---
###
### Linkerd Namespace
###
---
kind: Namespace
apiVersion: v1
metadata:
  name: linkerd
  annotations:
    linkerd.io/inject: disabled
  labels:
    linkerd.io/is-control-plane: "true"
    config.linkerd.io/admission-webhooks: disabled
    linkerd.io/control-plane-ns: linkerd
---
###
### Identity Controller Service RBAC
###
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: linkerd-linkerd-identity
  labels:
    linkerd.io/control-plane-component: identity
    linkerd.io/control-plane-ns: linkerd
rules:
- apiGroups: ["authentication.k8s.io"]
  resources: ["tokenreviews"]
  verbs: ["create"]
- apiGroups: ["apps"]
  resources: ["deployments"]
  verbs: ["get"]
- apiGroups: [""]
  resources: ["events"]
  verbs: ["create", "patch"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: linkerd-linkerd-identity
  labels:
    linkerd.io/control-plane-component: identity
    linkerd.io/control-plane-ns: linkerd
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: linkerd-linkerd-identity
subjects:
- kind: ServiceAccount
  name: linkerd-identity
  namespace: linkerd
---
kind: ServiceAccount
apiVersion: v1
metadata:
  name: linkerd-identity
  namespace: linkerd
  labels:
    linkerd.io/control-plane-component: identity
    linkerd.io/control-plane-ns: linkerd
---
###
### Controller RBAC
###
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: linkerd-linkerd-controller
  labels:
    linkerd.io/control-plane-component: controller
    linkerd.io/control-plane-ns: linkerd
rules:
- apiGroups: ["extensions", "apps"]
  resources: ["daemonsets", "deployments", "replicasets", "statefulsets"]
  verbs: ["list", "get", "watch"]
- apiGroups: ["extensions", "batch"]
  resources: ["cronjobs", "jobs"]
  verbs: ["list" , "get", "watch"]
- apiGroups: [""]
  resources: ["pods", "endpoints", "services", "replicationcontrollers", "namespaces"]
  verbs: ["list", "get", "watch"]
- apiGroups: ["linkerd.io"]
  resources: ["serviceprofiles"]
  verbs: ["list", "get", "watch"]
- apiGroups: ["split.smi-spec.io"]
  resources: ["trafficsplits"]
  verbs: ["list", "get", "watch"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: linkerd-linkerd-controller
  labels:
    linkerd.io/control-plane-component: controller
    linkerd.io/control-plane-ns: linkerd
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: linkerd-linkerd-controller
subjects:
- kind: ServiceAccount
  name: linkerd-controller
  namespace: linkerd
---
kind: ServiceAccount
apiVersion: v1
metadata:
  name: linkerd-controller
  namespace: linkerd
  labels:
    linkerd.io/control-plane-component: controller
    linkerd.io/control-plane-ns: linkerd
---
###
### Destination Controller Service
###
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: linkerd-linkerd-destination
  labels:
    linkerd.io/control-plane-component: destination
    linkerd.io/control-plane-ns: linkerd
rules:
- apiGroups: ["apps"]
  resources: ["replicasets"]
  verbs: ["list", "get", "watch"]
- apiGroups: ["batch"]
  resources: ["jobs"]
  verbs: ["list", "get", "watch"]
- apiGroups: [""]
  resources: ["pods", "endpoints", "services"]
  verbs: ["list", "get", "watch"]
- apiGroups: ["linkerd.io"]
  resources: ["serviceprofiles"]
  verbs: ["list", "get", "watch"]
- apiGroups: ["split.smi-spec.io"]
  resources: ["trafficsplits"]
  verbs: ["list", "get", "watch"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: linkerd-linkerd-destination
  labels:
    linkerd.io/control-plane-component: destination
    linkerd.io/control-plane-ns: linkerd
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: linkerd-linkerd-destination
subjects:
- kind: ServiceAccount
  name: linkerd-destination
  namespace: linkerd
---
kind: ServiceAccount
apiVersion: v1
metadata:
  name: linkerd-destination
  namespace: linkerd
  labels:
    linkerd.io/control-plane-component: destination
    linkerd.io/control-plane-ns: linkerd
---
###
### Heartbeat RBAC
###
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: linkerd-heartbeat
  namespace: linkerd
  labels:
    linkerd.io/control-plane-ns: linkerd
rules:
- apiGroups: [""]
  resources: ["configmaps"]
