metadata:
  name: calico-node
rules:
  # Used for creating service account tokens to be used by the CNI plugin
  - apiGroups: [""]
    resources:
      - serviceaccounts/token
    resourceNames:
      - calico-cni-plugin
    verbs:
      - create
  # The CNI plugin needs to get pods, nodes, and namespaces.
  - apiGroups: [""]
    resources:
      - pods
      - nodes

          "items": {
            "type": "string"
          },
          "type": "array",
          "x-kubernetes-list-type": "atomic"
        },
        "resourceNames": {
          "description": "ResourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.",
          "items": {
            "type": "string"
          },

apiGroups: ["certificates.k8s.io"] resources: - "certificatesigningre" - "certificatesigningre/approval" - "certificatesigningre/status" verbs: ["update", "create", "get", "delete", "watch"] - apiGroups: ["certificates.k8s.io"] resources: - "signers" resourceNames: - "kubernetes.io/legacy-unknown" {{- range .Values.global.certSigners }} - {{ . | quote }} {{- end }} verbs: ["approve"] {{- end}} # Used by Istiod to verify the JWT tokens - apiGroups: ["authentication.k8s.io"] resources: ["tokenreviews"] verbs:...

          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "resourceNames": {
          "description": "ResourceNames is an optional white list of names that the rule applies to.  An empty set means that everything is allowed.  \"*\" means all.",
          "items": {
            "type": "string"
          },