164 lines
6.1 KiB
YAML
164 lines
6.1 KiB
YAML
{{- if .Values.rbac.create -}}
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: {{ .Values.namespaced | ternary "Role" "ClusterRole" }}
|
|
metadata:
|
|
name: {{ template "external-dns.fullname" . }}
|
|
labels:
|
|
{{- include "external-dns.labels" . | nindent 4 }}
|
|
rules:
|
|
{{- if and (not .Values.namespaced) (or (has "node" .Values.sources) (has "pod" .Values.sources) (has "service" .Values.sources) (has "contour-httpproxy" .Values.sources) (has "gloo-proxy" .Values.sources) (has "openshift-route" .Values.sources) (has "skipper-routegroup" .Values.sources)) }}
|
|
- apiGroups: [""]
|
|
resources: ["nodes"]
|
|
verbs: ["list","watch"]
|
|
{{- end }}
|
|
{{- if or (has "pod" .Values.sources) (has "service" .Values.sources) (has "contour-httpproxy" .Values.sources) (has "gloo-proxy" .Values.sources) (has "openshift-route" .Values.sources) (has "skipper-routegroup" .Values.sources) }}
|
|
- apiGroups: [""]
|
|
resources: ["pods"]
|
|
verbs: ["get","watch","list"]
|
|
{{- end }}
|
|
{{- if or (has "service" .Values.sources) (has "contour-httpproxy" .Values.sources) (has "gloo-proxy" .Values.sources) (has "istio-gateway" .Values.sources) (has "istio-virtualservice" .Values.sources) (has "openshift-route" .Values.sources) (has "skipper-routegroup" .Values.sources) }}
|
|
- apiGroups: [""]
|
|
resources: ["services"]
|
|
verbs: ["get","watch","list"]
|
|
{{- end }}
|
|
{{- if has "service" .Values.sources }}
|
|
- apiGroups: ["discovery.k8s.io"]
|
|
resources: ["endpointslices"]
|
|
verbs: ["get","watch","list"]
|
|
{{- end }}
|
|
{{- if or (has "ingress" .Values.sources) (has "istio-gateway" .Values.sources) (has "istio-virtualservice" .Values.sources) (has "contour-httpproxy" .Values.sources) (has "openshift-route" .Values.sources) (has "skipper-routegroup" .Values.sources) (has "gloo-proxy" .Values.sources) }}
|
|
- apiGroups: ["extensions","networking.k8s.io"]
|
|
resources: ["ingresses"]
|
|
verbs: ["get","watch","list"]
|
|
{{- end }}
|
|
{{- if or (has "istio-gateway" .Values.sources) (has "istio-virtualservice" .Values.sources) }}
|
|
- apiGroups: ["networking.istio.io"]
|
|
resources: ["gateways"]
|
|
verbs: ["get","watch","list"]
|
|
{{- end }}
|
|
|
|
{{- if has "istio-virtualservice" .Values.sources }}
|
|
- apiGroups: ["networking.istio.io"]
|
|
resources: ["virtualservices"]
|
|
verbs: ["get","watch","list"]
|
|
{{- end }}
|
|
{{- if has "ambassador-host" .Values.sources }}
|
|
- apiGroups: ["getambassador.io"]
|
|
resources: ["hosts","ingresses"]
|
|
verbs: ["get","watch","list"]
|
|
{{- end }}
|
|
{{- if has "contour-httpproxy" .Values.sources }}
|
|
- apiGroups: ["projectcontour.io"]
|
|
resources: ["httpproxies"]
|
|
verbs: ["get","watch","list"]
|
|
{{- end }}
|
|
{{- if has "crd" .Values.sources }}
|
|
- apiGroups: ["externaldns.k8s.io"]
|
|
resources: ["dnsendpoints"]
|
|
verbs: ["get","watch","list"]
|
|
- apiGroups: ["externaldns.k8s.io"]
|
|
resources: ["dnsendpoints/status"]
|
|
verbs: ["*"]
|
|
{{- end }}
|
|
{{- if include "external-dns.hasGatewaySources" . }}
|
|
{{- if or (not .Values.namespaced) (and .Values.namespaced (not .Values.gatewayNamespace)) }}
|
|
- apiGroups: ["gateway.networking.k8s.io"]
|
|
resources: ["gateways"]
|
|
