mirror of
https://github.com/submariner-io/submariner-charts.git
synced 2026-09-21 22:00:35 +00:00
Tom PantelisandStephen Kitt
351fbb475c
On Openshift, the operator failed with error "\"submariner-gateway\" is forbidden: cannot set blockOwnerDeletion if an ownerReference refers to a resource you can't set finalizers on" Openshift enables OwnerReferencesPermissionEnforcement, so in order to set blockOwnerDeletion for an object, the user needs update permission for the finalizers subresource of the referenced owner. In this case the owner is the Submariner object. Signed-off-by: Tom Pantelis <tompantelis@gmail.com>
747 lines
16 KiB
YAML
747 lines
16 KiB
YAML
{{- if .Values.rbac.create -}}
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: {{ template "submariner.fullname" . }}
|
|
labels:
|
|
heritage: {{ .Release.Service | quote }}
|
|
release: {{ .Release.Name | quote }}
|
|
chart: {{ template "submariner.chart" . }}
|
|
app: {{ template "submariner.name" . }}
|
|
rules:
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
# For metrics
|
|
- services
|
|
verbs:
|
|
- get
|
|
- create
|
|
- update
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
# For syncing Secrets from the broker
|
|
- secrets
|
|
verbs:
|
|
- get
|
|
- create
|
|
- update
|
|
- delete
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
# Temporarily needed for network-plugin syncer removal
|
|
- serviceaccounts
|
|
resourceNames:
|
|
- submariner-networkplugin-syncer
|
|
verbs:
|
|
- delete
|
|
- apiGroups:
|
|
- apps
|
|
resources:
|
|
- deployments
|
|
- daemonsets
|
|
verbs:
|
|
- create
|
|
- delete
|
|
- get
|
|
- list
|
|
- patch
|
|
- update
|
|
- watch
|
|
- apiGroups:
|
|
- monitoring.coreos.com
|
|
resources:
|
|
# Needed for openshift monitoring
|
|
- servicemonitors
|
|
verbs:
|
|
- get
|
|
- create
|
|
- apiGroups:
|
|
- apps
|
|
resourceNames:
|
|
- {{ template "submariner.fullname" . }}
|
|
resources:
|
|
- deployments/finalizers
|
|
verbs:
|
|
- update
|
|
- apiGroups:
|
|
- submariner.io
|
|
resources:
|
|
- brokers
|
|
- brokers/status
|
|
- submariners
|
|
- submariners/status
|
|
- servicediscoveries
|
|
- servicediscoveries/status
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- create
|
|
- update
|
|
- delete
|
|
- apiGroups:
|
|
- submariner.io
|
|
resources:
|
|
- gateways
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- submariner.io
|
|
resources:
|
|
- submariners/finalizers
|
|
- servicediscoveries/finalizers
|
|
verbs:
|
|
- update
|
|
---
|
|
kind: RoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: {{ template "submariner.fullname" . }}
|
|
labels:
|
|
heritage: {{ .Release.Service | quote }}
|
|
release: {{ .Release.Name | quote }}
|
|
chart: {{ template "submariner.chart" . }}
|
|
app: {{ template "submariner.name" . }}
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: {{ template "submariner.operatorServiceAccountName" . }}
|
|
roleRef:
|
|
kind: Role
|
|
name: {{ template "submariner.fullname" . }}
|
|
apiGroup: rbac.authorization.k8s.io
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: {{ template "submariner.fullname" . }}:gateway
|
|
labels:
|
|
heritage: {{ .Release.Service | quote }}
|
|
release: {{ .Release.Name | quote }}
|
|
chart: {{ template "submariner.chart" . }}
|
|
app: {{ template "submariner.name" . }}
|
|
rules:
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- pods
|
|
verbs:
|
|
- get
|
|
- update
|
|
- patch
|
|
- apiGroups:
|
|
- submariner.io
|
|
resources:
|
|
- clusters
|
|
- endpoints
|
|
- gateways
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- create
|
|
- update
|
|
- delete
|
|
- apiGroups:
|
|
- coordination.k8s.io
|
|
resources:
|
|
- leases
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- create
|
|
- update
|
|
- delete
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: {{ template "submariner.fullname" . }}:gateway
|
|
labels:
|
|
heritage: {{ .Release.Service | quote }}
|
|
release: {{ .Release.Name | quote }}
|
|
chart: {{ template "submariner.chart" . }}
|
|
app: {{ template "submariner.name" . }}
