kubespray/roles/network_plugin/canal/templates/canal-cr-calico.yml.j2

---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: calico
  namespace: kube-system
rules:
  - apiGroups: [""]
    resources:
      - pods
      - nodes
      - namespaces
      - configmaps
    verbs:
      - get
  - apiGroups: [""]
    resources:
      - endpoints
      - services
    verbs:
      - watch
      - list
  - apiGroups: [""]
    resources:
      - nodes/status
    verbs:
      - patch
  - apiGroups:
    - policy
    resourceNames:
    - privileged
    resources:
    - podsecuritypolicies
    verbs:
    - use
  - apiGroups:
    - policy
    resourceNames:
    - privileged
    resources:
    - podsecuritypolicies
    verbs:
    - use
Add RBAC support for canal (#1604) Refactored how rbac_enabled is set Added RBAC to ubuntu-canal-ha CI job Added rbac for calico policy controller 2017-09-04 16:29:40 +08:00			`---`
			`kind: ClusterRole`
update rbac.authorization.k8s.io to non deprecated api-groups (#5517) 2020-04-15 04:14:04 +08:00			`apiVersion: rbac.authorization.k8s.io/v1`
Add RBAC support for canal (#1604) Refactored how rbac_enabled is set Added RBAC to ubuntu-canal-ha CI job Added rbac for calico policy controller 2017-09-04 16:29:40 +08:00			`metadata:`
			`name: calico`
Stop templating kube-system namespace and creating it (#2545) Kubernetes makes this namespace automatically, so there is no need for kubespray to manage it. 2018-03-30 19:29:13 +08:00			`namespace: kube-system`
Add RBAC support for canal (#1604) Refactored how rbac_enabled is set Added RBAC to ubuntu-canal-ha CI job Added rbac for calico policy controller 2017-09-04 16:29:40 +08:00			`rules:`
			`- apiGroups: [""]`
			`resources:`
			`- pods`
			`- nodes`
Update calico to 3.13.3 (#6061) 2020-05-04 23:56:26 +08:00			`- namespaces`
			`- configmaps`
Add RBAC support for canal (#1604) Refactored how rbac_enabled is set Added RBAC to ubuntu-canal-ha CI job Added rbac for calico policy controller 2017-09-04 16:29:40 +08:00			`verbs:`
			`- get`
Update calico to 3.13.3 (#6061) 2020-05-04 23:56:26 +08:00			`- apiGroups: [""]`
Add RBAC support for canal (#1604) Refactored how rbac_enabled is set Added RBAC to ubuntu-canal-ha CI job Added rbac for calico policy controller 2017-09-04 16:29:40 +08:00			`resources:`
Update calico to 3.13.3 (#6061) 2020-05-04 23:56:26 +08:00			`- endpoints`
			`- services`
Add RBAC support for canal (#1604) Refactored how rbac_enabled is set Added RBAC to ubuntu-canal-ha CI job Added rbac for calico policy controller 2017-09-04 16:29:40 +08:00			`verbs:`
			`- watch`
			`- list`
Update calico to 3.13.3 (#6061) 2020-05-04 23:56:26 +08:00			`- apiGroups: [""]`
Add RBAC support for canal (#1604) Refactored how rbac_enabled is set Added RBAC to ubuntu-canal-ha CI job Added rbac for calico policy controller 2017-09-04 16:29:40 +08:00			`resources:`
Update calico to 3.13.3 (#6061) 2020-05-04 23:56:26 +08:00			`- nodes/status`
Add RBAC support for canal (#1604) Refactored how rbac_enabled is set Added RBAC to ubuntu-canal-ha CI job Added rbac for calico policy controller 2017-09-04 16:29:40 +08:00			`verbs:`
Update calico to 3.13.3 (#6061) 2020-05-04 23:56:26 +08:00			`- patch`
			`- apiGroups:`
			`- policy`
			`resourceNames:`
			`- privileged`
Add RBAC support for canal (#1604) Refactored how rbac_enabled is set Added RBAC to ubuntu-canal-ha CI job Added rbac for calico policy controller 2017-09-04 16:29:40 +08:00			`resources:`
Update calico to 3.13.3 (#6061) 2020-05-04 23:56:26 +08:00			`- podsecuritypolicies`
Add RBAC support for canal (#1604) Refactored how rbac_enabled is set Added RBAC to ubuntu-canal-ha CI job Added rbac for calico policy controller 2017-09-04 16:29:40 +08:00			`verbs:`
Update calico to 3.13.3 (#6061) 2020-05-04 23:56:26 +08:00			`- use`
psp, roles and rbs for PodSecurityPolicy when podsecuritypolicy_enabled is true 2018-08-23 00:16:13 +08:00			`- apiGroups:`
			`- policy`
			`resourceNames:`
			`- privileged`
			`resources:`
			`- podsecuritypolicies`
			`verbs:`
			`- use`