c12s-kubespray/roles/network_plugin/cilium/templates/cilium-cr.yml.j2

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cilium-operator
rules:
- apiGroups:
  - ""
  resources:
  # to get k8s version and status
  - componentstatuses
  verbs:
  - get
- apiGroups:
  - ""
  resources:
  # to automatically delete [core|kube]dns pods so that are starting to being
  # managed by Cilium
  - pods
  verbs:
  - get
  - list
  - watch
  - delete
- apiGroups:
  - ""
  resources:
  # to automatically read from k8s and import the node's pod CIDR to cilium's
  # etcd so all nodes know how to reach another pod running in in a different
  # node.
  - nodes
  # to perform the translation of a CNP that contains `ToGroup` to its endpoints
  - services
  - endpoints
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - cilium.io
  resources:
  - ciliumnetworkpolicies
  - ciliumnetworkpolicies/status
  - ciliumendpoints
  - ciliumendpoints/status
  - ciliumnodes
  - ciliumnodes/status
  - ciliumidentities
  - ciliumidentities/status
  verbs:
  - '*'
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cilium
rules:
  - apiGroups:
      - networking.k8s.io
    resources:
      - networkpolicies
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - ""
    resources:
      - namespaces
      - services
      - nodes
      - endpoints
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - ""
    resources:
      - pods
      - nodes
    verbs:
      - get
      - list
      - watch
      - update
  - apiGroups:
      - ""
    resources:
      - nodes
      - nodes/status
    verbs:
      - patch
  - apiGroups:
      - apiextensions.k8s.io
    resources:
      - ingresses
      - customresourcedefinitions
    verbs:
      - create
      - get
      - list
      - watch
      - update
  - apiGroups:
      - cilium.io
    resources:
      - ciliumnetworkpolicies
      - ciliumnetworkpolicies/status
      - ciliumclusterwidenetworkpolicies
      - ciliumclusterwidenetworkpolicies/status
      - ciliumendpoints
      - ciliumendpoints/status
      - ciliumnodes
      - ciliumnodes/status
      - ciliumidentities
      - ciliumidentities/status
    verbs:
      - '*'
Added cilium support (#2236) * Added cilium support * Fix typo in debian test config * Remove empty lines * Changed cilium version from <latest> to <v1.0.0-rc3> * Add missing changes for cilium * Add cilium to CI pipeline * Fix wrong file name * Check kernel version for cilium * fixed ci error * fixed cilium-ds.j2 template * added waiting for cilium pods to run * Fixed missing EOF * Fixed trailing spaces * Fixed trailing spaces * Fixed trailing spaces * Fixed too many blank lines * Updated tolerations,annotations in cilium DS template * Set cilium_version to iptables-1.9 to see if bug is fixed in CI * Update cilium image tag to v1.0.0-rc4 * Update Cilium test case CI vars filenames * Add optional prometheus flag, adjust initial readiness delay * Update README.md with cilium info 2018-02-17 03:37:47 +00:00			`---`
cilium v1.1.2 Update all configs to current upstream state. Add more resources (unable to pass tests now)... 2018-07-26 20:17:27 +00:00			`apiVersion: rbac.authorization.k8s.io/v1`