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: {{ template "submariner.fullname" . }}:gateway
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: {{ template "submariner.gatewayServiceAccountName" . }}
|
|
namespace: {{ .Release.Namespace }}
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: {{ template "submariner.fullname" . }}:routeagent
|
|
labels:
|
|
heritage: {{ .Release.Service | quote }}
|
|
release: {{ .Release.Name | quote }}
|
|
chart: {{ template "submariner.chart" . }}
|
|
app: {{ template "submariner.name" . }}
|
|
rules:
|
|
- apiGroups:
|
|
- submariner.io
|
|
resources:
|
|
- endpoints
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- submariner.io
|
|
resources:
|
|
- gatewayroutes
|
|
- nongatewayroutes
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- create
|
|
- update
|
|
- delete
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: {{ template "submariner.fullname" . }}:routeagent
|
|
labels:
|
|
heritage: {{ .Release.Service | quote }}
|
|
release: {{ .Release.Name | quote }}
|
|
chart: {{ template "submariner.chart" . }}
|
|
app: {{ template "submariner.name" . }}
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: {{ template "submariner.fullname" . }}:routeagent
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: {{ template "submariner.routeAgentServiceAccountName" . }}
|
|
namespace: {{ .Release.Namespace }}
|
|
---
|
|
{{- if .Values.broker.globalnet }}
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: {{ template "submariner.fullname" . }}:globalnet
|
|
labels:
|
|
heritage: {{ .Release.Service | quote }}
|
|
release: {{ .Release.Name | quote }}
|
|
chart: {{ template "submariner.chart" . }}
|
|
app: {{ template "submariner.name" . }}
|
|
rules:
|
|
- apiGroups:
|
|
- coordination.k8s.io
|
|
resources:
|
|
- leases
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- create
|
|
- update
|
|
- delete
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: {{ template "submariner.fullname" . }}:globalnet
|
|
labels:
|
|
heritage: {{ .Release.Service | quote }}
|
|
release: {{ .Release.Name | quote }}
|
|
chart: {{ template "submariner.chart" . }}
|
|
app: {{ template "submariner.name" . }}
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: {{ template "submariner.fullname" . }}:globalnet
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: {{ template "submariner.globalnetServiceAccountName" . }}
|
|
namespace: {{ .Release.Namespace }}
|
|
---
|
|
{{- end -}}
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: {{ template "submariner.fullname" . }}
|
|
labels:
|
|
heritage: {{ .Release.Service | quote }}
|
|
release: {{ .Release.Name | quote }}
|
|
chart: {{ template "submariner.chart" . }}
|
|
app: {{ template "submariner.name" . }}
|
|
rules:
|
|
# submariner-operator updates the config map of core-dns to forward requests to
|
|
# clusterset.local to Lighthouse DNS, also looks at existing configmaps
|
|
# to figure out network settings
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- configmaps
|
|
verbs:
|
|
- create
|
|
- get
|
|
- list
|
|
- watch
|
|
- update
|
|
- apiGroups:
|
|
- apiextensions.k8s.io
|
|
resources:
|
|
- customresourcedefinitions
|
|
verbs:
|
|
- get
|
|
- list
|
|
- create
|
|
- update
|
|
- delete
|
|
- watch
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
# Needed for network settings discovery
|
|
- pods
|
|
- services
|
|
- nodes
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- operator.openshift.io
|
|
resources:
|
|
- dnses
|
|
verbs:
|
|
- get
|
|
- update
|
|
- apiGroups:
|
|
- config.openshift.io
|
|
resources:
|
|
# Needed for network settings discovery
|
|
- networks
|
|
resourceNames:
|
|
- cluster
|
|
verbs:
|
|
- get
|
|
- apiGroups:
|
|
- monitoring.coreos.com
|
|
resources:
|
|
# Needed for openshift monitoring
|
|
- servicemonitors
|
|
verbs:
|
|
- get
|
|
- create
|
|
- apiGroups:
|
|
- apps
|
|
resources:
|
|
# Needed for Flannel CNI discovery
|
|
- daemonsets
|
|
verbs:
|
|
- list
|
|
- apiGroups:
|
|
- rbac.authorization.k8s.io
|
|
resources:
|
|
# Temporarily needed for network-plugin syncer removal
|
|
- clusterroles
|
