---
###
### Linkerd Namespace
###
---
kind: Namespace
apiVersion: v1
metadata:
  name: linkerd
  annotations:
    linkerd.io/inject: disabled
  labels:
    linkerd.io/is-control-plane: "true"
---
###
### Identity Controller Service RBAC
###
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: linkerd-linkerd-identity
  labels:
    linkerd.io/control-plane-component: identity
    linkerd.io/control-plane-ns: linkerd
rules:
- apiGroups: ["authentication.k8s.io"]
  resources: ["tokenreviews"]
  verbs: ["create"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: linkerd-linkerd-identity
  labels:
    linkerd.io/control-plane-component: identity
    linkerd.io/control-plane-ns: linkerd
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: linkerd-linkerd-identity
subjects:
- kind: ServiceAccount
  name: linkerd-identity
  namespace: linkerd
---
kind: ServiceAccount
apiVersion: v1
metadata:
  name: linkerd-identity
  namespace: linkerd
  labels:
    linkerd.io/control-plane-component: identity
    linkerd.io/control-plane-ns: linkerd
---
###
### Controller RBAC
###
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: linkerd-linkerd-controller
  labels:
    linkerd.io/control-plane-component: controller
    linkerd.io/control-plane-ns: linkerd
rules:
- apiGroups: ["extensions", "apps"]
  resources: ["daemonsets", "deployments", "replicasets", "statefulsets"]
  verbs: ["list", "get", "watch"]
- apiGroups: ["extensions", "batch"]
  resources: ["jobs"]
  verbs: ["list" , "get", "watch"]
- apiGroups: [""]
  resources: ["pods", "endpoints", "services", "replicationcontrollers", "namespaces"]
  verbs: ["list", "get", "watch"]
- apiGroups: ["linkerd.io"]
  resources: ["serviceprofiles"]
  verbs: ["list", "get", "watch"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: linkerd-linkerd-controller
  labels:
    linkerd.io/control-plane-component: controller
    linkerd.io/control-plane-ns: linkerd
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: linkerd-linkerd-controller
subjects:
- kind: ServiceAccount
  name: linkerd-controller
  namespace: linkerd
---
kind: ServiceAccount
apiVersion: v1
metadata:
  name: linkerd-controller
  namespace: linkerd
  labels:
    linkerd.io/control-plane-component: controller
    linkerd.io/control-plane-ns: linkerd
---
###
### Web RBAC
###
---
kind: ServiceAccount
apiVersion: v1
metadata:
  name: linkerd-web
  namespace: linkerd
  labels:
    linkerd.io/control-plane-component: web
    linkerd.io/control-plane-ns: linkerd
---
###
### Service Profile CRD
###
---
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: serviceprofiles.linkerd.io
  annotations:
    linkerd.io/created-by: linkerd/cli dev-undefined
  labels:
    linkerd.io/control-plane-ns: linkerd
spec:
  group: linkerd.io
  version: v1alpha1
  scope: Namespaced
  names:
    plural: serviceprofiles
    singular: serviceprofile
    kind: ServiceProfile
    shortNames:
    - sp
  validation:
    openAPIV3Schema:
      properties:
        spec:
          required:
          - routes
          properties:
            retryBudget:
              required:
              - minRetriesPerSecond
              - retryRatio
              - ttl
              type: object
              properties:
                minRetriesPerSecond:
                  type: integer
                retryRatio:
                  type: number
                ttl:
                  type: string
            routes:
              type: array
              items:
                type: object
                required:
                - name
                - condition
                properties:
                  name:
                    type: string
                  timeout:
                    type: string
                  condition:
                    type: object
                    minProperties: 1
                    properties:
                      method:
                        type: string
                      pathRegex:
                        type: string
                      all:
                        type: array
                        items:
                          type: object
                      any:
                        type: array
                        items:
                          type: object
                      not:
                        type: object
                  responseClasses:
                    type: array
                    items:
                      type: object
                      required:
