c12s-kubespray/roles/network_plugin/cilium/templates/cilium-cr.yml.j2

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cilium
rules:
  - apiGroups:
      - "networking.k8s.io"
    resources:
      - networkpolicies
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - ""
    resources:
      - namespaces
      - services
      - nodes
      - endpoints
      - componentstatuses
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - ""
    resources:
      - pods
      - nodes
    verbs:
      - get
      - list
      - watch
      - update
  - apiGroups:
      - extensions
    resources:
      - networkpolicies  # FIXME remove this when we drop support for k8s NP-beta GH-1202
      - thirdpartyresources
      - ingresses
    verbs:
      - create
      - get
      - list
      - watch
  - apiGroups:
      - "apiextensions.k8s.io"
    resources:
      - customresourcedefinitions
    verbs:
      - create
      - get
      - list
      - watch
      - update
  - apiGroups:
      - cilium.io
    resources:
      - ciliumnetworkpolicies
      - ciliumnetworkpolicies/status
      - ciliumendpoints
      - ciliumendpoints/status
    verbs:
      - "*"
  - apiGroups:
    - policy
    resourceNames:
    - privileged
    resources:
    - podsecuritypolicies
    verbs:
    - use
Added cilium support (#2236) * Added cilium support * Fix typo in debian test config * Remove empty lines * Changed cilium version from <latest> to <v1.0.0-rc3> * Add missing changes for cilium * Add cilium to CI pipeline * Fix wrong file name * Check kernel version for cilium * fixed ci error * fixed cilium-ds.j2 template * added waiting for cilium pods to run * Fixed missing EOF * Fixed trailing spaces * Fixed trailing spaces * Fixed trailing spaces * Fixed too many blank lines * Updated tolerations,annotations in cilium DS template * Set cilium_version to iptables-1.9 to see if bug is fixed in CI * Update cilium image tag to v1.0.0-rc4 * Update Cilium test case CI vars filenames * Add optional prometheus flag, adjust initial readiness delay * Update README.md with cilium info 2018-02-17 03:37:47 +00:00			`---`
cilium v1.1.2 Update all configs to current upstream state. Add more resources (unable to pass tests now)... 2018-07-26 20:17:27 +00:00			`apiVersion: rbac.authorization.k8s.io/v1`
Added cilium support (#2236) * Added cilium support * Fix typo in debian test config * Remove empty lines * Changed cilium version from <latest> to <v1.0.0-rc3> * Add missing changes for cilium * Add cilium to CI pipeline * Fix wrong file name * Check kernel version for cilium * fixed ci error * fixed cilium-ds.j2 template * added waiting for cilium pods to run * Fixed missing EOF * Fixed trailing spaces * Fixed trailing spaces * Fixed trailing spaces * Fixed too many blank lines * Updated tolerations,annotations in cilium DS template * Set cilium_version to iptables-1.9 to see if bug is fixed in CI * Update cilium image tag to v1.0.0-rc4 * Update Cilium test case CI vars filenames * Add optional prometheus flag, adjust initial readiness delay * Update README.md with cilium info 2018-02-17 03:37:47 +00:00			`kind: ClusterRole`
			`metadata:`
			`name: cilium`
			`rules:`
cilium v1.1.2 Update all configs to current upstream state. Add more resources (unable to pass tests now)... 2018-07-26 20:17:27 +00:00			`- apiGroups:`
			`- "networking.k8s.io"`
			`resources:`
			`- networkpolicies`
			`verbs:`
			`- get`
			`- list`
			`- watch`
			`- apiGroups:`
			`- ""`
			`resources:`
			`- namespaces`
			`- services`
			`- nodes`
			`- endpoints`
			`- componentstatuses`
			`verbs:`
			`- get`
			`- list`
			`- watch`
			`- apiGroups:`
			`- ""`
			`resources:`
			`- pods`
			`- nodes`
			`verbs:`
			`- get`
			`- list`
			`- watch`
			`- update`
			`- apiGroups:`
			`- extensions`
			`resources:`
			`- networkpolicies # FIXME remove this when we drop support for k8s NP-beta GH-1202`
			`- thirdpartyresources`
			`- ingresses`
			`verbs:`
			`- create`
			`- get`
			`- list`
			`- watch`
			`- apiGroups:`
			`- "apiextensions.k8s.io"`
			`resources:`
			`- customresourcedefinitions`
			`verbs:`
			`- create`
			`- get`
			`- list`
			`- watch`
			`- update`
			`- apiGroups:`
			`- cilium.io`
			`resources:`
			`- ciliumnetworkpolicies`
			`- ciliumnetworkpolicies/status`
			`- ciliumendpoints`
			`- ciliumendpoints/status`
			`verbs:`
			`- "*"`
psp, roles and rbs for PodSecurityPolicy when podsecuritypolicy_enabled is true 2018-08-22 16:16:13 +00:00			`- apiGroups:`
			`- policy`
			`resourceNames:`
			`- privileged`
			`resources:`
			`- podsecuritypolicies`
			`verbs:`
			`- use`