  verbs: ["get"]
  resourceNames: ["linkerd-config"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: linkerd-heartbeat
  namespace: linkerd
  labels:
    linkerd.io/control-plane-ns: linkerd
roleRef:
  kind: Role
  name: linkerd-heartbeat
  apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
  name: linkerd-heartbeat
  namespace: linkerd
---
kind: ServiceAccount
apiVersion: v1
metadata:
  name: linkerd-heartbeat
  namespace: linkerd
  labels:
    linkerd.io/control-plane-component: heartbeat
    linkerd.io/control-plane-ns: linkerd
---
###
### Web RBAC
###
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: linkerd-web
  namespace: linkerd
  labels:
    linkerd.io/control-plane-component: web
    linkerd.io/control-plane-ns: linkerd
rules:
- apiGroups: [""]
  resources: ["configmaps"]
  verbs: ["get"]
  resourceNames: ["linkerd-config"]
- apiGroups: [""]
  resources: ["namespaces", "configmaps"]
  verbs: ["get"]
- apiGroups: [""]
  resources: ["serviceaccounts", "pods"]
  verbs: ["list"]
- apiGroups: ["apps"]
  resources: ["replicasets"]
  verbs: ["list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: linkerd-web
  namespace: linkerd
  labels:
    linkerd.io/control-plane-component: web
    linkerd.io/control-plane-ns: linkerd
roleRef:
  kind: Role
  name: linkerd-web
  apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
  name: linkerd-web
  namespace: linkerd
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: linkerd-linkerd-web-check
  labels:
    linkerd.io/control-plane-component: web
    linkerd.io/control-plane-ns: linkerd
rules:
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["clusterroles", "clusterrolebindings"]
  verbs: ["list"]
- apiGroups: ["apiextensions.k8s.io"]
  resources: ["customresourcedefinitions"]
  verbs: ["list"]
- apiGroups: ["admissionregistration.k8s.io"]
  resources: ["mutatingwebhookconfigurations", "validatingwebhookconfigurations"]
  verbs: ["list"]
- apiGroups: ["policy"]
  resources: ["podsecuritypolicies"]
  verbs: ["list"]
- apiGroups: ["linkerd.io"]
  resources: ["serviceprofiles"]
  verbs: ["list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: linkerd-linkerd-web-check
  labels:
    linkerd.io/control-plane-component: web
    linkerd.io/control-plane-ns: linkerd
roleRef:
  kind: ClusterRole
  name: linkerd-linkerd-web-check
  apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
  name: linkerd-web
  namespace: linkerd
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: linkerd-linkerd-web-admin
  labels:
    linkerd.io/control-plane-component: web
    linkerd.io/control-plane-ns: linkerd
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: linkerd-linkerd-tap-admin
subjects:
- kind: ServiceAccount
  name: linkerd-web
  namespace: linkerd
---
kind: ServiceAccount
apiVersion: v1
metadata:
  name: linkerd-web
  namespace: linkerd
  labels:
    linkerd.io/control-plane-component: web
    linkerd.io/control-plane-ns: linkerd
---
###
### Service Profile CRD
###
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: serviceprofiles.linkerd.io
  annotations:
    linkerd.io/created-by: linkerd/cli dev-undefined
  labels:
    linkerd.io/control-plane-ns: linkerd
spec:
  group: linkerd.io
  versions:
  - name: v1alpha1
    served: true
    storage: false
  - name: v1alpha2
    served: true
    storage: true
  scope: Namespaced
  names:
    plural: serviceprofiles
    singular: serviceprofile
    kind: ServiceProfile
    shortNames:
    - sp
---
###
### TrafficSplit CRD
### Copied from https://github.com/deislabs/smi-sdk-go/blob/cea7e1e9372304bbb6c74a3f6ca788d9eaa9cc58/crds/split.yaml
###
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: trafficsplits.split.smi-spec.io
  annotations:
    linkerd.io/created-by: linkerd/cli dev-undefined
  labels:
    linkerd.io/control-plane-ns: linkerd
spec:
  group: split.smi-spec.io
  version: v1alpha1
  scope: Namespaced
  names:
    kind: TrafficSplit
    shortNames:
      - ts
    plural: trafficsplits
    singular: trafficsplit
  additionalPrinterColumns:
  - name: Service
    type: string
    description: The apex service of this split.
