Lock down the metallb-system/leader-election role.
The leader elector role only needs to be able to get/create/update
one specific leadership lock.
@@ -37,7 +37,8 @@ metadata:
rules:
- apiGroups: [""]
resources: ["endpoints"]
- verbs: ["get", "list", "watch", "create", "update"]
+ resourceNames: ["metallb-speaker"]
+ verbs: ["get", "create", "update"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
