gistfile1.txt

apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: servicemeshcontrolplanes.maistra.io
spec:
  group: maistra.io
  names:
    kind: ServiceMeshControlPlane
    listKind: ServiceMeshControlPlaneList
    plural: servicemeshcontrolplanes
    singular: servicemeshcontrolplane
    shortNames:
      - smcp
  scope: Namespaced
  subresources:
    status: {}
  version: v1
  additionalPrinterColumns:
  - JSONPath: .status.conditions[?(@.type=="Ready")].status
    name: Ready
    description: Whether or not the control plane installation is up to date and ready to handle requests.
    type: stringhttps://gist.github.com/lucasponce/89106d545f5a4890ffe8172bb42cd228
  - JSONPath: .status.conditions[?(@.type=="Ready")].message
    name: Status
    description: The status of the control plane installation.
    type: string
    priority: 1
  - JSONPath: .status.conditions[?(@.type=="Reconciled")].status
    name: Reconciled
    description: Whether or not the control plane installation is up to date with the latest version of this resource.
    type: string
    priority: 1
  - JSONPath: .status.conditions[?(@.type=="Reconciled")].message
    name: Reconciliation Status
    description: The status of the reconciliation process, if the control plane is not up to date with the latest version this resource.
    type: string
    priority: 1
---

apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: servicemeshmemberrolls.maistra.io
spec:
  group: maistra.io
  names:
    kind: ServiceMeshMemberRoll
    listKind: ServiceMeshMemberRollList
    plural: servicemeshmemberrolls
    singular: servicemeshmemberroll
    shortNames:
      - smmr
  scope: Namespaced
  subresources:
    status: {}
  version: v1
  additionalPrinterColumns:
  - JSONPath: .spec.members
    description: Namespaces that are members of this Control Plane
    name: Members
    type: string

---

# create role that can be used to grant users permission to create smcp and smmr resources
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: maistra-admin
  labels:
    rbac.authorization.k8s.io/aggregate-to-admin: "true"
rules:
- apiGroups: ["maistra.io"]
  resources: ["*"]
  verbs: ["*"]

---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: maistra-admin
roleRef:
  kind: ClusterRole
  apiGroup: rbac.authorization.k8s.io
  name: maistra-admin

---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: istio-admin
  labels:
    rbac.authorization.k8s.io/aggregate-to-admin: "true"
rules:
- apiGroups: ["config.istio.io"]
  resources: ["*"]
  verbs: ["*"]
- apiGroups: ["networking.istio.io"]
  resources: ["*"]
  verbs: ["*"]
- apiGroups: ["authentication.istio.io"]
  resources: ["*"]
  verbs: ["*"]
- apiGroups: ["rbac.istio.io"]
  resources: ["*"]
  verbs: ["*"]
- apiGroups: ["authentication.maistra.io"]
  resources: ["*"]
  verbs: ["*"]
- apiGroups: ["rbac.maistra.io"]
  resources: ["*"]
  verbs: ["*"]

---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: istio-admin
roleRef:
  kind: ClusterRole
  apiGroup: rbac.authorization.k8s.io
  name: istio-admin

---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: istio-operator
rules:
- apiGroups:
  - ""
  resources:
  - configmaps
  - endpoints
  - namespaces
  - persistentvolumeclaims
  - pods
  - replicationcontrollers
  - secrets
  - serviceaccounts
  - services
  - events # is this needed?
  verbs:
  - '*'
- apiGroups:
  - apps
  - extensions
  resources:
  - daemonsets
  - deployments
  - deployments/finalizers
  - ingresses # is this needed? should it be converted to a route?
  - ingresses/status
  - replicasets
  - statefulsets
  verbs:
  - '*'
- apiGroups:
  - autoscaling
  resources:
  - horizontalpodautoscalers
  verbs:
  - '*'
- apiGroups:
  - policy
  resources:
  - poddisruptionbudgets
  verbs:
  - '*'
- apiGroups:
  - admissionregistration.k8s.io
  resources:
  - mutatingwebhookconfigurations
  - validatingwebhookconfigurations
  verbs:
  - '*'
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions
  verbs:
  - '*'
- apiGroups:
  - certmanager.k8s.io
  resources:
  - clusterissuers
  verbs:
  - '*'
- apiGroups:
  - networking.k8s.io
  resources:
  - networkpolicies
  verbs:
  - '*'
- apiGroups:
  - rbac.authorization.k8s.io
  resources:
  - clusterrolebindings
  - clusterroles
  - rolebindings
  - roles
  verbs:
  - '*'
- apiGroups:
  - authentication.istio.io
  resources:
  - '*'
  verbs:
  - '*'
- apiGroups:
  - config.istio.io
  resources:
  - '*'
  verbs:
  - '*'
- apiGroups:
  - networking.istio.io
  resources:
  - '*'
  verbs:
  - '*'
- apiGroups:
  - rbac.istio.io
  resources:
  - '*'
  verbs:
  - '*'
- apiGroups:
  - jaegertracing.io
  resources:
  - jaegers
  verbs:
  - '*'
- apiGroups:
  - kiali.io
  resources:
  - kialis
  verbs:
  - '*'
- apiGroups:
  - maistra.io
  resources:
  - '*'
  verbs:
  - '*'
- apiGroups:
  - authentication.maistra.io
  resources:
  - '*'
  verbs:
  - '*'
- apiGroups:
  - rbac.maistra.io
  resources:
  - '*'
  verbs:
  - '*'
- apiGroups:
  - route.openshift.io
  resources:
  - routes
  - routes/custom-host
  verbs:
  - '*'
# required by smmr controller
- apiGroups:
  - authorization.k8s.io
  resources:
  - subjectaccessreviews
  verbs:
  - create
- apiGroups:
  - network.openshift.io
  resources:
  - clusternetworks
  verbs:
  - get
- apiGroups:
  - network.openshift.io
  resources:
  - netnamespaces
  verbs:
  - get
  - list
  - watch
  - update
- apiGroups: 
  - k8s.cni.cncf.io
  resources:
  - network-attachment-definitions
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - watch