    JSONPath: .spec.service
---
###
### Prometheus RBAC
###
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: linkerd-linkerd-prometheus
  labels:
    linkerd.io/control-plane-component: prometheus
    linkerd.io/control-plane-ns: linkerd
rules:
- apiGroups: [""]
  resources: ["nodes", "nodes/proxy", "pods"]
  verbs: ["get", "list", "watch"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: linkerd-linkerd-prometheus
  labels:
    linkerd.io/control-plane-component: prometheus
    linkerd.io/control-plane-ns: linkerd
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: linkerd-linkerd-prometheus
subjects:
- kind: ServiceAccount
  name: linkerd-prometheus
  namespace: linkerd
---
kind: ServiceAccount
apiVersion: v1
metadata:
  name: linkerd-prometheus
  namespace: linkerd
  labels:
    linkerd.io/control-plane-component: prometheus
    linkerd.io/control-plane-ns: linkerd
---
###
### Grafana RBAC
###
---
kind: ServiceAccount
apiVersion: v1
metadata:
  name: linkerd-grafana
  namespace: linkerd
  labels:
    linkerd.io/control-plane-component: grafana
    linkerd.io/control-plane-ns: linkerd
---
###
### Proxy Injector RBAC
###
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: linkerd-linkerd-proxy-injector
  labels:
    linkerd.io/control-plane-component: proxy-injector
    linkerd.io/control-plane-ns: linkerd
rules:
- apiGroups: [""]
  resources: ["events"]
  verbs: ["create", "patch"]
- apiGroups: [""]
  resources: ["namespaces", "replicationcontrollers"]
  verbs: ["list", "get", "watch"]
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["list", "watch"]
- apiGroups: ["extensions", "apps"]
  resources: ["deployments", "replicasets", "daemonsets", "statefulsets"]
  verbs: ["list", "get", "watch"]
- apiGroups: ["extensions", "batch"]
  resources: ["cronjobs", "jobs"]
  verbs: ["list", "get", "watch"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: linkerd-linkerd-proxy-injector
  labels:
    linkerd.io/control-plane-component: proxy-injector
    linkerd.io/control-plane-ns: linkerd
subjects:
- kind: ServiceAccount
  name: linkerd-proxy-injector
  namespace: linkerd
  apiGroup: ""
roleRef:
  kind: ClusterRole
  name: linkerd-linkerd-proxy-injector
  apiGroup: rbac.authorization.k8s.io
---
kind: ServiceAccount
apiVersion: v1
metadata:
  name: linkerd-proxy-injector
  namespace: linkerd
  labels:
    linkerd.io/control-plane-component: proxy-injector
    linkerd.io/control-plane-ns: linkerd
---
kind: Secret
apiVersion: v1
metadata:
  name: linkerd-proxy-injector-tls
  namespace: linkerd
  labels:
    linkerd.io/control-plane-component: proxy-injector
    linkerd.io/control-plane-ns: linkerd
  annotations:
    linkerd.io/created-by: linkerd/cli dev-undefined
type: Opaque
data:
  crt.pem: cHJveHkgaW5qZWN0b3IgY3J0
  key.pem: cHJveHkgaW5qZWN0b3Iga2V5
---
apiVersion: admissionregistration.k8s.io/v1beta1
kind: MutatingWebhookConfiguration
metadata:
  name: linkerd-proxy-injector-webhook-config
  labels:
    linkerd.io/control-plane-component: proxy-injector
    linkerd.io/control-plane-ns: linkerd
webhooks:
- name: linkerd-proxy-injector.linkerd.io
  namespaceSelector:
    matchExpressions:
    - key: config.linkerd.io/admission-webhooks
      operator: NotIn
      values:
      - disabled
  clientConfig:
    service:
      name: linkerd-proxy-injector
      namespace: linkerd
      path: "/"
    caBundle: cHJveHkgaW5qZWN0b3IgY3J0
