60 lines
1.7 KiB
YAML
60 lines
1.7 KiB
YAML
|
---
|
||
|
|
# ClusterRole for pangolin-kube-controller
|
||
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
||
|
|
kind: ClusterRole
|
||
|
|
metadata:
|
||
|
|
name: pangolin-kube-controller
|
||
|
|
labels:
|
||
|
|
app.kubernetes.io/name: pangolin-kube-controller
|
||
|
|
app.kubernetes.io/component: controller
|
||
|
|
app.kubernetes.io/part-of: pangolin
|
||
|
|
rules:
|
||
|
|
# Traefik CRDs - full access to manage IngressRoutes, Middlewares, and TraefikServices
|
||
|
|
- apiGroups: ["traefik.io"]
|
||
|
|
resources:
|
||
|
|
- ingressroutes
|
||
|
|
- ingressroutetcps
|
||
|
|
- ingressrouteudps
|
||
|
|
- middlewares
|
||
|
|
- middlewaretcps
|
||
|
|
- traefikservices
|
||
|
|
- serverstransports
|
||
|
|
- serverstransporttcps
|
||
|
|
- tlsoptions
|
||
|
|
- tlsstores
|
||
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||
|
|
|
||
|
|
# IngressClass - read-only for validation
|
||
|
|
- apiGroups: ["networking.k8s.io"]
|
||
|
|
resources: ["ingressclasses"]
|
||
|
|
verbs: ["get", "list", "watch"]
|
||
|
|
|
||
|
|
# Leader election - requires lease access
|
||
|
|
- apiGroups: ["coordination.k8s.io"]
|
||
|
|
resources: ["leases"]
|
||
|
|
verbs: ["get", "list", "watch", "create", "update", "patch"]
|
||
|
|
|
||
|
|
# Events - for operational notifications
|
||
|
|
- apiGroups: [""]
|
||
|
|
resources: ["events"]
|
||
|
|
verbs: ["create", "patch", "get", "list"]
|
||
|
|
|
||
|
|
---
|
||
|
|
# ClusterRoleBinding for pangolin-kube-controller
|
||
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
||
|
|
kind: ClusterRoleBinding
|
||
|
|
metadata:
|
||
|
|
name: pangolin-kube-controller
|
||
|
|
labels:
|
||
|
|
app.kubernetes.io/name: pangolin-kube-controller
|
||
|
|
app.kubernetes.io/component: controller
|
||
|
|
app.kubernetes.io/part-of: pangolin
|
||
|
|
subjects:
|
||
|
|
- kind: ServiceAccount
|
||
|
|
name: pangolin-kube-controller
|
||
|
|
namespace: pangolin
|
||
|
|
roleRef:
|
||
|
|
kind: ClusterRole
|
||
|
|
name: pangolin-kube-controller
|
||
|
|
apiGroup: rbac.authorization.k8s.io
|