# required by cni daemonset
- apiGroups:
  - security.openshift.io
  resources:
  - securitycontextconstraints
  resourceNames:
  - privileged
  verbs:
  - use

# to be removed
- apiGroups:
  - ""
  resources:
  - nodes
  - nodes/proxy
  verbs:
  - get
  - list
  - watch
- apiGroups: # might be required by citadel
  - authentication.k8s.io
  resources:
  - tokenreviews
  verbs:
  - create
- nonResourceURLs:
  - '/metrics'
  verbs:
  - get

---

apiVersion: v1
kind: ServiceAccount
metadata:
  name: istio-operator
  namespace: istio-operator

---

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: istio-operator-account-istio-operator-cluster-role-binding
subjects:
- kind: ServiceAccount
  namespace: istio-operator
  name: istio-operator
roleRef:
  kind: ClusterRole
  name: istio-operator
  apiGroup: rbac.authorization.k8s.io

---

apiVersion: admissionregistration.k8s.io/v1beta1
kind: ValidatingWebhookConfiguration
metadata:
  # this must match what is used inside the operator, which is <operator-namespace>.servicemesh-resources.maistra.io
  name: istio-operator.servicemesh-resources.maistra.io
webhooks:
- name: smcp.validation.maistra.io
  rules:
  - apiGroups:
    - maistra.io
    apiVersions:
    - v1
    operations:
    - CREATE
    - UPDATE
    resources:
    - servicemeshcontrolplanes
  failurePolicy: Fail
  clientConfig:
    caBundle: ""
    service:
      name: admission-controller
      namespace: istio-operator
      path: /validate-smcp
  namespaceSelector: {}
- name: smmr.validation.maistra.io
  rules:
  - apiGroups:
    - maistra.io
    apiVersions:
    - v1
    operations:
    - CREATE
    - UPDATE
    resources:
    - servicemeshmemberrolls
  failurePolicy: Fail
  clientConfig:
    caBundle: ""
    service:
      name: admission-controller
      namespace: istio-operator
      path: /validate-smmr
  namespaceSelector: {}
  
---

apiVersion: v1
kind: Service
metadata:
  name: admission-controller
  namespace: istio-operator
spec:
  ports:
  - port: 443
    protocol: TCP
    targetPort: 11999
  selector:
    name: istio-operator
  type: ClusterIP

---

apiVersion: apps/v1
kind: Deployment
metadata:
  name: istio-operator
  namespace: istio-operator
spec:
  replicas: 1
  selector:
    matchLabels:
      name: istio-operator
  template:
    metadata:
      labels:
        name: istio-operator
    spec:
      serviceAccountName: istio-operator
      volumes:
      - name: discovery-cache
        emptyDir:
          medium: Memory
      containers:
        - name: istio-operator
          image: docker.io/dgrimm/istio-operator:latest-qe
          ports:
          - containerPort: 60000
            name: metrics
          command:
          - istio-operator
          - --discoveryCacheDir
          - /home/istio-operator/.kube/cache/discovery
          imagePullPolicy: Always
          env:
            - name: WATCH_NAMESPACE
              value: ""
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: OPERATOR_NAME
              value: istio-operator
            - name: ISTIO_CNI_IMAGE
              value: maistra/istio-cni-ubi8:1.0.0
#            - name: ISTIO_CNI_IMAGE_PULL_SECRET
#              value: name-of-secret
          volumeMounts:
          - name: discovery-cache
            mountPath: /home/istio-operator/.kube/cache/discovery