config/helm/appmesh-controller/templates/rbac.yaml

{{- if .Values.rbac.create }}
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: {{ template "appmesh-controller.fullname" . }}-leader-election-role
  namespace: {{ .Release.Namespace }}
  labels:
{{ include "appmesh-controller.labels" . | indent 4 }}
rules:
- apiGroups: [""]
  resources: [configmaps]
  verbs: [create, list, watch]
- apiGroups: [""]
  resources: [configmaps]
  resourceNames: [appmesh-controller-leader-election]
  verbs: [get, patch, update]
- apiGroups: [""]
  resources: [events]
  verbs: [create, patch]
- apiGroups: ["coordination.k8s.io"]
  resources: [leases]
  verbs: [create]
- apiGroups: ["coordination.k8s.io"]
  resources: [leases]
  resourceNames: [appmesh-controller-leader-election]
  verbs: [get, update, patch]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: {{ template "appmesh-controller.fullname" . }}-leader-election-rolebinding
  namespace: {{ .Release.Namespace }}
  labels:
{{ include "appmesh-controller.labels" . | indent 4 }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: {{ template "appmesh-controller.fullname" . }}-leader-election-role
subjects:
- kind: ServiceAccount
  name: {{ template "appmesh-controller.serviceAccountName" . }}
  namespace: {{ .Release.Namespace }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ template "appmesh-controller.fullname" . }}-role
  labels:
{{ include "appmesh-controller.labels" . | indent 4 }}
rules:
- apiGroups: [""]
  resources: [events]
  verbs: [create, delete, get, list, patch, update, watch]
- apiGroups: [""]
  resources: [namespaces, pods, nodes]
  verbs: [get, list, watch]
- apiGroups: [""]
  resources: [pods/status]
  verbs: [get, patch, update]
- apiGroups: [appmesh.k8s.aws]
  resources: [backendgroups, gatewayroutes, meshes, virtualgateways, virtualnodes, virtualrouters, virtualservices]
  verbs: [create, delete, get, list, patch, update, watch]
- apiGroups: [appmesh.k8s.aws]
  resources: [backendgroups/status, gatewayroutes/status, meshes/status, virtualgateways/status, virtualnodes/status, virtualrouters/status, virtualservices/status]
  verbs: [get, patch, update]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: {{ template "appmesh-controller.fullname" . }}-rolebinding
  labels:
{{ include "appmesh-controller.labels" . | indent 4 }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: {{ template "appmesh-controller.fullname" . }}-role
subjects:
- name: {{ template "appmesh-controller.serviceAccountName" . }}
  namespace: {{ .Release.Namespace }}
  kind: ServiceAccount
{{- end }}