Added cilium support (#2236) * Added cilium support * Fix typo in debian test config * Remove empty lines * Changed cilium version from <latest> to <v1.0.0-rc3> * Add missing changes for cilium * Add cilium to CI pipeline * Fix wrong file name * Check kernel version for cilium * fixed ci error * fixed cilium-ds.j2 template * added waiting for cilium pods to run * Fixed missing EOF * Fixed trailing spaces * Fixed trailing spaces * Fixed trailing spaces * Fixed too many blank lines * Updated tolerations,annotations in cilium DS template * Set cilium_version to iptables-1.9 to see if bug is fixed in CI * Update cilium image tag to v1.0.0-rc4 * Update Cilium test case CI vars filenames * Add optional prometheus flag, adjust initial readiness delay * Update README.md with cilium info 2018-02-17 03:37:47 +00:00			`kind: ClusterRole`
Upgrade Cilium network plugin to v1.5.5. (#5014) * Needs an additional cilium-operator deployment. * Added option to enable hostPort mappings. 2019-08-06 08:37:55 +00:00			`metadata:`
			`name: cilium-operator`
			`rules:`
			`- apiGroups:`
			`- ""`
			`resources:`
			`# to get k8s version and status`
			`- componentstatuses`
			`verbs:`
			`- get`
			`- apiGroups:`
			`- ""`
			`resources:`
			`# to automatically delete [core\|kube]dns pods so that are starting to being`
			`# managed by Cilium`
			`- pods`
			`verbs:`
			`- get`
			`- list`
			`- watch`
			`- delete`
			`- apiGroups:`
			`- ""`
			`resources:`
			`# to automatically read from k8s and import the node's pod CIDR to cilium's`
			`# etcd so all nodes know how to reach another pod running in in a different`
			`# node.`
			`- nodes`
			# to perform the translation of a CNP that contains `ToGroup` to its endpoints
			`- services`
			`- endpoints`
			`verbs:`
			`- get`
			`- list`
			`- watch`
			`- apiGroups:`
			`- cilium.io`
			`resources:`
			`- ciliumnetworkpolicies`
			`- ciliumnetworkpolicies/status`
			`- ciliumendpoints`
			`- ciliumendpoints/status`
Cilium updates (#5438) * Add resources needed to deploy 1.6.4 * Use cilium v1.6.4 * Change deprecated option name * Add update crd to clusterrole cilium * Cilium 1.6.4 -> 1.6.5 * Make monitor-aggregation config configurable as a variable * Change monitor-aggregation default none->medium * Cilium 1.6.5 -> 1.6.6 * Update to 1.7.0 * v1.7.0->v1.7.1 2020-03-11 15:15:36 +00:00			`- ciliumnodes`
			`- ciliumnodes/status`
			`- ciliumidentities`
			`- ciliumidentities/status`
Upgrade Cilium network plugin to v1.5.5. (#5014) * Needs an additional cilium-operator deployment. * Added option to enable hostPort mappings. 2019-08-06 08:37:55 +00:00			`verbs:`
			`- '*'`
			`---`
			`apiVersion: rbac.authorization.k8s.io/v1`
			`kind: ClusterRole`
Added cilium support (#2236) * Added cilium support * Fix typo in debian test config * Remove empty lines * Changed cilium version from <latest> to <v1.0.0-rc3> * Add missing changes for cilium * Add cilium to CI pipeline * Fix wrong file name * Check kernel version for cilium * fixed ci error * fixed cilium-ds.j2 template * added waiting for cilium pods to run * Fixed missing EOF * Fixed trailing spaces * Fixed trailing spaces * Fixed trailing spaces * Fixed too many blank lines * Updated tolerations,annotations in cilium DS template * Set cilium_version to iptables-1.9 to see if bug is fixed in CI * Update cilium image tag to v1.0.0-rc4 * Update Cilium test case CI vars filenames * Add optional prometheus flag, adjust initial readiness delay * Update README.md with cilium info 2018-02-17 03:37:47 +00:00			`metadata:`
			`name: cilium`
			`rules:`
cilium v1.1.2 Update all configs to current upstream state. Add more resources (unable to pass tests now)... 2018-07-26 20:17:27 +00:00			`- apiGroups:`
Upgrade Cilium network plugin to v1.5.5. (#5014) * Needs an additional cilium-operator deployment. * Added option to enable hostPort mappings. 2019-08-06 08:37:55 +00:00			`- networking.k8s.io`
