aws-app-mesh-controller-for-k8s/config/helm/appmesh-controller/templates/rbac.yaml at 5f45e5b4198bbcdeec8f2576bfcefdf37453097d · aws/aws-app-mesh-controller-for-k8s · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
{{- if .Values.rbac.create }}
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: {{ template "appmesh-controller.fullname" . }}-leader-election-role
  namespace: {{ .Release.Namespace }}
  labels:
{{ include "appmesh-controller.labels" . | indent 4 }}
rules:
- apiGroups: [""]
  resources: [configmaps]
  verbs: [create, list, watch]
- apiGroups: [""]
  resources: [configmaps]
  resourceNames: [appmesh-controller-leader-election]
  verbs: [get, patch, update]
- apiGroups: [""]
  resources: [events]
  verbs: [create, patch]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: {{ template "appmesh-controller.fullname" . }}-leader-election-rolebinding
  namespace: {{ .Release.Namespace }}
  labels:
{{ include "appmesh-controller.labels" . | indent 4 }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: {{ template "appmesh-controller.fullname" . }}-leader-election-role
subjects:
- kind: ServiceAccount
  name: {{ template "appmesh-controller.serviceAccountName" . }}
  namespace: {{ .Release.Namespace }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ template "appmesh-controller.fullname" . }}-role
  labels:
{{ include "appmesh-controller.labels" . | indent 4 }}
rules:
- apiGroups: [""]
  resources: [events]
  verbs: [create, delete, get, list, patch, update, watch]
- apiGroups: [""]
  resources: [namespaces, pods, nodes]
  verbs: [get, list, watch]
- apiGroups: [batch]
  resources: [jobs]
  verbs: [get, list, watch]
- apiGroups: [""]
  resources: [pods/status]
  verbs: [get, patch, update]
- apiGroups: [appmesh.k8s.aws]
  resources: [backendgroups, gatewayroutes, meshes, virtualgateways, virtualnodes, virtualrouters, virtualservices]
  verbs: [create, delete, get, list, patch, update, watch]
- apiGroups: [appmesh.k8s.aws]
  resources: [backendgroups/status, gatewayroutes/status, meshes/status, virtualgateways/status, virtualnodes/status, virtualrouters/status, virtualservices/status]
  verbs: [get, patch, update]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: {{ template "appmesh-controller.fullname" . }}-rolebinding
  labels:
{{ include "appmesh-controller.labels" . | indent 4 }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: {{ template "appmesh-controller.fullname" . }}-role
subjects:
- name: {{ template "appmesh-controller.serviceAccountName" . }}
  namespace: {{ .Release.Namespace }}
  kind: ServiceAccount
{{- end }}