                      - condition
                      properties:
                        isFailure:
                          type: boolean
                        condition:
                          type: object
                          properties:
                            status:
                              type: object
                              minProperties: 1
                              properties:
                                min:
                                  type: integer
                                  minimum: 100
                                  maximum: 599
                                max:
                                  type: integer
                                  minimum: 100
                                  maximum: 599
                            all:
                              type: array
                              items:
                                type: object
                            any:
                              type: array
                              items:
                                type: object
                            not:
                              type: object
---
###
### Prometheus RBAC
###
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: linkerd-linkerd-prometheus
  labels:
    linkerd.io/control-plane-component: prometheus
    linkerd.io/control-plane-ns: linkerd
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: linkerd-linkerd-prometheus
  labels:
    linkerd.io/control-plane-component: prometheus
    linkerd.io/control-plane-ns: linkerd
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: linkerd-linkerd-prometheus
subjects:
- kind: ServiceAccount
  name: linkerd-prometheus
  namespace: linkerd
---
kind: ServiceAccount
apiVersion: v1
metadata:
  name: linkerd-prometheus
  namespace: linkerd
  labels:
    linkerd.io/control-plane-component: prometheus
    linkerd.io/control-plane-ns: linkerd
---
###
### Grafana RBAC
###
---
kind: ServiceAccount
apiVersion: v1
metadata:
  name: linkerd-grafana
  namespace: linkerd
  labels:
    linkerd.io/control-plane-component: grafana
    linkerd.io/control-plane-ns: linkerd
---
###
### Proxy Injector RBAC
###
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: linkerd-linkerd-proxy-injector
  labels:
    linkerd.io/control-plane-component: proxy-injector
    linkerd.io/control-plane-ns: linkerd
rules:
- apiGroups: [""]
  resources: ["namespaces"]
  verbs: ["list", "get", "watch"]
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["list"]
- apiGroups: ["apps"]
  resources: ["replicasets"]
  verbs: ["list", "get", "watch"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: linkerd-linkerd-proxy-injector
  labels:
    linkerd.io/control-plane-component: proxy-injector
    linkerd.io/control-plane-ns: linkerd
subjects:
- kind: ServiceAccount
  name: linkerd-proxy-injector
  namespace: linkerd
  apiGroup: ""
roleRef:
  kind: ClusterRole
  name: linkerd-linkerd-proxy-injector
  apiGroup: rbac.authorization.k8s.io
---
kind: ServiceAccount
apiVersion: v1
metadata:
  name: linkerd-proxy-injector
  namespace: linkerd
  labels:
    linkerd.io/control-plane-component: proxy-injector
    linkerd.io/control-plane-ns: linkerd
---
kind: Secret
apiVersion: v1
metadata:
  name: linkerd-proxy-injector-tls
  namespace: linkerd
  labels:
    linkerd.io/control-plane-component: proxy-injector
    linkerd.io/control-plane-ns: linkerd
  annotations:
    linkerd.io/created-by: linkerd/cli dev-undefined
type: Opaque
data:
  crt.pem: cHJveHkgaW5qZWN0b3IgY3J0
  key.pem: cHJveHkgaW5qZWN0b3Iga2V5
---
apiVersion: admissionregistration.k8s.io/v1beta1
kind: MutatingWebhookConfiguration
metadata:
  name: linkerd-proxy-injector-webhook-config
  labels:
    linkerd.io/control-plane-component: proxy-injector
    linkerd.io/control-plane-ns: linkerd
webhooks:
- name: linkerd-proxy-injector.linkerd.io
  namespaceSelector:
    matchExpressions:
    - key: linkerd.io/is-control-plane
      operator: DoesNotExist
  clientConfig:
    service:
      name: linkerd-proxy-injector
      namespace: linkerd
      path: "/"
    caBundle: cHJveHkgaW5qZWN0b3IgY3J0
  failurePolicy: Ignore
  rules:
  - operations: [ "CREATE" ]
    apiGroups: [""]
    apiVersions: ["v1"]
    resources: ["pods"]
  sideEffects: None
---
###
### Service Profile Validator RBAC
###
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: linkerd-linkerd-sp-validator
  labels:
    linkerd.io/control-plane-component: sp-validator
    linkerd.io/control-plane-ns: linkerd