cilium v1.1.2 Update all configs to current upstream state. Add more resources (unable to pass tests now)... 2018-07-26 20:17:27 +00:00			`resources:`
			`- networkpolicies`
			`verbs:`
			`- get`
			`- list`
			`- watch`
			`- apiGroups:`
			`- ""`
			`resources:`
			`- namespaces`
			`- services`
			`- nodes`
			`- endpoints`
			`verbs:`
			`- get`
			`- list`
			`- watch`
			`- apiGroups:`
			`- ""`
			`resources:`
			`- pods`
			`- nodes`
			`verbs:`
			`- get`
			`- list`
			`- watch`
			`- update`
Upgrade Cilium network plugin to v1.5.5. (#5014) * Needs an additional cilium-operator deployment. * Added option to enable hostPort mappings. 2019-08-06 08:37:55 +00:00			`- apiGroups:`
			`- ""`
			`resources:`
			`- nodes`
			`- nodes/status`
			`verbs:`
			`- patch`
cilium v1.1.2 Update all configs to current upstream state. Add more resources (unable to pass tests now)... 2018-07-26 20:17:27 +00:00			`- apiGroups:`
Upgrade Cilium network plugin to v1.5.5. (#5014) * Needs an additional cilium-operator deployment. * Added option to enable hostPort mappings. 2019-08-06 08:37:55 +00:00			`- apiextensions.k8s.io`
cilium v1.1.2 Update all configs to current upstream state. Add more resources (unable to pass tests now)... 2018-07-26 20:17:27 +00:00			`resources:`
Cilium updates (#5438) * Add resources needed to deploy 1.6.4 * Use cilium v1.6.4 * Change deprecated option name * Add update crd to clusterrole cilium * Cilium 1.6.4 -> 1.6.5 * Make monitor-aggregation config configurable as a variable * Change monitor-aggregation default none->medium * Cilium 1.6.5 -> 1.6.6 * Update to 1.7.0 * v1.7.0->v1.7.1 2020-03-11 15:15:36 +00:00			`- ingresses`
cilium v1.1.2 Update all configs to current upstream state. Add more resources (unable to pass tests now)... 2018-07-26 20:17:27 +00:00			`- customresourcedefinitions`
			`verbs:`
			`- create`
			`- get`
			`- list`
			`- watch`
			`- update`
			`- apiGroups:`
			`- cilium.io`
			`resources:`
			`- ciliumnetworkpolicies`
			`- ciliumnetworkpolicies/status`
Cilium updates (#5438) * Add resources needed to deploy 1.6.4 * Use cilium v1.6.4 * Change deprecated option name * Add update crd to clusterrole cilium * Cilium 1.6.4 -> 1.6.5 * Make monitor-aggregation config configurable as a variable * Change monitor-aggregation default none->medium * Cilium 1.6.5 -> 1.6.6 * Update to 1.7.0 * v1.7.0->v1.7.1 2020-03-11 15:15:36 +00:00			`- ciliumclusterwidenetworkpolicies`
			`- ciliumclusterwidenetworkpolicies/status`
cilium v1.1.2 Update all configs to current upstream state. Add more resources (unable to pass tests now)... 2018-07-26 20:17:27 +00:00			`- ciliumendpoints`
			`- ciliumendpoints/status`
Cilium updates (#5438) * Add resources needed to deploy 1.6.4 * Use cilium v1.6.4 * Change deprecated option name * Add update crd to clusterrole cilium * Cilium 1.6.4 -> 1.6.5 * Make monitor-aggregation config configurable as a variable * Change monitor-aggregation default none->medium * Cilium 1.6.5 -> 1.6.6 * Update to 1.7.0 * v1.7.0->v1.7.1 2020-03-11 15:15:36 +00:00			`- ciliumnodes`
			`- ciliumnodes/status`
			`- ciliumidentities`
			`- ciliumidentities/status`
cilium v1.1.2 Update all configs to current upstream state. Add more resources (unable to pass tests now)... 2018-07-26 20:17:27 +00:00			`verbs:`
Upgrade Cilium network plugin to v1.5.5. (#5014) * Needs an additional cilium-operator deployment. * Added option to enable hostPort mappings. 2019-08-06 08:37:55 +00:00			`- '*'`