61 lines
2.2 KiB
YAML
61 lines
2.2 KiB
YAML
|
{{ $mcsAPIGroup := or .Values.pilot.env.MCS_API_GROUP "multicluster.x-k8s.io" }}
|
||
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
||
|
|
kind: ClusterRole
|
||
|
|
metadata:
|
||
|
|
name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }}
|
||
|
|
labels:
|
||
|
|
app: istio-reader
|
||
|
|
release: {{ .Release.Name }}
|
||
|
|
rules:
|
||
|
|
- apiGroups:
|
||
|
|
- "config.istio.io"
|
||
|
|
- "security.istio.io"
|
||
|
|
- "networking.istio.io"
|
||
|
|
- "authentication.istio.io"
|
||
|
|
- "rbac.istio.io"
|
||
|
|
- "telemetry.istio.io"
|
||
|
|
- "extensions.istio.io"
|
||
|
|
resources: ["*"]
|
||
|
|
verbs: ["get", "list", "watch"]
|
||
|
|
- apiGroups: [""]
|
||
|
|
resources: ["endpoints", "pods", "services", "nodes", "replicationcontrollers", "namespaces", "secrets"]
|
||
|
|
verbs: ["get", "list", "watch"]
|
||
|
|
- apiGroups: ["networking.istio.io"]
|
||
|
|
verbs: [ "get", "watch", "list" ]
|
||
|
|
resources: [ "workloadentries" ]
|
||
|
|
- apiGroups: ["networking.x-k8s.io", "gateway.networking.k8s.io"]
|
||
|
|
resources: ["gateways"]
|
||
|
|
verbs: ["get", "watch", "list"]
|
||
|
|
- apiGroups: ["apiextensions.k8s.io"]
|
||
|
|
resources: ["customresourcedefinitions"]
|
||
|
|
verbs: ["get", "list", "watch"]
|
||
|
|
- apiGroups: ["discovery.k8s.io"]
|
||
|
|
resources: ["endpointslices"]
|
||
|
|
verbs: ["get", "list", "watch"]
|
||
|
|
- apiGroups: ["{{ $mcsAPIGroup }}"]
|
||
|
|
resources: ["serviceexports"]
|
||
|
|
verbs: ["get", "list", "watch", "create", "delete"]
|
||
|
|
- apiGroups: ["{{ $mcsAPIGroup }}"]
|
||
|
|
resources: ["serviceimports"]
|
||
|
|
verbs: ["get", "list", "watch"]
|
||
|
|
- apiGroups: ["apps"]
|
||
|
|
resources: ["replicasets"]
|
||
|
|
verbs: ["get", "list", "watch"]
|
||
|
|
- apiGroups: ["authentication.k8s.io"]
|
||
|
|
resources: ["tokenreviews"]
|
||
|
|
verbs: ["create"]
|
||
|
|
- apiGroups: ["authorization.k8s.io"]
|
||
|
|
resources: ["subjectaccessreviews"]
|
||
|
|
verbs: ["create"]
|
||
|
|
{{- if .Values.global.externalIstiod }}
|
||
|
|
- apiGroups: [""]
|
||
|
|
resources: ["configmaps"]
|
||
|
|
verbs: ["create", "get", "list", "watch", "update"]
|
||
|
|
- apiGroups: ["admissionregistration.k8s.io"]
|
||
|
|
resources: ["mutatingwebhookconfigurations"]
|
||
|
|
verbs: ["get", "list", "watch", "update", "patch"]
|
||
|
|
- apiGroups: ["admissionregistration.k8s.io"]
|
||
|
|
resources: ["validatingwebhookconfigurations"]
|
||
|
|
verbs: ["get", "list", "watch", "update"]
|
||
|
|
{{- end}}
|