mirror of
https://github.com/bitnami/charts.git
synced 2026-03-27 15:27:10 +08:00
0ad4fe3aa7
* [bitnami/kong] chore(ClusterRole): Concat namespace in ClusterRole name Signed-off-by: Fran Mulero <francisco-jose.mulero@broadcom.com> * Update CHANGELOG.md Signed-off-by: Bitnami Bot <bitnami.bot@broadcom.com> --------- Signed-off-by: Fran Mulero <francisco-jose.mulero@broadcom.com> Signed-off-by: Bitnami Bot <bitnami.bot@broadcom.com> Co-authored-by: Bitnami Bot <bitnami.bot@broadcom.com>
634 lines
12 KiB
YAML
634 lines
12 KiB
YAML
{{- /*
|
|
Copyright Broadcom, Inc. All Rights Reserved.
|
|
SPDX-License-Identifier: APACHE-2.0
|
|
*/}}
|
|
|
|
{{- if and .Values.ingressController.rbac.create .Values.ingressController.enabled }}
|
|
apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
|
|
kind: Role
|
|
metadata:
|
|
name: {{ include "common.names.fullname" . }}
|
|
namespace: {{ .Release.Namespace }}
|
|
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
|
app.kubernetes.io/component: server
|
|
{{- if .Values.commonAnnotations }}
|
|
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
|
{{- end }}
|
|
rules:
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- configmaps
|
|
- pods
|
|
- secrets
|
|
- namespaces
|
|
verbs:
|
|
- get
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- configmaps
|
|
resourceNames:
|
|
- "kong-ingress-controller-leader-{{ .Values.ingressController.ingressClass }}-{{ .Values.ingressController.ingressClass }}"
|
|
verbs:
|
|
- get
|
|
- update
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- configmaps
|
|
verbs:
|
|
- create
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- endpoints
|
|
verbs:
|
|
- get
|
|
# Begin KIC 2.x leader permissions
|
|
- apiGroups:
|
|
- ""
|
|
- coordination.k8s.io
|
|
resources:
|
|
- configmaps
|
|
- leases
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- create
|
|
- update
|
|
- patch
|
|
- delete
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- events
|
|
verbs:
|
|
- create
|
|
- patch
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- services
|
|
verbs:
|
|
- get
|
|
{{- if .Values.ingressController.rbac.rules }}
|
|
{{- include "common.tplvalues.render" ( dict "value" .Values.ingressController.rbac.rules "context" $ ) | nindent 2 }}
|
|
{{- end }}
|
|
---
|
|
apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: {{ template "common.names.fullname" . }}
|
|
namespace: {{ .Release.Namespace }}
|
|
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
|
app.kubernetes.io/component: server
|
|
{{- if .Values.commonAnnotations }}
|
|
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
|
{{- end }}
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: {{ template "common.names.fullname" . }}
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: {{ include "kong.ingressController.serviceAccountName" . }}
|
|
namespace: {{ .Release.Namespace }}
|
|
---
|
|
apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: {{ include "common.names.fullname.namespace" . }}
|
|
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
|
app.kubernetes.io/component: server
|
|
{{- if .Values.commonAnnotations }}
|
|
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
|
{{- end }}
|
|
rules:
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- configmaps
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- configuration.konghq.com
|
|
resources:
|
|
- kongcustomentities
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- configuration.konghq.com
|
|
resources:
|
|
- kongcustomentities/status
|
|
verbs:
|
|
- get
|
|
- patch
|
|
- update
|
|
- apiGroups:
|
|
- incubator.ingress-controller.konghq.com
|
|
resources:
|
|
- kongservicefacades
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- incubator.ingress-controller.konghq.com
|
|
resources:
|
|
- kongservicefacades/status
|
|
verbs:
|
|
- get
|
|
- patch
|
|
- update
|
|
- apiGroups:
|
|
- configuration.konghq.com
|
|
resources:
|
|
- kongupstreampolicies
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- configuration.konghq.com
|
|
resources:
|
|
- kongupstreampolicies/status
|
|
verbs:
|
|
- get
|
|
- patch
|
|
- update
|
|
- apiGroups:
|
|
- configuration.konghq.com
|
|
resources:
|
|
- kongconsumergroups
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- configuration.konghq.com
|
|
resources:
|
|
- kongconsumergroups/status
|
|
verbs:
|
|
- get
|
|
- patch
|
|
- update
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- endpoints
|
|
verbs:
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- events
|
|
verbs:
|
|
- create
|
|
- patch
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- nodes
|
|
verbs:
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- pods
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- secrets
|
|
verbs:
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- services
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- services/status
|
|
verbs:
|
|
- get
|
|
- patch
|
|
- update
|
|
- apiGroups:
|
|
- configuration.konghq.com
|
|
resources:
|
|
- ingressclassparameterses
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- configuration.konghq.com
|
|
resources:
|
|
- kongconsumers
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- configuration.konghq.com
|
|
resources:
|
|
- kongconsumers/status
|
|
verbs:
|
|
- get
|
|
- patch
|
|
- update
|
|
- apiGroups:
|
|
- configuration.konghq.com
|
|
resources:
|
|
- kongingresses
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- configuration.konghq.com
|
|
resources:
|
|
- kongingresses/status
|
|
verbs:
|
|
- get
|
|
- patch
|
|
- update
|
|
- apiGroups:
|
|
- configuration.konghq.com
|
|
resources:
|
|
- kongplugins
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- configuration.konghq.com
|
|
resources:
|
|
- kongplugins/status
|
|
verbs:
|
|
- get
|
|
- patch
|
|
- update
|
|
- apiGroups:
|
|
- configuration.konghq.com
|
|
resources:
|
|
- tcpingresses
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- configuration.konghq.com
|
|
resources:
|
|
- tcpingresses/status
|
|
verbs:
|
|
- get
|
|
- patch
|
|
- update
|
|
- apiGroups:
|
|
- configuration.konghq.com
|
|
resources:
|
|
- udpingresses
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- configuration.konghq.com
|
|
resources:
|
|
- udpingresses/status
|
|
verbs:
|
|
- get
|
|
- patch
|
|
- update
|
|
- apiGroups:
|
|
- extensions
|
|
resources:
|
|
- ingresses
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- extensions
|
|
resources:
|
|
- ingresses/status
|
|
verbs:
|
|
- get
|
|
- patch
|
|
- update
|
|
- apiGroups:
|
|
- configuration.konghq.com
|
|
resources:
|
|
- kongcustomentities
|
|
verbs:
|
|
- list
|
|
{{- if or (include "common.capabilities.apiVersions.has" ( dict "version" "gateway.networking.k8s.io/v1alpha2" "context" . )) (include "common.capabilities.apiVersions.has" ( dict "version" "gateway.networking.k8s.io/v1beta1" "context" . )) (include "common.capabilities.apiVersions.has" ( dict "version" "gateway.networking.k8s.io/v1" "context" . )) }}
|
|
- apiGroups:
|
|
- gateway.networking.k8s.io
|
|
resources:
|
|
- backendtlspolicies
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- gateway.networking.k8s.io
|
|
resources:
|
|
- backendtlspolicies/status
|
|
verbs:
|
|
- patch
|
|
- update
|
|
- apiGroups:
|
|
- gateway.networking.k8s.io
|
|
resources:
|
|
- gateways
|
|
verbs:
|
|
- get
|
|
- list
|
|
- update
|
|
- watch
|
|
- apiGroups:
|
|
- gateway.networking.k8s.io
|
|
resources:
|
|
- gateways/status
|
|
verbs:
|
|
- get
|
|
- update
|
|
- apiGroups:
|
|
- gateway.networking.k8s.io
|
|
resources:
|
|
- httproutes
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- gateway.networking.k8s.io
|
|
resources:
|
|
- httproutes/status
|
|
verbs:
|
|
- get
|
|
- update
|
|
- apiGroups:
|
|
- gateway.networking.k8s.io
|
|
resources:
|
|
- referencegrants
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- gateway.networking.k8s.io
|
|
resources:
|
|
- referencegrants/status
|
|
verbs:
|
|
- get
|
|
- apiGroups:
|
|
- gateway.networking.k8s.io
|
|
resources:
|
|
- tcproutes
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- gateway.networking.k8s.io
|
|
resources:
|
|
- tcproutes/status
|
|
verbs:
|
|
- get
|
|
- update
|
|
- apiGroups:
|
|
- gateway.networking.k8s.io
|
|
resources:
|
|
- tlsroutes