  failurePolicy: Ignore
  rules:
  - operations: [ "CREATE" ]
    apiGroups: [""]
    apiVersions: ["v1"]
    resources: ["pods"]
  sideEffects: None
---
###
### Service Profile Validator RBAC
###
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: linkerd-linkerd-sp-validator
  labels:
    linkerd.io/control-plane-component: sp-validator
    linkerd.io/control-plane-ns: linkerd
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["list"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: linkerd-linkerd-sp-validator
  labels:
    linkerd.io/control-plane-component: sp-validator
    linkerd.io/control-plane-ns: linkerd
subjects:
- kind: ServiceAccount
  name: linkerd-sp-validator
  namespace: linkerd
  apiGroup: ""
roleRef:
  kind: ClusterRole
  name: linkerd-linkerd-sp-validator
  apiGroup: rbac.authorization.k8s.io
---
kind: ServiceAccount
apiVersion: v1
metadata:
  name: linkerd-sp-validator
  namespace: linkerd
  labels:
    linkerd.io/control-plane-component: sp-validator
    linkerd.io/control-plane-ns: linkerd
---
kind: Secret
apiVersion: v1
metadata:
  name: linkerd-sp-validator-tls
  namespace: linkerd
  labels:
    linkerd.io/control-plane-component: sp-validator
    linkerd.io/control-plane-ns: linkerd
  annotations:
    linkerd.io/created-by: linkerd/cli dev-undefined
type: Opaque
data:
  crt.pem: cHJveHkgaW5qZWN0b3IgY3J0
  key.pem: cHJveHkgaW5qZWN0b3Iga2V5
---
apiVersion: admissionregistration.k8s.io/v1beta1
kind: ValidatingWebhookConfiguration
metadata:
  name: linkerd-sp-validator-webhook-config
  labels:
    linkerd.io/control-plane-component: sp-validator
    linkerd.io/control-plane-ns: linkerd
webhooks:
- name: linkerd-sp-validator.linkerd.io
  namespaceSelector:
    matchExpressions:
    - key: config.linkerd.io/admission-webhooks
      operator: NotIn
      values:
      - disabled
  clientConfig:
    service:
      name: linkerd-sp-validator
      namespace: linkerd
      path: "/"
    caBundle: cHJveHkgaW5qZWN0b3IgY3J0
  failurePolicy: Ignore
  rules:
  - operations: [ "CREATE" , "UPDATE" ]
    apiGroups: ["linkerd.io"]
    apiVersions: ["v1alpha1", "v1alpha2"]
    resources: ["serviceprofiles"]
  sideEffects: None
---
###
### Tap RBAC
###
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: linkerd-linkerd-tap
  labels:
    linkerd.io/control-plane-component: tap
    linkerd.io/control-plane-ns: linkerd
rules:
- apiGroups: [""]
  resources: ["pods", "services", "replicationcontrollers", "namespaces", "nodes"]
  verbs: ["list", "get", "watch"]
- apiGroups: ["extensions", "apps"]
  resources: ["daemonsets", "deployments", "replicasets", "statefulsets"]
  verbs: ["list", "get", "watch"]
- apiGroups: ["extensions", "batch"]
  resources: ["cronjobs", "jobs"]
  verbs: ["list" , "get", "watch"]
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: linkerd-linkerd-tap-admin
  labels:
    linkerd.io/control-plane-component: tap
    linkerd.io/control-plane-ns: linkerd
rules:
- apiGroups: ["tap.linkerd.io"]
  resources: ["*"]
  verbs: ["watch"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: linkerd-linkerd-tap
  labels:
    linkerd.io/control-plane-component: tap
    linkerd.io/control-plane-ns: linkerd
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: linkerd-linkerd-tap
subjects:
- kind: ServiceAccount
  name: linkerd-tap
  namespace: linkerd
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: linkerd-linkerd-tap-auth-delegator
