---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app: metallb
  name: pod-lister
  namespace: metallb-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: pod-lister
subjects:
- kind: ServiceAccount
  name: speaker
  namespace: metallb-system
---
apiVersion: rbac.authorization.k8s.io/v1

{{- define "mesh" }}
    # The trust domain corresponds to the trust root of a system.
    # Refer to https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain
    trustDomain: "cluster.local"

    # The namespace to treat as the administrative root namespace for Istio configuration.
    # When processing a leaf namespace Istio will search for declarations in that namespace first

# Configures Depdendabot to PR go security updates only

version: 2
updates:
  # Go configuration for master branch
  - package-ecosystem: "gomod"
    directory: "/"
    schedule:
      interval: "daily"
    # Limit number of open PRs to 0 so that we only get security updates
    # See https://docs.github.com/en/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates

    # Must be set for any cluster configured with private docker registry.
    imagePullSecrets: []
    # - private-registry-key

    # Enabled by default in master for maximising testing.
    istiod:
      enableAnalysis: false
    # To output all istio components logs in json format by adding --log_as_json argument to each container argument
    logAsJson: false

# This manifest installs the Istio install-cni container, as well
# as the Istio CNI plugin and config on
# each master and worker node in a Kubernetes cluster.
{{- $defaultBinDir :=
    (.Capabilities.KubeVersion.GitVersion | contains "-gke") | ternary
      "/home/kubernetes/bin"
      "/opt/cni/bin"
}}
kind: DaemonSet
apiVersion: apps/v1
metadata:
  name: istio-cni-node
  namespace: {{ .Release.Namespace }}
  labels:

    autoscalingv2API: true

  meshConfig:
    enablePrometheusMerge: true

    # The trust domain corresponds to the trust root of a system
    # Refer to https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain
    trustDomain: "cluster.local"

    defaultConfig:
      proxyMetadata: {}
      tracing:
      #      tlsSettings:

    autoscalingv2API: true

  meshConfig:
    enablePrometheusMerge: true

    # The trust domain corresponds to the trust root of a system
    # Refer to https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain
    trustDomain: "cluster.local"

    defaultConfig:
      proxyMetadata: {}
      tracing:
      #      tlsSettings: