mirror of
https://github.com/submariner-io/submariner-charts.git
synced 2026-09-20 21:30:35 +00:00
Sridhar Gaddam
c31d14f3c2
Submariner-route-agent daemonset pod needs to query the list of other sm-route-agent pods in the cluster for their hostIP addresses. The ipaddress will be used as remote VxLAN Vtep IPs. Currently, sm-route-agent pod does not have the necessary privileges to list the pods in the submariner namespace of local cluster. This patch addresses this issue by adding the necessary role. Error seen: Failed to list *v1.Pod: pods is forbidden: User "system:serviceaccount:submariner:submariner-routeagent" cannot list resource "pods" in API group "" in the namespace "submariner"
65 lines
1.9 KiB
YAML
65 lines
1.9 KiB
YAML
{{- if .Values.rbac.create -}}
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: {{ template "submariner.fullname" . }}:engine
|
|
labels:
|
|
heritage: {{ .Release.Service | quote }}
|
|
release: {{ .Release.Name | quote }}
|
|
chart: {{ template "submariner.chart" . }}
|
|
app: {{ template "submariner.name" . }}
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["configmaps"]
|
|
verbs: ["create", "get", "list", "watch", "patch", "update"]
|
|
- apiGroups: ["submariner.io"]
|
|
resources: ["clusters", "endpoints"]
|
|
verbs: ["create", "get", "list", "watch", "patch", "update", "delete"]
|
|
- apiGroups: [""]
|
|
resources: ["events"]
|
|
verbs: ["create", "patch"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: {{ template "submariner.fullname" . }}:routeagent
|
|
labels:
|
|
heritage: {{ .Release.Service | quote }}
|
|
release: {{ .Release.Name | quote }}
|
|
chart: {{ template "submariner.chart" . }}
|
|
app: {{ template "submariner.name" . }}
|
|
rules:
|
|
- apiGroups: ["submariner.io"]
|
|
resources: ["clusters", "endpoints"]
|
|
verbs: ["create", "get", "list", "watch", "patch", "update"]
|
|
- apiGroups: [""]
|
|
resources: ["pods"]
|
|
verbs: ["get", "watch", "list"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: {{ template "submariner.fullname" . }}:engine
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: {{ template "submariner.fullname" . }}:engine
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: {{ template "submariner.engineServiceAccountName" . }}
|
|
namespace: {{ .Release.Namespace }}
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: {{ template "submariner.fullname" . }}:routeagent
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: {{ template "submariner.fullname" . }}:routeagent
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: {{ template "submariner.routeAgentServiceAccountName" . }}
|
|
namespace: {{ .Release.Namespace }}
|
|
{{- end -}}
|