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- gateway.networking.k8s.io
|
|
resources:
|
|
- tlsroutes/status
|
|
verbs:
|
|
- get
|
|
- update
|
|
- apiGroups:
|
|
- gateway.networking.k8s.io
|
|
resources:
|
|
- udproutes
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- gateway.networking.k8s.io
|
|
resources:
|
|
- udproutes/status
|
|
verbs:
|
|
- get
|
|
- update
|
|
- apiGroups:
|
|
- gateway.networking.k8s.io
|
|
resources:
|
|
- grpcroutes
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- gateway.networking.k8s.io
|
|
resources:
|
|
- grpcroutes/status
|
|
verbs:
|
|
- get
|
|
- patch
|
|
- update
|
|
{{- end }}
|
|
{{- if include "common.capabilities.apiVersions.has" ( dict "version" "networking.internal.knative.dev/v1alpha1" "context" . ) }}
|
|
- apiGroups:
|
|
- networking.internal.knative.dev
|
|
resources:
|
|
- ingresses
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- networking.internal.knative.dev
|
|
resources:
|
|
- ingresses/status
|
|
verbs:
|
|
- get
|
|
- patch
|
|
- update
|
|
{{- end }}
|
|
- apiGroups:
|
|
- networking.k8s.io
|
|
resources:
|
|
- ingresses
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- networking.k8s.io
|
|
resources:
|
|
- ingresses/status
|
|
verbs:
|
|
- get
|
|
- patch
|
|
- update
|
|
- apiGroups:
|
|
- discovery.k8s.io
|
|
resources:
|
|
- endpointslices
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- configuration.konghq.com
|
|
resources:
|
|
- konglicenses
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- configuration.konghq.com
|
|
resources:
|
|
- konglicenses/status
|
|
verbs:
|
|
- get
|
|
- patch
|
|
- update
|
|
- apiGroups:
|
|
- configuration.konghq.com
|
|
resources:
|
|
- kongclusterplugins
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- configuration.konghq.com
|
|
resources:
|
|
- kongclusterplugins/status
|
|
verbs:
|
|
- get
|
|
- patch
|
|
- update
|
|
- apiGroups:
|
|
- configuration.konghq.com
|
|
resources:
|
|
- kongvaults
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- configuration.konghq.com
|
|
resources:
|
|
- kongvaults/status
|
|
verbs:
|
|
- get
|
|
- patch
|
|
- update
|
|
- apiGroups:
|
|
- configuration.konghq.com
|
|
resources:
|
|
- kongclusterplugins
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- configuration.konghq.com
|
|
resources:
|
|
- kongclusterplugins/status
|
|
verbs:
|
|
- get
|
|
- patch
|
|
- update
|
|
- apiGroups:
|
|
- apiextensions.k8s.io
|
|
resources:
|
|
- customresourcedefinitions
|
|
verbs:
|
|
- list
|
|
- watch
|
|
{{- if or (include "common.capabilities.apiVersions.has" ( dict "version" "gateway.networking.k8s.io/v1alpha2" "context" . )) (include "common.capabilities.apiVersions.has" ( dict "version" "gateway.networking.k8s.io/v1beta1" "context" . )) (include "common.capabilities.apiVersions.has" ( dict "version" "gateway.networking.k8s.io/v1" "context" . )) }}
|
|
- apiGroups:
|
|
- gateway.networking.k8s.io
|
|
resources:
|
|
- gatewayclasses
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- gateway.networking.k8s.io
|
|
resources:
|
|
- gatewayclasses/status
|
|
verbs:
|
|
- get
|
|
- update
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- namespaces
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
{{- end }}
|
|
- apiGroups:
|
|
- networking.k8s.io
|
|
resources:
|
|
- ingressclasses
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
{{- if .Values.ingressController.rbac.rules }}
|
|
{{- include "common.tplvalues.render" ( dict "value" .Values.ingressController.rbac.rules "context" $ ) | nindent 2 }}
|
|
{{- end }}
|
|
---
|
|
apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: {{ include "common.names.fullname.namespace" . }}
|
|
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
|
app.kubernetes.io/component: server
|
|
{{- if .Values.commonAnnotations }}
|
|
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
|
{{- end }}
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: {{ include "common.names.fullname.namespace" . }}
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: {{ include "kong.ingressController.serviceAccountName" . }}
|
|
namespace: {{ .Release.Namespace }}
|
|
{{- end }}
|