apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: istio-cni subjects: - kind: ServiceAccount name: istio-cni namespace: kube-system --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: istio-cni-repair-rolebinding labels: k8s-app: istio-cni-repair istio.io/rev: default install.operator.istio.io/owning-resource: unknown operator.istio.io/component: "Cni" subjects: - kind: ServiceAccount name: istio-cni namespace: kube-system roleRef: apiGroup: rbac.authorization.k8s.io...

            {
              "resource": "rolebindings",
              "responseKind": {
                "group": "",
                "kind": "RoleBinding",
                "version": ""
              },
              "scope": "Namespaced",
              "singularResource": "rolebinding",
              "verbs": [
                "create",
                "delete",
                "deletecollection",

		out["name"] = name
	}
	if port != -1 {
		out["port"] = port
	}
	if targetPort != -1 {
		out["targetPort"] = targetPort
	}
	return out
}

// checkRoleBindingsReferenceRoles fails if any RoleBinding in objs references a Role that isn't found in objs.
func checkRoleBindingsReferenceRoles(g *WithT, objs *ObjectSet) {
	for _, o := range objs.kind(name2.RoleBindingStr).objSlice {
		ou := o.Unstructured()

	return g.Lister.Roles(namespace).Get(name)
}

type RoleBindingLister struct {
	Lister rbaclisters.RoleBindingLister
}

func (l *RoleBindingLister) ListRoleBindings(namespace string) ([]*rbacv1.RoleBinding, error) {
	return l.Lister.RoleBindings(namespace).List(labels.Everything())
}

type ClusterRoleGetter struct {
	Lister rbaclisters.ClusterRoleLister
}

				Verbs:         []string{"get"},
				APIGroups:     []string{""},
				Resources:     []string{"configmaps"},
				ResourceNames: []string{constants.KubeProxyConfigMap},
			},
		},
	}

	rb := &rbac.RoleBinding{
		ObjectMeta: metav1.ObjectMeta{
			Name:      KubeProxyConfigMapRoleName,
			Namespace: metav1.NamespaceSystem,
		},
		RoleRef: rbac.RoleRef{
			APIGroup: rbac.GroupName,
			Kind:     "Role",

            {
              "resource": "rolebindings",
              "responseKind": {
                "group": "",
                "kind": "RoleBinding",
                "version": ""
              },
              "scope": "Namespaced",
              "singularResource": "rolebinding",
              "verbs": [
                "create",
                "delete",
                "deletecollection",

				Rules:      []rbacv1.PolicyRule{ruleAdmin},
			},
			{
				ObjectMeta: metav1.ObjectMeta{Name: "write-nodes"},
				Rules:      []rbacv1.PolicyRule{ruleWriteNodes},
			},
		},
		roleBindings: []*rbacv1.RoleBinding{
			{
				ObjectMeta: metav1.ObjectMeta{Namespace: "namespace1"},
				Subjects: []rbacv1.Subject{
					{Kind: rbacv1.UserKind, Name: "foobar"},
					{Kind: rbacv1.GroupKind, Name: "group1"},
				},

- apiGroups: [""]
  resources: ["configmaps"]
  resourceNames: ["spire-bundle"]
  verbs: ["get", "patch"]

---
# RoleBinding granting the spire-server-role to the SPIRE server
# service account.
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: spire-server-role-binding
  namespace: spire
subjects:
- kind: ServiceAccount
  name: spire-server

  namespace: kube-system
rules:
- apiGroups:
  - ""
  resourceNames:
  - kube-proxy
  resources:
  - configmaps
  verbs:
  - get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  creationTimestamp: null
  name: kube-proxy
  namespace: kube-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: kube-proxy
subjects:
- kind: Group

	switch {
	case errors.IsNotFound(err):
		// ignore, authConfigMap is nil now
		return nil
	case errors.IsForbidden(err):
		klog.Warningf("Unable to get configmap/%s in %s.  Usually fixed by "+
			"'kubectl create rolebinding -n %s ROLEBINDING_NAME --role=%s --serviceaccount=YOUR_NS:YOUR_SA'",
			c.configmapName, c.configmapNamespace, c.configmapNamespace, authenticationRoleName)
		return err
	case err != nil:
		return err
	}