c12s-kubespray/roles/network_plugin/calico/templates/calico-cr.yml.j2

---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: calico-node
  namespace: kube-system
rules:
  - apiGroups: [""]
    resources:
      - pods
      - nodes
      - namespaces
    verbs:
      - get
  - apiGroups: [""]
    resources:
      - endpoints
      - services
    verbs:
      - watch
      - list
  - apiGroups: [""]
    resources:
      - nodes/status
    verbs:
      - patch
  - apiGroups:
    - policy
    resourceNames:
    - privileged
    resources:
    - podsecuritypolicies
    verbs:
    - use
Move calico to daemonset (#1605) * Drop legacy calico logic * add calico as a daemonset 2017-09-04 08:29:51 +00:00			`---`
			`kind: ClusterRole`
			`apiVersion: rbac.authorization.k8s.io/v1beta1`
			`metadata:`
			`name: calico-node`
Stop templating kube-system namespace and creating it (#2545) Kubernetes makes this namespace automatically, so there is no need for kubespray to manage it. 2018-03-30 11:29:13 +00:00			`namespace: kube-system`
Move calico to daemonset (#1605) * Drop legacy calico logic * add calico as a daemonset 2017-09-04 08:29:51 +00:00			`rules:`
			`- apiGroups: [""]`
			`resources:`
			`- pods`
			`- nodes`
[PR-Calico]Support calico 3.4.0 (#4102) * Suport calico 3.4.0 Signed-off-by: wangxf1987 <xiaofeix.wang@gmail.com> * Remove symlink + cni conflist template when 3.3.0+, handle Canal, addition of install-cni: sidecar(3.3.0) or initontainer(3.4.0), KUBECONFIG_FILEPATH, calico_cert_dir, advertise cluster ips * scheduler.alpha.kubernetes.io/critical-pod deprecated since 1.12 2019-01-28 19:03:49 +00:00			`- namespaces`
Move calico to daemonset (#1605) * Drop legacy calico logic * add calico as a daemonset 2017-09-04 08:29:51 +00:00			`verbs:`
			`- get`
[PR-Calico]Support calico 3.4.0 (#4102) * Suport calico 3.4.0 Signed-off-by: wangxf1987 <xiaofeix.wang@gmail.com> * Remove symlink + cni conflist template when 3.3.0+, handle Canal, addition of install-cni: sidecar(3.3.0) or initontainer(3.4.0), KUBECONFIG_FILEPATH, calico_cert_dir, advertise cluster ips * scheduler.alpha.kubernetes.io/critical-pod deprecated since 1.12 2019-01-28 19:03:49 +00:00			`- apiGroups: [""]`
			`resources:`
			`- endpoints`
			`- services`
			`verbs:`
			`- watch`
			`- list`
			`- apiGroups: [""]`
			`resources:`
			`- nodes/status`
			`verbs:`
			`- patch`
psp, roles and rbs for PodSecurityPolicy when podsecuritypolicy_enabled is true 2018-08-22 16:16:13 +00:00			`- apiGroups:`
			`- policy`
			`resourceNames:`
			`- privileged`
			`resources:`
			`- podsecuritypolicies`
			`verbs:`
			`- use`