{{- if and (or .Values.externalWorkloads.enabled .Values.clustermesh.useAPIServer) .Values.serviceAccounts.clustermeshApiserver.create }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: clustermesh-apiserver
rules:
- apiGroups:
  - ""
  resources:
  - endpoints
  - namespaces
  - services
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - discovery.k8s.io
  resources:
  - endpointslices
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions
  verbs:
  - list
- apiGroups:
  - cilium.io
  resources:
  - ciliumnodes
  - ciliumnodes/status
  - ciliumexternalworkloads
  - ciliumexternalworkloads/status
  - ciliumidentities
  - ciliumidentities/status
  - ciliumendpoints
  - ciliumendpoints/status
  verbs:
  - '*'
{{- end }}

{{- if and (or .Values.externalWorkloads.enabled .Values.clustermesh.useAPIServer) .Values.serviceAccounts.clustermeshApiserver.create }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: clustermesh-apiserver
rules:
- apiGroups:
  - ""
  resources:
  - nodes/finalizers
  verbs:
  - update
- apiGroups:
  - ""
  resources:
  - endpoints
  - namespaces
  - services
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - discovery.k8s.io
  resources:
  - endpointslices
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions
  verbs:
  - list
- apiGroups:
  - cilium.io
  resources:
  - ciliumnodes
  - ciliumnodes/status
  - ciliumexternalworkloads
  - ciliumexternalworkloads/status
  - ciliumidentities
  - ciliumidentities/status
  - ciliumendpoints
  - ciliumendpoints/status
  verbs:
  - '*'
{{- end }}

Add RBAC Permissions to Clustermesh APIServer Clusterrole
helm: Add RBAC Permissions to Clustermesh APIServer Clusterrole

The Clustermesh-APIServer creates a CiliumEndPoint and sets
a node as its ownerReference, also setting blockOwnerDeletion
to "true". If the OwnerReferencesPermissionEnforcement admission
controller is enabled (such as in environments like Openshift) then
the Clustermesh-APIServer will fail to create the CiliumEndPoint
as it has insufficient privileges to set blockOwnerDeletion of
a node. It needs to be able to "update" "nodes/finalizers" in order
to do this. See #19053 for more details and references.

Signed-off-by: Nate Sweet <6e86808f393e1310ee2d93bf774535aa7e8640d9@pm.me>
