apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    addonmanager.kubernetes.io/mode: Reconcile
  name: system::leader-locking-cloud-controller-manager
  namespace: kube-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: system::leader-locking-cloud-controller-manager
subjects:
- kind: ServiceAccount
  name: cloud-controller-manager
  namespace: kube-system
---

  labels:
    addonmanager.kubernetes.io/mode: Reconcile
rules:
- apiGroups: ["coordination.k8s.io"]
  resources: ["leases"]
  verbs: ["get", "watch", "list", "delete", "update", "create"]

---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: volume-snapshot-controller-leaderelection
  namespace: kube-system
  labels:
    addonmanager.kubernetes.io/mode: Reconcile
subjects:

  namespace: {{ .Release.Namespace }}
---
{{- if .Values.cni.repair.enabled }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: {{ template "name" . }}-repair-rolebinding
  labels:
    k8s-app: {{ template "name" . }}-repair
    release: {{ .Release.Name }}
    istio.io/rev: {{ .Values.revision | default "default" }}

  $ kubectl delete clusterrolebinding spire-server-cluster-role-binding spire-agent-cluster-role-binding manager-role-binding
  $ kubectl delete role spire-server-role leader-election-role
  $ kubectl delete rolebinding spire-server-role-binding leader-election-role-binding
  $ kubectl delete ValidatingWebhookConfiguration spire-controller-manager-webhook
  $ kubectl delete csidriver csi.spiffe.io

  - nodes/metrics
  verbs:
  - get
- apiGroups:
  - ""
  resources:
  - pods
  - nodes
  verbs:
  - get
  - list
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    k8s-app: metrics-server
  name: metrics-server-auth-reader
  namespace: kube-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role

				ResourceNames: []string{bootstrapapi.ConfigMapClusterInfo},
			},
		},
	})
	if err != nil {
		return err
	}

	return apiclient.CreateOrUpdateRoleBinding(client, &rbac.RoleBinding{
		ObjectMeta: metav1.ObjectMeta{
			Name:      BootstrapSignerClusterRoleName,
			Namespace: metav1.NamespacePublic,
		},
		RoleRef: rbac.RoleRef{
			APIGroup: rbac.GroupName,
			Kind:     "Role",

// It is controlled by "k8s:prerelease-lifecycle-gen:introduced" tags in types.go.
func (in *RoleBinding) APILifecycleIntroduced() (major, minor int) {
	return 1, 8
}

	// that are members of the system:bootstrappers:kubeadm:default-node-token group
	// and to all nodes
	return apiclient.CreateOrUpdateRoleBinding(client, &rbac.RoleBinding{
		ObjectMeta: metav1.ObjectMeta{
			Name:      NodesKubeadmConfigClusterRoleName,
			Namespace: metav1.NamespaceSystem,
		},
		RoleRef: rbac.RoleRef{
			APIGroup: rbac.GroupName,
			Kind:     "Role",

				ResourceNames: []string{kubeadmconstants.KubeletBaseConfigurationConfigMap},
			},
		},
	}); err != nil {
		return err
	}

	return apiclient.CreateOrUpdateRoleBinding(client, &rbac.RoleBinding{
		ObjectMeta: metav1.ObjectMeta{
			Name:      kubeadmconstants.KubeletBaseConfigMapRole,
			Namespace: metav1.NamespaceSystem,
		},
		RoleRef: rbac.RoleRef{
			APIGroup: rbac.GroupName,
			Kind:     "Role",

	PDBStr                            = "PodDisruptionBudget"
	ReplicaSetStr                     = "ReplicaSet"
	RoleStr                           = "Role"
	RoleBindingStr                    = "RoleBinding"
	SAStr                             = "ServiceAccount"
	ServiceStr                        = "Service"
	SecretStr                         = "Secret"
	StatefulSetStr                    = "StatefulSet"