e257d92f41
* Add resources needed to deploy 1.6.4 * Use cilium v1.6.4 * Change deprecated option name * Add update crd to clusterrole cilium * Cilium 1.6.4 -> 1.6.5 * Make monitor-aggregation config configurable as a variable * Change monitor-aggregation default none->medium * Cilium 1.6.5 -> 1.6.6 * Update to 1.7.0 * v1.7.0->v1.7.1
120 lines
2.1 KiB
Django/Jinja
120 lines
2.1 KiB
Django/Jinja
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: cilium-operator
|
|
rules:
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
# to get k8s version and status
|
|
- componentstatuses
|
|
verbs:
|
|
- get
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
# to automatically delete [core|kube]dns pods so that are starting to being
|
|
# managed by Cilium
|
|
- pods
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- delete
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
# to automatically read from k8s and import the node's pod CIDR to cilium's
|
|
# etcd so all nodes know how to reach another pod running in in a different
|
|
# node.
|
|
- nodes
|
|
# to perform the translation of a CNP that contains `ToGroup` to its endpoints
|
|
- services
|
|
- endpoints
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- cilium.io
|
|
resources:
|
|
- ciliumnetworkpolicies
|
|
- ciliumnetworkpolicies/status
|
|
- ciliumendpoints
|
|
- ciliumendpoints/status
|
|
- ciliumnodes
|
|
- ciliumnodes/status
|
|
- ciliumidentities
|
|
- ciliumidentities/status
|
|
verbs:
|
|
- '*'
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: cilium
|
|
rules:
|
|
- apiGroups:
|
|
- networking.k8s.io
|
|
resources:
|
|
- networkpolicies
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- namespaces
|
|
- services
|
|
- nodes
|
|
- endpoints
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- pods
|
|
- nodes
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- update
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- nodes
|
|
- nodes/status
|
|
verbs:
|
|
- patch
|
|
- apiGroups:
|
|
- apiextensions.k8s.io
|
|
resources:
|
|
- ingresses
|
|
- customresourcedefinitions
|
|
verbs:
|
|
- create
|
|
- get
|
|
- list
|
|
- watch
|
|
- update
|
|
- apiGroups:
|
|
- cilium.io
|
|
resources:
|
|
- ciliumnetworkpolicies
|
|
- ciliumnetworkpolicies/status
|
|
- ciliumclusterwidenetworkpolicies
|
|
- ciliumclusterwidenetworkpolicies/status
|
|
- ciliumendpoints
|
|
- ciliumendpoints/status
|
|
- ciliumnodes
|
|
- ciliumnodes/status
|
|
- ciliumidentities
|
|
- ciliumidentities/status
|
|
verbs:
|
|
- '*'
|