103 lines
3.4 KiB
YAML
103 lines
3.4 KiB
YAML
|
---
|
||
|
|
###
|
||
|
|
### Proxy Injector RBAC
|
||
|
|
###
|
||
|
|
kind: ClusterRole
|
||
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
||
|
|
metadata:
|
||
|
|
name: linkerd-{{.Values.namespace}}-proxy-injector
|
||
|
|
labels:
|
||
|
|
linkerd.io/control-plane-component: proxy-injector
|
||
|
|
linkerd.io/control-plane-ns: {{.Values.namespace}}
|
||
|
|
rules:
|
||
|
|
- apiGroups: [""]
|
||
|
|
resources: ["events"]
|
||
|
|
verbs: ["create", "patch"]
|
||
|
|
- apiGroups: [""]
|
||
|
|
resources: ["namespaces", "replicationcontrollers"]
|
||
|
|
verbs: ["list", "get", "watch"]
|
||
|
|
- apiGroups: [""]
|
||
|
|
resources: ["pods"]
|
||
|
|
verbs: ["list", "watch"]
|
||
|
|
- apiGroups: ["extensions", "apps"]
|
||
|
|
resources: ["deployments", "replicasets", "daemonsets", "statefulsets"]
|
||
|
|
verbs: ["list", "get", "watch"]
|
||
|
|
- apiGroups: ["extensions", "batch"]
|
||
|
|
resources: ["cronjobs", "jobs"]
|
||
|
|
verbs: ["list", "get", "watch"]
|
||
|
|
---
|
||
|
|
kind: ClusterRoleBinding
|
||
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
||
|
|
metadata:
|
||
|
|
name: linkerd-{{.Values.namespace}}-proxy-injector
|
||
|
|
labels:
|
||
|
|
linkerd.io/control-plane-component: proxy-injector
|
||
|
|
linkerd.io/control-plane-ns: {{.Values.namespace}}
|
||
|
|
subjects:
|
||
|
|
- kind: ServiceAccount
|
||
|
|
name: linkerd-proxy-injector
|
||
|
|
namespace: {{.Values.namespace}}
|
||
|
|
apiGroup: ""
|
||
|
|
roleRef:
|
||
|
|
kind: ClusterRole
|
||
|
|
name: linkerd-{{.Values.namespace}}-proxy-injector
|
||
|
|
apiGroup: rbac.authorization.k8s.io
|
||
|
|
---
|
||
|
|
kind: ServiceAccount
|
||
|
|
apiVersion: v1
|
||
|
|
metadata:
|
||
|
|
name: linkerd-proxy-injector
|
||
|
|
namespace: {{.Values.namespace}}
|
||
|
|
labels:
|
||
|
|
linkerd.io/control-plane-component: proxy-injector
|
||
|
|
linkerd.io/control-plane-ns: {{.Values.namespace}}
|
||
|
|
{{- include "partials.image-pull-secrets" .Values.imagePullSecrets }}
|
||
|
|
---
|
||
|
|
{{- $host := printf "linkerd-proxy-injector.%s.svc" .Values.namespace }}
|
||
|
|
{{- $ca := genSelfSignedCert $host (list) (list $host) 365 }}
|
||
|
|
{{- if (not .Values.proxyInjector.externalSecret) }}
|
||
|
|
kind: Secret
|
||
|
|
apiVersion: v1
|
||
|
|
metadata:
|
||
|
|
name: linkerd-proxy-injector-k8s-tls
|
||
|
|
namespace: {{ .Values.namespace }}
|
||
|
|
labels:
|
||
|
|
linkerd.io/control-plane-component: proxy-injector
|
||
|
|
linkerd.io/control-plane-ns: {{.Values.namespace}}
|
||
|
|
annotations:
|
||
|
|
{{ include "partials.annotations.created-by" . }}
|
||
|
|
type: kubernetes.io/tls
|
||
|
|
data:
|
||
|
|
tls.crt: {{ ternary (b64enc (trim $ca.Cert)) (b64enc (trim .Values.proxyInjector.crtPEM)) (empty .Values.proxyInjector.crtPEM) }}
|
||
|
|
tls.key: {{ ternary (b64enc (trim $ca.Key)) (b64enc (trim .Values.proxyInjector.keyPEM)) (empty .Values.proxyInjector.keyPEM) }}
|
||
|
|
---
|
||
|
|
{{- end }}
|
||
|
|
apiVersion: admissionregistration.k8s.io/v1
|
||
|
|
kind: MutatingWebhookConfiguration
|
||
|
|
metadata:
|
||
|
|
name: linkerd-proxy-injector-webhook-config
|
||
|
|
labels:
|
||
|
|
linkerd.io/control-plane-component: proxy-injector
|
||
|
|
linkerd.io/control-plane-ns: {{.Values.namespace}}
|
||
|
|
webhooks:
|
||
|
|
- name: linkerd-proxy-injector.linkerd.io
|
||
|
|
namespaceSelector:
|
||
|
|
{{- toYaml .Values.proxyInjector.namespaceSelector | trim | nindent 4 }}
|
||
|
|
clientConfig:
|
||
|
|
service:
|
||
|
|
name: linkerd-proxy-injector
|
||
|
|
namespace: {{ .Values.namespace }}
|
||
|
|
path: "/"
|
||
|
|
{{- if and (.Values.proxyInjector.externalSecret) (empty .Values.proxyInjector.caBundle) }}
|
||
|
|
{{- fail "If proxyInjector.externalSecret is true then you need to provide proxyInjector.caBundle" }}
|
||
|
|
{{- end }}
|
||
|
|
caBundle: {{ ternary (b64enc (trim $ca.Cert)) (b64enc (trim .Values.proxyInjector.caBundle)) (empty .Values.proxyInjector.caBundle) }}
|
||
|
|
failurePolicy: {{.Values.webhookFailurePolicy}}
|
||
|
|
admissionReviewVersions: ["v1", "v1beta1"]
|
||
|
|
rules:
|
||
|
|
- operations: [ "CREATE" ]
|
||
|
|
apiGroups: [""]
|
||
|
|
apiVersions: ["v1"]
|
||
|
|
resources: ["pods", "services"]
|
||
|
|
sideEffects: None
|