  labels:
    linkerd.io/control-plane-component: tap
    linkerd.io/control-plane-ns: linkerd
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:auth-delegator
subjects:
- kind: ServiceAccount
  name: linkerd-tap
  namespace: linkerd
---
kind: ServiceAccount
apiVersion: v1
metadata:
  name: linkerd-tap
  namespace: linkerd
  labels:
    linkerd.io/control-plane-component: tap
    linkerd.io/control-plane-ns: linkerd
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: linkerd-linkerd-tap-auth-reader
  namespace: kube-system
  labels:
    linkerd.io/control-plane-component: tap
    linkerd.io/control-plane-ns: linkerd
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: extension-apiserver-authentication-reader
subjects:
- kind: ServiceAccount
  name: linkerd-tap
  namespace: linkerd
---
kind: Secret
apiVersion: v1
metadata:
  name: linkerd-tap-tls
  namespace: linkerd
  labels:
    linkerd.io/control-plane-component: tap
    linkerd.io/control-plane-ns: linkerd
  annotations:
    linkerd.io/created-by: linkerd/cli dev-undefined
type: Opaque
data:
  crt.pem: dGFwIGNydA==
  key.pem: dGFwIGtleQ==
---
apiVersion: apiregistration.k8s.io/v1
kind: APIService
metadata:
  name: v1alpha1.tap.linkerd.io
  labels:
    linkerd.io/control-plane-component: tap
    linkerd.io/control-plane-ns: linkerd
spec:
  group: tap.linkerd.io
  version: v1alpha1
  groupPriorityMinimum: 1000
  versionPriority: 100
  service:
    name: linkerd-tap
    namespace: linkerd
  caBundle: dGFwIGNydA==
---
###
### Control Plane PSP
###
---
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: linkerd-linkerd-control-plane
  labels:
    linkerd.io/control-plane-ns: linkerd
spec:
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: true
  allowedCapabilities:
  - NET_ADMIN
  - NET_RAW
  requiredDropCapabilities:
  - ALL
  hostNetwork: false
  hostIPC: false
  hostPID: false
  seLinux:
    rule: RunAsAny
  runAsUser:
    rule: RunAsAny
  supplementalGroups:
    rule: MustRunAs
    ranges:
    - min: 1
      max: 65535
  fsGroup:
    rule: MustRunAs
    ranges:
    - min: 1
      max: 65535
  volumes:
  - configMap
  - emptyDir
  - secret
  - projected
  - downwardAPI
  - persistentVolumeClaim
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: linkerd-psp
  namespace: linkerd
  labels:
    linkerd.io/control-plane-ns: linkerd
rules:
- apiGroups: ['policy', 'extensions']
  resources: ['podsecuritypolicies']
  verbs: ['use']
  resourceNames:
  - linkerd-linkerd-control-plane
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: linkerd-psp
  namespace: linkerd
  labels:
    linkerd.io/control-plane-ns: linkerd
roleRef:
  kind: Role
  name: linkerd-psp
  apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
  name: linkerd-controller
  namespace: linkerd
- kind: ServiceAccount
  name: linkerd-destination
  namespace: linkerd
- kind: ServiceAccount
  name: linkerd-grafana
  namespace: linkerd
- kind: ServiceAccount
  name: linkerd-heartbeat
  namespace: linkerd
- kind: ServiceAccount
  name: linkerd-identity
  namespace: linkerd
- kind: ServiceAccount
  name: linkerd-prometheus
  namespace: linkerd
- kind: ServiceAccount
  name: linkerd-proxy-injector
  namespace: linkerd
- kind: ServiceAccount
  name: linkerd-sp-validator
  namespace: linkerd
- kind: ServiceAccount
  name: linkerd-tap
  namespace: linkerd
- kind: ServiceAccount
  name: linkerd-web
  namespace: linkerd