|
- clusterrolebindings
|
|
resourceNames:
|
|
- ocp-submariner-networkplugin-syncer
|
|
- submariner-networkplugin-syncer
|
|
verbs:
|
|
- delete
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: {{ template "submariner.fullname" . }}
|
|
labels:
|
|
heritage: {{ .Release.Service | quote }}
|
|
release: {{ .Release.Name | quote }}
|
|
chart: {{ template "submariner.chart" . }}
|
|
app: {{ template "submariner.name" . }}
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: {{ template "submariner.operatorServiceAccountName" . }}
|
|
namespace: {{ .Release.Namespace }}
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: {{ template "submariner.fullname" . }}
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: submariner-metrics-reader
|
|
namespace: {{ .Release.Namespace }}
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["pods", "services", "endpoints"]
|
|
verbs: ["get", "list", "watch"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: read-submariner-metrics
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: prometheus-k8s
|
|
namespace: openshift-monitoring
|
|
roleRef:
|
|
kind: Role
|
|
name: submariner-metrics-reader
|
|
apiGroup: rbac.authorization.k8s.io
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: {{ template "submariner.fullname" . }}:gateway
|
|
labels:
|
|
heritage: {{ .Release.Service | quote }}
|
|
release: {{ .Release.Name | quote }}
|
|
chart: {{ template "submariner.chart" . }}
|
|
app: {{ template "submariner.name" . }}
|
|
rules:
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- configmaps
|
|
verbs:
|
|
- get
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- pods
|
|
- services
|
|
- nodes
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: {{ template "submariner.fullname" . }}:gateway
|
|
labels:
|
|
heritage: {{ .Release.Service | quote }}
|
|
release: {{ .Release.Name | quote }}
|
|
chart: {{ template "submariner.chart" . }}
|
|
app: {{ template "submariner.name" . }}
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: {{ template "submariner.fullname" . }}:gateway
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: {{ template "submariner.gatewayServiceAccountName" . }}
|
|
namespace: {{ .Release.Namespace }}
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: {{ template "submariner.fullname" . }}:routeagent
|
|
labels:
|
|
heritage: {{ .Release.Service | quote }}
|
|
release: {{ .Release.Name | quote }}
|
|
chart: {{ template "submariner.chart" . }}
|
|
app: {{ template "submariner.name" . }}
|
|
rules:
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- pods
|
|
- services
|
|
- secrets
|
|
- configmaps
|
|
- endpoints
|
|
verbs:
|
|
- get
|
|
- list
|
|
- apiGroups:
|
|
- config.openshift.io
|
|
resources:
|
|
- networks
|
|
resourceNames:
|
|
- cluster
|
|
verbs:
|
|
- get
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- nodes
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- update
|
|
- apiGroups:
|
|
- projectcalico.org
|
|
resources:
|
|
- ippools
|
|
verbs:
|
|
- get
|
|
- create
|
|
- delete
|
|
- update
|
|
- deletecollection
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: {{ template "submariner.fullname" . }}:routeagent
|
|
labels:
|
|
heritage: {{ .Release.Service | quote }}
|
|
release: {{ .Release.Name | quote }}
|
|
chart: {{ template "submariner.chart" . }}
|
|
app: {{ template "submariner.name" . }}
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: {{ template "submariner.fullname" . }}:routeagent
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: {{ template "submariner.routeAgentServiceAccountName" . }}
|
|
namespace: {{ .Release.Namespace }}
|
|
---
|
|
{{- if .Values.broker.globalnet }}
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: {{ template "submariner.fullname" . }}:globalnet
|
|
labels:
|
|
heritage: {{ .Release.Service | quote }}
|
|
release: {{ .Release.Name | quote }}
|
|
chart: {{ template "submariner.chart" . }}
|
|
app: {{ template "submariner.name" . }}
|
|
rules:
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- nodes
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- update
