NO MORE GIT SUBMODULE

consul-helm/templates/connect-inject-clusterrole.yaml

@@ -0,0 +1,37 @@
+# The ClusterRole to enable the Connect injector to get, list, watch and patch MutatingWebhookConfiguration.
+{{- if and (not .Values.connectInject.certs.secretName) (or (and (ne (.Values.connectInject.enabled | toString) "-") .Values.connectInject.enabled) (and (eq (.Values.connectInject.enabled | toString) "-") .Values.global.enabled)) }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "consul.fullname" . }}-connect-injector-webhook
+  labels:
+    app: {{ template "consul.name" . }}
+    chart: {{ template "consul.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+rules:
+- apiGroups: ["admissionregistration.k8s.io"]
+  resources: ["mutatingwebhookconfigurations"]
+  verbs: 
+    - "get"
+    - "list"
+    - "watch"
+    - "patch"
+{{- if .Values.global.enablePodSecurityPolicies }}
+- apiGroups: ["policy"]
+  resources: ["podsecuritypolicies"]
+  resourceNames:
+  - {{ template "consul.fullname" . }}-connect-injector-webhook
+  verbs:
+  - use
+{{- end }}
+{{- if and .Values.global.bootstrapACLs .Values.global.enableConsulNamespaces }}
+- apiGroups: [""]
+  resources:
+    - secrets
+  resourceNames:
+    - {{ template "consul.fullname" . }}-connect-inject-acl-token
+  verbs:
+    - get
+{{- end }}
+{{- end }}