Skip to content

Commit c5bec60

Browse files
andraxyliaandraxylia
authored
Correct match with clusterrole (istio#769)
1 parent c4852e7 commit c5bec60

File tree

5 files changed

+30
-30
lines changed

5 files changed

+30
-30
lines changed

‎install/kubernetes/istio-auth.yaml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,7 @@ subjects:
9191
namespace: istio-system
9292
roleRef:
9393
kind: ClusterRole
94-
name: istio-pilot
94+
name: istio-pilot-istio-system
9595
apiGroup: rbac.authorization.k8s.io
9696
---
9797
# Grant permissions to the CA.
@@ -105,7 +105,7 @@ subjects:
105105
namespace: istio-system
106106
roleRef:
107107
kind: ClusterRole
108-
name: istio-ca
108+
name: istio-ca-istio-system
109109
apiGroup: rbac.authorization.k8s.io
110110
---
111111
# Grant permissions to the Ingress controller.
@@ -119,7 +119,7 @@ subjects:
119119
namespace: istio-system
120120
roleRef:
121121
kind: ClusterRole
122-
name: istio-pilot
122+
name: istio-pilot-istio-system
123123
apiGroup: rbac.authorization.k8s.io
124124
---
125125
# Grant permissions to the Egress controller.
@@ -133,7 +133,7 @@ subjects:
133133
namespace: istio-system
134134
roleRef:
135135
kind: ClusterRole
136-
name: istio-pilot
136+
name: istio-pilot-istio-system
137137
apiGroup: rbac.authorization.k8s.io
138138
---
139139
# Grant permissions to the sidecar.
@@ -149,7 +149,7 @@ subjects:
149149
namespace: istio-system
150150
roleRef:
151151
kind: ClusterRole
152-
name: istio-sidecar
152+
name: istio-sidecar-istio-system
153153
apiGroup: rbac.authorization.k8s.io
154154
---
155155
# Grant permissions to Mixer.
@@ -163,7 +163,7 @@ subjects:
163163
namespace: istio-system
164164
roleRef:
165165
kind: ClusterRole
166-
name: istio-mixer
166+
name: istio-mixer-istio-system
167167
apiGroup: rbac.authorization.k8s.io
168168
---
169169
# Mixer

‎install/kubernetes/istio-cluster-wide.yaml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,7 @@ subjects:
9191
namespace: istio-system
9292
roleRef:
9393
kind: ClusterRole
94-
name: istio-pilot
94+
name: istio-pilot-istio-system
9595
apiGroup: rbac.authorization.k8s.io
9696
---
9797
# Grant permissions to the CA.
@@ -105,7 +105,7 @@ subjects:
105105
namespace: istio-system
106106
roleRef:
107107
kind: ClusterRole
108-
name: istio-ca
108+
name: istio-ca-istio-system
109109
apiGroup: rbac.authorization.k8s.io
110110
---
111111
# Grant permissions to the Ingress controller.
@@ -119,7 +119,7 @@ subjects:
119119
namespace: istio-system
120120
roleRef:
121121
kind: ClusterRole
122-
name: istio-pilot
122+
name: istio-pilot-istio-system
123123
apiGroup: rbac.authorization.k8s.io
124124
---
125125
# Grant permissions to the Egress controller.
@@ -133,7 +133,7 @@ subjects:
133133
namespace: istio-system
134134
roleRef:
135135
kind: ClusterRole
136-
name: istio-pilot
136+
name: istio-pilot-istio-system
137137
apiGroup: rbac.authorization.k8s.io
138138
---
139139
# Grant permissions to the sidecar.
@@ -149,7 +149,7 @@ subjects:
149149
namespace: istio-system
150150
roleRef:
151151
kind: ClusterRole
152-
name: istio-sidecar
152+
name: istio-sidecar-istio-system
153153
apiGroup: rbac.authorization.k8s.io
154154
---
155155
# Grant permissions to Mixer.
@@ -163,7 +163,7 @@ subjects:
163163
namespace: istio-system
164164
roleRef:
165165
kind: ClusterRole
166-
name: istio-mixer
166+
name: istio-mixer-istio-system
167167
apiGroup: rbac.authorization.k8s.io
168168
---
169169
# Mixer

‎install/kubernetes/istio-rbac-beta.yaml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ subjects:
8484
namespace: istio-system
8585
roleRef:
8686
kind: ClusterRole
87-
name: istio-pilot
87+
name: istio-pilot-istio-system
8888
apiGroup: rbac.authorization.k8s.io
8989
---
9090
# Grant permissions to the CA.
@@ -98,7 +98,7 @@ subjects:
9898
namespace: istio-system
9999
roleRef:
100100
kind: ClusterRole
101-
name: istio-ca
101+
name: istio-ca-istio-system
102102
apiGroup: rbac.authorization.k8s.io
103103
---
104104
# Grant permissions to the Ingress controller.
@@ -112,7 +112,7 @@ subjects:
112112
namespace: istio-system
113113
roleRef:
114114
kind: ClusterRole
115-
name: istio-pilot
115+
name: istio-pilot-istio-system
116116
apiGroup: rbac.authorization.k8s.io
117117
---
118118
# Grant permissions to the Egress controller.
@@ -126,7 +126,7 @@ subjects:
126126
namespace: istio-system
127127
roleRef:
128128
kind: ClusterRole
129-
name: istio-pilot
129+
name: istio-pilot-istio-system
130130
apiGroup: rbac.authorization.k8s.io
131131
---
132132
# Grant permissions to the sidecar.
@@ -142,7 +142,7 @@ subjects:
142142
namespace: istio-system
143143
roleRef:
144144
kind: ClusterRole
145-
name: istio-sidecar
145+
name: istio-sidecar-istio-system
146146
apiGroup: rbac.authorization.k8s.io
147147
---
148148
# Grant permissions to Mixer.
@@ -156,6 +156,6 @@ subjects:
156156
namespace: istio-system
157157
roleRef:
158158
kind: ClusterRole
159-
name: istio-mixer
159+
name: istio-mixer-istio-system
160160
apiGroup: rbac.authorization.k8s.io
161161
---

