When Operator manages webhooks, Galley and Sidecar Injector are depri…

…vileged (#18029)
istio · Oct 18, 2019 · 156d828 · 156d828
1 parent acac632
commit 156d828
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 0 deletions.
diff --git a/install/kubernetes/helm/istio/charts/galley/templates/clusterrole.yaml b/install/kubernetes/helm/istio/charts/galley/templates/clusterrole.yaml
@@ -26,9 +26,11 @@ rules:
   "security.istio.io"]
   resources: ["*/status"]
   verbs: ["update"]
+{{- if not .Values.global.operatorManageWebhooks }}
 - apiGroups: ["admissionregistration.k8s.io"]
   resources: ["validatingwebhookconfigurations"]
   verbs: ["*"]
+{{- end }}
 - apiGroups: ["extensions","apps"]
   resources: ["deployments"]
   resourceNames: ["istio-galley"]

diff --git a/install/kubernetes/helm/istio/charts/sidecarInjectorWebhook/templates/clusterrole.yaml b/install/kubernetes/helm/istio/charts/sidecarInjectorWebhook/templates/clusterrole.yaml
@@ -12,6 +12,8 @@ rules:
 - apiGroups: [""]
   resources: ["configmaps"]
   verbs: ["get", "list", "watch"]
+{{- if not .Values.global.operatorManageWebhooks }}
 - apiGroups: ["admissionregistration.k8s.io"]
   resources: ["mutatingwebhookconfigurations"]
   verbs: ["get", "list", "watch", "patch"]
+{{- end }}