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- pods
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- services
|
|
- endpoints
|
|
verbs:
|
|
- create
|
|
- get
|
|
- list
|
|
- watch
|
|
- update
|
|
- delete
|
|
- apiGroups:
|
|
- submariner.io
|
|
resources:
|
|
- clusters
|
|
- endpoints
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- submariner.io
|
|
resources:
|
|
- clusterglobalegressips
|
|
- clusterglobalegressips/status
|
|
- globalegressips
|
|
- globalegressips/status
|
|
- globalingressips
|
|
- globalingressips/status
|
|
verbs:
|
|
- create
|
|
- get
|
|
- list
|
|
- watch
|
|
- update
|
|
- delete
|
|
- deletecollection
|
|
- apiGroups:
|
|
- multicluster.x-k8s.io
|
|
resources:
|
|
- serviceexports
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- network.openshift.io
|
|
resources:
|
|
- service/externalips
|
|
verbs:
|
|
- create
|
|
- get
|
|
- list
|
|
- delete
|
|
---
|
|
{{- end -}}
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: {{ template "submariner.fullname" . }}:globalnet
|
|
labels:
|
|
heritage: {{ .Release.Service | quote }}
|
|
release: {{ .Release.Name | quote }}
|
|
chart: {{ template "submariner.chart" . }}
|
|
app: {{ template "submariner.name" . }}
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: {{ template "submariner.fullname" . }}:globalnet
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: {{ template "submariner.globalnetServiceAccountName" . }}
|
|
namespace: {{ .Release.Namespace }}
|
|
---
|
|
{{- if .Values.submariner.serviceDiscovery }}
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: {{ template "submariner.fullname" . }}:lighthouse-agent
|
|
labels:
|
|
heritage: {{ .Release.Service | quote }}
|
|
release: {{ .Release.Name | quote }}
|
|
chart: {{ template "submariner.chart" . }}
|
|
app: {{ template "submariner.name" . }}
|
|
rules:
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- services
|
|
- namespaces
|
|
- endpoints
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- discovery.k8s.io
|
|
resources:
|
|
- endpointslices
|
|
- endpointslices/restricted
|
|
verbs:
|
|
- create
|
|
- get
|
|
- list
|
|
- watch
|
|
- update
|
|
- delete
|
|
- deletecollection
|
|
- apiGroups:
|
|
- submariner.io
|
|
resources:
|
|
- gateways
|
|
- globalingressips
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- multicluster.x-k8s.io
|
|
resources:
|
|
- serviceimports
|
|
- serviceimports/status
|
|
verbs:
|
|
- create
|
|
- get
|
|
- list
|
|
- watch
|
|
- update
|
|
- delete
|
|
- apiGroups:
|
|
- multicluster.x-k8s.io
|
|
resources:
|
|
- serviceexports
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- multicluster.x-k8s.io
|
|
resources:
|
|
- serviceexports/status
|
|
verbs:
|
|
- update
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: {{ template "submariner.fullname" . }}:lighthouse-agent
|
|
labels:
|
|
heritage: {{ .Release.Service | quote }}
|
|
release: {{ .Release.Name | quote }}
|
|
chart: {{ template "submariner.chart" . }}
|
|
app: {{ template "submariner.name" . }}
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: {{ template "submariner.fullname" . }}:lighthouse-agent
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: {{ template "submariner.lighthouseAgentServiceAccountName" . }}
|
|
namespace: {{ .Release.Namespace }}
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: {{ template "submariner.fullname" . }}:lighthouse-coredns
|
|
rules:
|
|
- apiGroups:
|
|
- discovery.k8s.io
|
|
resources:
|
|
- endpointslices
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- submariner.io
|
|
resources:
|
|
- gateways
|
|
- submariners
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- multicluster.x-k8s.io
|
|
resources:
|
|
- serviceimports
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: {{ template "submariner.fullname" . }}:lighthouse-coredns
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: {{ template "submariner.fullname" . }}:lighthouse-coredns
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }}
|
|
namespace: {{ .Release.Namespace }}
|
|
{{- end -}}
|
|
{{- end -}}
|