deploy/cpu-manager/base/cmk-rbac-rules.yaml

   1 kind: ClusterRole
   2 apiVersion: rbac.authorization.k8s.io/v1beta1
   3 metadata:
   4   name: cmk-third-party-resource-controller
   5 rules:
   6 - apiGroups: ["cmk.intel.com"]
   7   resources: ["*"]
   8   verbs: ["*"]
   9 - apiGroups: ["extensions"]
  10   resources: ["thirdpartyresources", "thirdpartyresources.extensions"]
  11   verbs: ["*"]
  12 ---
  13 kind: ClusterRole
  14 apiVersion: rbac.authorization.k8s.io/v1beta1
  15 metadata:
  16   name: cmk-custom-resource-definition-controller
  17 rules:
  18 - apiGroups: ["intel.com"]
  19   resources: ["*"]
  20   verbs: ["*"]
  21 - apiGroups: ["apiextensions.k8s.io"]
  22   resources: ["customresourcedefinitions", "customresourcedefinitions.extensions"]
  23   verbs: ["*"]
  24 ---
  25 kind: ClusterRole
  26 apiVersion: rbac.authorization.k8s.io/v1beta1
  27 metadata:
  28   name: cmk-daemonset-controller
  29 rules:
  30 - apiGroups: ["extensions", "apps"]
  31   resources: ["daemonsets", "daemonsets.extensions", "daemonsets.apps"]
  32   verbs: ["*"]
  33 ---
  34 kind: ClusterRole
  35 apiVersion: rbac.authorization.k8s.io/v1beta1
  36 metadata:
  37   name: cmk-version-controller
  38 rules:
  39   - nonResourceURLs: ["*"]
  40     verbs:
  41       - get
  42 ---
  43 kind: ClusterRole
  44 apiVersion: rbac.authorization.k8s.io/v1beta1
  45 metadata:
  46   name: cmk-webhook-installer
  47 rules:
  48 - apiGroups: ["", "apps", "extensions", "admissionregistration.k8s.io"]
  49   resources: ["secrets", "configmaps", "deployments", "services", "mutatingwebhookconfigurations"]
  50   verbs: ["*"]
  51 ---
  52 kind: ClusterRole
  53 apiVersion: rbac.authorization.k8s.io/v1beta1
  54 metadata:
  55   name: cmk-node-lister
  56 rules:
  57 - apiGroups: [""]
  58   resources: ["nodes"]
  59   verbs: ["*"]
  60 ---
  61 apiVersion: rbac.authorization.k8s.io/v1beta1
  62 kind: ClusterRoleBinding
  63 metadata:
  64   name: cmk-role-binding-daemonset
  65 roleRef:
  66   apiGroup: rbac.authorization.k8s.io
  67   kind: ClusterRole
  68   name: cmk-daemonset-controller
  69 subjects:
  70 - kind: ServiceAccount
  71   name: cmk-serviceaccount
  72   namespace: cmk-namespace
  73 ---
  74 apiVersion: rbac.authorization.k8s.io/v1beta1
  75 kind: ClusterRoleBinding
  76 metadata:
  77   name: cmk-role-binding-node
  78 roleRef:
  79   apiGroup: rbac.authorization.k8s.io
  80   kind: ClusterRole
  81   name: system:node
  82 subjects:
  83 - kind: ServiceAccount
  84   name: cmk-serviceaccount
  85   namespace: cmk-namespace
  86 ---
  87 apiVersion: rbac.authorization.k8s.io/v1beta1
  88 kind: ClusterRoleBinding
  89 metadata:
  90   name: cmk-role-binding-tpr
  91 roleRef:
  92   apiGroup: rbac.authorization.k8s.io
  93   kind: ClusterRole
  94   name: cmk-third-party-resource-controller
  95 subjects:
  96 - kind: ServiceAccount
  97   name: cmk-serviceaccount
  98   namespace: cmk-namespace
  99 ---
 100 apiVersion: rbac.authorization.k8s.io/v1beta1
 101 kind: ClusterRoleBinding
 102 metadata:
 103   name: cmk-role-binding-crd
 104 roleRef:
 105   apiGroup: rbac.authorization.k8s.io
 106   kind: ClusterRole
 107   name: cmk-custom-resource-definition-controller
 108 subjects:
 109 - kind: ServiceAccount
 110   name: cmk-serviceaccount
 111   namespace: cmk-namespace
 112 ---
 113 apiVersion: rbac.authorization.k8s.io/v1beta1
 114 kind: ClusterRoleBinding
 115 metadata:
 116   name: cmk-role-binding-version
 117 roleRef:
 118   apiGroup: rbac.authorization.k8s.io
 119   kind: ClusterRole
 120   name: cmk-version-controller
 121 subjects:
 122 - kind: ServiceAccount
 123   name: cmk-serviceaccount
 124   namespace: cmk-namespace
 125 ---
 126 apiVersion: rbac.authorization.k8s.io/v1beta1
 127 kind: ClusterRoleBinding
 128 metadata:
 129   name: cmk-role-binding-webhook-installer
 130 roleRef:
 131   apiGroup: rbac.authorization.k8s.io
 132   kind: ClusterRole
 133   name: cmk-webhook-installer
 134 subjects:
 135 - kind: ServiceAccount
 136   name: cmk-serviceaccount
 137   namespace: cmk-namespace
 138 ---
 139 apiVersion: rbac.authorization.k8s.io/v1beta1
 140 kind: ClusterRoleBinding
 141 metadata:
 142   name: cmk-role-binding-node-lister
 143 roleRef:
 144   apiGroup: rbac.authorization.k8s.io
 145   kind: ClusterRole
 146   name: cmk-node-lister
 147 subjects:
 148 - kind: ServiceAccount
 149   name: cmk-serviceaccount
 150   namespace: cmk-namespace