verbs: ["get","watch","list"]
|
|
{{- end }}
|
|
{{- if not .Values.namespaced }}
|
|
- apiGroups: [""]
|
|
resources: ["namespaces"]
|
|
verbs: ["get","watch","list"]
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if has "gateway-httproute" .Values.sources }}
|
|
- apiGroups: ["gateway.networking.k8s.io"]
|
|
resources: ["httproutes"]
|
|
verbs: ["get","watch","list"]
|
|
{{- end }}
|
|
{{- if has "gateway-grpcroute" .Values.sources }}
|
|
- apiGroups: ["gateway.networking.k8s.io"]
|
|
resources: ["grpcroutes"]
|
|
verbs: ["get","watch","list"]
|
|
{{- end }}
|
|
{{- if has "gateway-tlsroute" .Values.sources }}
|
|
- apiGroups: ["gateway.networking.k8s.io"]
|
|
resources: ["tlsroutes"]
|
|
verbs: ["get","watch","list"]
|
|
{{- end }}
|
|
{{- if has "gateway-tcproute" .Values.sources }}
|
|
- apiGroups: ["gateway.networking.k8s.io"]
|
|
resources: ["tcproutes"]
|
|
verbs: ["get","watch","list"]
|
|
{{- end }}
|
|
{{- if has "gateway-udproute" .Values.sources }}
|
|
- apiGroups: ["gateway.networking.k8s.io"]
|
|
resources: ["udproutes"]
|
|
verbs: ["get","watch","list"]
|
|
{{- end }}
|
|
{{- if has "gloo-proxy" .Values.sources }}
|
|
- apiGroups: ["gloo.solo.io","gateway.solo.io"]
|
|
resources: ["proxies","virtualservices","gateways"]
|
|
verbs: ["get","watch","list"]
|
|
{{- end }}
|
|
{{- if has "kong-tcpingress" .Values.sources }}
|
|
- apiGroups: ["configuration.konghq.com"]
|
|
resources: ["tcpingresses"]
|
|
verbs: ["get","watch","list"]
|
|
{{- end }}
|
|
{{- if has "traefik-proxy" .Values.sources }}
|
|
- apiGroups: ["traefik.containo.us", "traefik.io"]
|
|
resources: ["ingressroutes", "ingressroutetcps", "ingressrouteudps"]
|
|
verbs: ["get","watch","list"]
|
|
{{- end }}
|
|
{{- if has "openshift-route" .Values.sources }}
|
|
- apiGroups: ["route.openshift.io"]
|
|
resources: ["routes"]
|
|
verbs: ["get","watch","list"]
|
|
{{- end }}
|
|
{{- if has "skipper-routegroup" .Values.sources }}
|
|
- apiGroups: ["zalando.org"]
|
|
resources: ["routegroups"]
|
|
verbs: ["get","watch","list"]
|
|
- apiGroups: ["zalando.org"]
|
|
resources: ["routegroups/status"]
|
|
verbs: ["patch","update"]
|
|
{{- end }}
|
|
{{- if or (has "f5-virtualserver" .Values.sources) (has "f5-transportserver" .Values.sources) }}
|
|
- apiGroups: ["cis.f5.com"]
|
|
resources: ["virtualservers", "transportservers"]
|
|
verbs: ["get","watch","list"]
|
|
{{- end }}
|
|
{{- with .Values.rbac.additionalPermissions }}
|
|
{{- toYaml . | nindent 2 }}
|
|
{{- end }}
|
|
{{- if and .Values.rbac.create .Values.namespaced (include "external-dns.hasGatewaySources" .) }}
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: {{ template "external-dns.fullname" . }}-namespaces
|
|
labels:
|
|
{{- include "external-dns.labels" . | nindent 4 }}
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["namespaces"]
|
|
verbs: ["get","watch","list"]
|
|
{{- if .Values.gatewayNamespace }}
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: {{ template "external-dns.fullname" . }}-gateway
|
|
namespace: {{ .Values.gatewayNamespace }}
|
|
labels:
|
|
{{- include "external-dns.labels" . | nindent 4 }}
|
|
rules:
|
|
- apiGroups: ["gateway.networking.k8s.io"]
|
|
resources: ["gateways"]
|
|
verbs: ["get","watch","list"]
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|