manifests/google-service-account-template.yaml [53:69]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
rules:
  # Allows 'downscoping' - getting tokens with audience - without mounting.
  - apiGroups: [ "" ]
    resources:
      - "serviceaccounts/token"
    resourceNames:
      - "default"
    verbs:
      - "create"
      - "get"

    # Access to a pernamespace mesh-env. If not found, istio-system is used (mesh-env in istio-system is visible to all
    # authenticated users.
  - apiGroups: [ "" ]
    resources:
      - "configmaps"
    resourceNames:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



manifests/hgate/rbac.yaml [22:34]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
rules:
  - apiGroups: [ "" ]
    resources:
      - "serviceaccounts/token"
    resourceNames:
      - "default"
    verbs:
      - "create"
      - "get"
  - apiGroups: [ "" ]
    resources:
      - "configmaps"
    resourceNames:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



