# to read the config for terminating authentication
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: RoleBinding
metadata:
  name: searchlight-admission-webhook-extension-server-authentication-reader
  namespace: kube-system
roleRef:
  kind: Role
  apiGroup: rbac.authorization.k8s.io
  name: extension-apiserver-authentication-reader
subjects:
- kind: ServiceAccount
  name: $SEARCHLIGHT_SERVICE_ACCOUNT
  namespace: $SEARCHLIGHT_NAMESPACE
---
# to delegate authentication and authorization
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: searchlight-admission-webhook-auth-delegator
  labels:
    app: searchlight
roleRef:
  kind: ClusterRole
  apiGroup: rbac.authorization.k8s.io
  name: system:auth-delegator
subjects:
- kind: ServiceAccount
  name: $SEARCHLIGHT_SERVICE_ACCOUNT
  namespace: $SEARCHLIGHT_NAMESPACE
---
# to let aggregated apiservers create admission reviews
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: system:appscode:searchlight:admission-webhook-requester
  labels:
    app: searchlight
rules:
- apiGroups: ['admission.monitoring.appscode.com']
  resources: ['*']
  verbs: ['create']

# to read the config for terminating authentication
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: RoleBinding
metadata:
  name: searchlight-admission-webhook-extension-server-authentication-reader
  namespace: kube-system
roleRef:
  kind: Role
  apiGroup: rbac.authorization.k8s.io
  name: extension-apiserver-authentication-reader
subjects:
- kind: ServiceAccount
  name: $SEARCHLIGHT_SERVICE_ACCOUNT
  namespace: $SEARCHLIGHT_NAMESPACE
---
# to delegate authentication and authorization
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: searchlight-admission-webhook-auth-delegator
  labels:
    app: searchlight
roleRef:
  kind: ClusterRole
  apiGroup: rbac.authorization.k8s.io
  name: system:auth-delegator
subjects:
- kind: ServiceAccount
  name: $SEARCHLIGHT_SERVICE_ACCOUNT
  namespace: $SEARCHLIGHT_NAMESPACE
---
# to let aggregated apiservers create admission reviews
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: appscode:searchlight:admission-webhook-requester
  labels:
    app: searchlight
rules:
- apiGroups: ['admission.monitoring.appscode.com']
  resources: ['*']
  verbs: ['create']

Remove system prefix from webhook cluster role
Remove system prefix from webhook cluster role