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["list"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: linkerd-linkerd-sp-validator
  labels:
    linkerd.io/control-plane-component: sp-validator
    linkerd.io/control-plane-ns: linkerd
subjects:
- kind: ServiceAccount
  name: linkerd-sp-validator
  namespace: linkerd
  apiGroup: ""
roleRef:
  kind: ClusterRole
  name: linkerd-linkerd-sp-validator
  apiGroup: rbac.authorization.k8s.io
---
kind: ServiceAccount
apiVersion: v1
metadata:
  name: linkerd-sp-validator
  namespace: linkerd
  labels:
    linkerd.io/control-plane-component: sp-validator
    linkerd.io/control-plane-ns: linkerd
---
kind: Secret
apiVersion: v1
metadata:
  name: linkerd-sp-validator-tls
  namespace: linkerd
  labels:
    linkerd.io/control-plane-component: sp-validator
    linkerd.io/control-plane-ns: linkerd
  annotations:
    linkerd.io/created-by: linkerd/cli dev-undefined
type: Opaque
data:
  crt.pem: cHJvZmlsZSB2YWxpZGF0b3IgY3J0
  key.pem: cHJvZmlsZSB2YWxpZGF0b3Iga2V5
---
apiVersion: admissionregistration.k8s.io/v1beta1
kind: ValidatingWebhookConfiguration
metadata:
  name: linkerd-sp-validator-webhook-config
  labels:
    linkerd.io/control-plane-component: sp-validator
    linkerd.io/control-plane-ns: linkerd
webhooks:
- name: linkerd-sp-validator.linkerd.io
  clientConfig:
    service:
      name: linkerd-sp-validator
      namespace: linkerd
      path: "/"
    caBundle: cHJvZmlsZSB2YWxpZGF0b3IgY3J0
  failurePolicy: Ignore
  rules:
  - operations: [ "CREATE" , "UPDATE" ]
    apiGroups: ["linkerd.io"]
    apiVersions: ["v1alpha1"]
    resources: ["serviceprofiles"]
  sideEffects: None
---
###
### Tap RBAC
###
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: linkerd-linkerd-tap
  labels:
    linkerd.io/control-plane-component: tap
    linkerd.io/control-plane-ns: linkerd
rules:
- apiGroups: [""]
  resources: ["pods", "services", "replicationcontrollers", "namespaces"]
  verbs: ["list", "get", "watch"]
- apiGroups: ["extensions", "apps"]
  resources: ["daemonsets", "deployments", "replicasets", "statefulsets"]
  verbs: ["list", "get", "watch"]
- apiGroups: ["extensions", "batch"]
  resources: ["jobs"]
  verbs: ["list" , "get", "watch"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: linkerd-linkerd-tap
  labels:
    linkerd.io/control-plane-component: tap
    linkerd.io/control-plane-ns: linkerd
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: linkerd-linkerd-tap
subjects:
- kind: ServiceAccount
  name: linkerd-tap
  namespace: linkerd
---
kind: ServiceAccount
apiVersion: v1
metadata:
  name: linkerd-tap
  namespace: linkerd
  labels:
    linkerd.io/control-plane-component: tap
    linkerd.io/control-plane-ns: linkerd
---
###
### Control Plane PSP
###
---
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: linkerd-linkerd-control-plane
  labels:
    linkerd.io/control-plane-ns: linkerd
spec:
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: true
  allowedCapabilities:
  - NET_ADMIN
  - NET_RAW
  requiredDropCapabilities:
  - ALL
  hostNetwork: false
  hostIPC: false
  hostPID: false
  seLinux:
    rule: RunAsAny
  runAsUser:
    rule: RunAsAny
  supplementalGroups:
    rule: MustRunAs
    ranges:
    - min: 1
      max: 65535
  fsGroup:
    rule: MustRunAs
    ranges:
    - min: 1
      max: 65535
  volumes:
  - configMap
  - emptyDir
  - secret
  - projected
  - downwardAPI
  - persistentVolumeClaim
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: linkerd-psp
  namespace: linkerd
  labels:
    linkerd.io/control-plane-ns: linkerd
rules:
- apiGroups: ['policy', 'extensions']
  resources: ['podsecuritypolicies']
  verbs: ['use']
  resourceNames:
  - linkerd-linkerd-control-plane
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: linkerd-psp
  namespace: linkerd
  labels:
    linkerd.io/control-plane-ns: linkerd
roleRef:
  kind: Role
  name: linkerd-psp
  apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
  name: linkerd-controller
  namespace: linkerd
- kind: ServiceAccount
  name: linkerd-grafana
  namespace: linkerd
- kind: ServiceAccount
  name: linkerd-identity
  namespace: linkerd
- kind: ServiceAccount
  name: linkerd-prometheus
  namespace: linkerd
- kind: ServiceAccount
  name: linkerd-proxy-injector
  namespace: linkerd
- kind: ServiceAccount
  name: linkerd-sp-validator
  namespace: linkerd
- kind: ServiceAccount
  name: linkerd-tap
  namespace: linkerd
- kind: ServiceAccount
  name: linkerd-web
  namespace: linkerd
---