metallb: Update the configs to align with upstream
@@ -36,15 +36,28 @@ metadata:
labels:
app: metallb
rules:
-- apiGroups: [""]
- resources: ["services"]
- verbs: ["get", "list", "watch", "update"]
-- apiGroups: [""]
- resources: ["services/status"]
- verbs: ["update"]
-- apiGroups: [""]
- resources: ["events"]
- verbs: ["create", "patch"]
+- apiGroups:
+ - ''
+ resources:
+ - services
+ verbs:
+ - get
+ - list
+ - watch
+ - update
+- apiGroups:
+ - ''
+ resources:
+ - services/status
+ verbs:
+ - update
+- apiGroups:
+ - ''
+ resources:
+ - events
+ verbs:
+ - create
+ - patch
`
// Note: Diversion from upstream.
@@ -57,13 +70,16 @@ metadata:
labels:
app: metallb
rules:
-- apiGroups: [""]
- resources: ["services", "endpoints", "nodes"]
- verbs: ["get", "list", "watch"]
-- apiGroups: ["policy"]
- resources: ["podsecuritypolicies"]
- resourceNames: ["metallb-speaker"]
- verbs: ["use"]
+- apiGroups:
+ - ''
+ resources:
+ - services
+ - endpoints
+ - nodes
+ verbs:
+ - get
+ - list
+ - watch
- apiGroups:
- ''
resources:
@@ -71,6 +87,14 @@ rules:
verbs:
- create
- patch
+- apiGroups:
+ - extensions
+ resourceNames:
+ - speaker
+ resources:
+ - podsecuritypolicies
+ verbs:
+ - use
`
const roleConfigWatcher = `
@@ -82,12 +106,14 @@ metadata:
labels:
app: metallb
rules:
-- apiGroups: [""]
- resources: ["configmaps"]
- verbs: ["get", "list", "watch"]
-- apiGroups: [""]
- resources: ["events"]
- verbs: ["create"]
+- apiGroups:
+ - ''
+ resources:
+ - configmaps
+ verbs:
+ - get
+ - list
+ - watch
`
const clusterRoleBindingMetallbSystemController = `
@@ -283,7 +309,7 @@ metadata:
annotations:
seccomp.security.alpha.kubernetes.io/allowedProfileNames: docker/default
seccomp.security.alpha.kubernetes.io/defaultProfileName: docker/default
- name: metallb-speaker
+ name: speaker
labels:
app: metallb
spec:
@@ -292,13 +318,10 @@ spec:
- min: 7472
max: 7472
allowPrivilegeEscalation: false
- readOnlyRootFilesystem: true
allowedCapabilities:
- NET_RAW
- NET_ADMIN
- SYS_ADMIN
- requiredDropCapabilities:
- - all
seLinux:
rule: RunAsAny
fsGroup:
