their website. To better fit into the CNCF ecosystem and be a more welcoming project, follow that pattern. Relates-to: submariner-io/submariner#804 Signed-off-by: Daniel Farrell <dfarrell@redhat.com>	2020-11-10 17:54:06 +01:00
Daniel FarrellandStephen Kitt	9a4f6bbfea	Add CONTRIBUTING.md, point to website It seems most CNCF projects provide a CONTRIBUTING.md file at the root of their repositories, even if they have their contributing docs on their website. To better fit into the CNCF ecosystem and be a more welcoming project, follow that pattern. Relates-to: submariner-io/submariner#804 Signed-off-by: Daniel Farrell <dfarrell@redhat.com>	2020-11-10 17:54:06 +01:00
nyechielandThomas Pantelis	e207ef8e4a	Add templates for bugs/enhancements/support Signed-off-by: nyechiel <nyechiel@redhat.com>	2020-11-10 11:41:01 -05:00
Vishal ThaparandThomas Pantelis	71926ccfe3	Add `openAPIV3Schema` fields to MCS CRDS Signed-off-by: Vishal Thapar <5137689+vthapar@users.noreply.github.com>	2020-11-10 07:53:49 -05:00