‎install/kubernetes/istio.yaml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,7 @@ subjects:
9191
namespace: istio-system
9292
roleRef:
9393
kind: ClusterRole
94-
name: istio-pilot
94+
name: istio-pilot-istio-system
9595
apiGroup: rbac.authorization.k8s.io
9696
---
9797
# Grant permissions to the CA.
@@ -105,7 +105,7 @@ subjects:
105105
namespace: istio-system
106106
roleRef:
107107
kind: ClusterRole
108-
name: istio-ca
108+
name: istio-ca-istio-system
109109
apiGroup: rbac.authorization.k8s.io
110110
---
111111
# Grant permissions to the Ingress controller.
@@ -119,7 +119,7 @@ subjects:
119119
namespace: istio-system
120120
roleRef:
121121
kind: ClusterRole
122-
name: istio-pilot
122+
name: istio-pilot-istio-system
123123
apiGroup: rbac.authorization.k8s.io
124124
---
125125
# Grant permissions to the Egress controller.
@@ -133,7 +133,7 @@ subjects:
133133
namespace: istio-system
134134
roleRef:
135135
kind: ClusterRole
136-
name: istio-pilot
136+
name: istio-pilot-istio-system
137137
apiGroup: rbac.authorization.k8s.io
138138
---
139139
# Grant permissions to the sidecar.
@@ -149,7 +149,7 @@ subjects:
149149
namespace: istio-system
150150
roleRef:
151151
kind: ClusterRole
152-
name: istio-sidecar
152+
name: istio-sidecar-istio-system
153153
apiGroup: rbac.authorization.k8s.io
154154
---
155155
# Grant permissions to Mixer.
@@ -163,7 +163,7 @@ subjects:
163163
namespace: istio-system
164164
roleRef:
165165
kind: ClusterRole
166-
name: istio-mixer
166+
name: istio-mixer-istio-system
167167
apiGroup: rbac.authorization.k8s.io
168168
---
169169
# Mixer

‎install/kubernetes/templates/istio-rbac-beta.yaml.tmpl‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ subjects:
8484
namespace: {ISTIO_NAMESPACE}
8585
roleRef:
8686
kind: ClusterRole
87-
name: istio-pilot
87+
name: istio-pilot-{ISTIO_NAMESPACE}
8888
apiGroup: rbac.authorization.k8s.io
8989
---
9090
# Grant permissions to the CA.
@@ -98,7 +98,7 @@ subjects:
9898
namespace: {ISTIO_NAMESPACE}
9999
roleRef:
100100
kind: ClusterRole
101-
name: istio-ca
101+
name: istio-ca-{ISTIO_NAMESPACE}
102102
apiGroup: rbac.authorization.k8s.io
103103
---
104104
# Grant permissions to the Ingress controller.
@@ -112,7 +112,7 @@ subjects:
112112
namespace: {ISTIO_NAMESPACE}
113113
roleRef:
114114
kind: ClusterRole
115-
name: istio-pilot
115+
name: istio-pilot-{ISTIO_NAMESPACE}
116116
apiGroup: rbac.authorization.k8s.io
117117
---
118118
# Grant permissions to the Egress controller.
@@ -126,7 +126,7 @@ subjects:
126126
namespace: {ISTIO_NAMESPACE}
127127
roleRef:
128128
kind: ClusterRole
129-
name: istio-pilot
129+
name: istio-pilot-{ISTIO_NAMESPACE}
130130
apiGroup: rbac.authorization.k8s.io
131131
---
132132
# Grant permissions to the sidecar.
@@ -142,7 +142,7 @@ subjects:
142142
namespace: {ISTIO_NAMESPACE}
143143
roleRef:
144144
kind: ClusterRole
145-
name: istio-sidecar
145+
name: istio-sidecar-{ISTIO_NAMESPACE}
146146
apiGroup: rbac.authorization.k8s.io
147147
---
148148
# Grant permissions to Mixer.
@@ -156,6 +156,6 @@ subjects:
156156
namespace: {ISTIO_NAMESPACE}
157157
roleRef:
158158
kind: ClusterRole
159-
name: istio-mixer
159+
name: istio-mixer-{ISTIO_NAMESPACE}
160160
apiGroup: rbac.authorization.k8s.io
161161
---

0 commit comments

Comments
 (0)