| {{ $mcsAPIGroup := or .Values.pilot.env.MCS_API_GROUP "multicluster.x-k8s.io" }} |
| apiVersion: rbac.authorization.k8s.io/v1 |
| kind: ClusterRole |
| metadata: |
| name: istio-reader-clusterrole{{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }} |
| labels: |
| app: istio-reader |
| release: {{ .Release.Name }} |
| rules: |
| - apiGroups: |
| - "config.istio.io" |
| - "security.istio.io" |
| - "networking.istio.io" |
| - "authentication.istio.io" |
| - "rbac.istio.io" |
| resources: ["*"] |
| verbs: ["get", "list", "watch"] |
| - apiGroups: [""] |
| resources: ["endpoints", "pods", "services", "nodes", "replicationcontrollers", "namespaces", "secrets"] |
| verbs: ["get", "list", "watch"] |
| - apiGroups: ["networking.istio.io"] |
| verbs: [ "get", "watch", "list" ] |
| resources: [ "workloadentries" ] |
| - apiGroups: ["apiextensions.k8s.io"] |
| resources: ["customresourcedefinitions"] |
| verbs: ["get", "list", "watch"] |
| - apiGroups: ["discovery.k8s.io"] |
| resources: ["endpointslices"] |
| verbs: ["get", "list", "watch"] |
| - apiGroups: ["{{ $mcsAPIGroup }}"] |
| resources: ["serviceexports"] |
| verbs: ["get", "list", "watch", "create", "delete"] |
| - apiGroups: ["{{ $mcsAPIGroup }}"] |
| resources: ["serviceimports"] |
| verbs: ["get", "list", "watch"] |
| - apiGroups: ["apps"] |
| resources: ["replicasets"] |
| verbs: ["get", "list", "watch"] |
| - apiGroups: ["authentication.k8s.io"] |
| resources: ["tokenreviews"] |
| verbs: ["create"] |
| - apiGroups: ["authorization.k8s.io"] |
| resources: ["subjectaccessreviews"] |
| verbs: ["create"] |
| {{- if .Values.global.externalIstiod }} |
| - apiGroups: [""] |
| resources: ["configmaps"] |
| verbs: ["create", "get", "list", "watch", "update"] |
| - apiGroups: ["admissionregistration.k8s.io"] |
| resources: ["mutatingwebhookconfigurations"] |
| verbs: ["get", "list", "watch", "update", "patch"] |
| - apiGroups: ["admissionregistration.k8s.io"] |
| resources: ["validatingwebhookconfigurations"] |
| verbs: ["get", "list", "watch", "update"] |
| {{- end}} |