mirror of
https://github.com/edgelesssys/constellation.git
synced 2024-12-13 18:04:20 -05:00
968cdc1a38
* cli: move internal packages Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * cli: fix buildfiles Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * bazel: fix exclude dir Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * cli: move back libraries that will not be used by TF provider Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> --------- Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
151 lines
2.7 KiB
YAML
151 lines
2.7 KiB
YAML
{{- if .Values.preflight.enabled }}
|
|
{{- /*
|
|
Keep file in sync with cilium-agent/clusterrole.yaml
|
|
*/ -}}
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: cilium-pre-flight
|
|
{{- with .Values.preflight.annotations }}
|
|
annotations:
|
|
{{- toYaml . | nindent 4 }}
|
|
{{- end }}
|
|
labels:
|
|
app.kubernetes.io/part-of: cilium
|
|
rules:
|
|
- apiGroups:
|
|
- networking.k8s.io
|
|
resources:
|
|
- networkpolicies
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- discovery.k8s.io
|
|
resources:
|
|
- endpointslices
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- namespaces
|
|
- services
|
|
- pods
|
|
- endpoints
|
|
- nodes
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
{{- if .Values.annotateK8sNode }}
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- nodes/status
|
|
verbs:
|
|
# To annotate the k8s node with Cilium's metadata
|
|
- patch
|
|
{{- end }}
|
|
{{- if .Values.l2announcements.enabled }}
|
|
- apiGroups:
|
|
- coordination.k8s.io
|
|
resources:
|
|
- leases
|
|
verbs:
|
|
- create
|
|
- get
|
|
- update
|
|
- list
|
|
- delete
|
|
{{- end }}
|
|
- apiGroups:
|
|
- apiextensions.k8s.io
|
|
resources:
|
|
- customresourcedefinitions
|
|
verbs:
|
|
- list
|
|
- watch
|
|
# This is used when validating policies in preflight. This will need to stay
|
|
# until we figure out how to avoid "get" inside the preflight, and then
|
|
# should be removed ideally.
|
|
- get
|
|
{{- if eq "k8s" .Values.tls.secretsBackend }}
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- secrets
|
|
verbs:
|
|
- get
|
|
{{- end }}
|
|
- apiGroups:
|
|
- cilium.io
|
|
resources:
|
|
- ciliumloadbalancerippools
|
|
- ciliumbgppeeringpolicies
|
|
- ciliumbgpnodeconfigs
|
|
- ciliumbgpadvertisements
|
|
- ciliumbgppeerconfigs
|
|
- ciliumclusterwideenvoyconfigs
|
|
- ciliumclusterwidenetworkpolicies
|
|
- ciliumegressgatewaypolicies
|
|
- ciliumendpoints
|
|
- ciliumendpointslices
|
|
- ciliumenvoyconfigs
|
|
- ciliumidentities
|
|
- ciliumlocalredirectpolicies
|
|
- ciliumnetworkpolicies
|
|
- ciliumnodes
|
|
- ciliumnodeconfigs
|
|
- ciliumcidrgroups
|
|
- ciliuml2announcementpolicies
|
|
- ciliumpodippools
|
|
verbs:
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- cilium.io
|
|
resources:
|
|
- ciliumidentities
|
|
- ciliumendpoints
|
|
- ciliumnodes
|
|
verbs:
|
|
- create
|
|
- apiGroups:
|
|
- cilium.io
|
|
# To synchronize garbage collection of such resources
|
|
resources:
|
|
- ciliumidentities
|
|
verbs:
|
|
- update
|
|
- apiGroups:
|
|
- cilium.io
|
|
resources:
|
|
- ciliumendpoints
|
|
verbs:
|
|
- delete
|
|
- get
|
|
- apiGroups:
|
|
- cilium.io
|
|
resources:
|
|
- ciliumnodes
|
|
- ciliumnodes/status
|
|
verbs:
|
|
- get
|
|
- update
|
|
- apiGroups:
|
|
- cilium.io
|
|
resources:
|
|
- ciliumnetworkpolicies/status
|
|
- ciliumclusterwidenetworkpolicies/status
|
|
- ciliumendpoints/status
|
|
- ciliumendpoints
|
|
- ciliuml2announcementpolicies/status
|
|
- ciliumbgpnodeconfigs/status
|
|
verbs:
|
|
- patch
|
|
{{- end }}
|