- update
- apiGroups:
  - policy
  resources:
  - poddisruptionbudgets
  verbs:
  - '*'
- apiGroups:
  - rbac.authorization.k8s.io
  resources:
  - clusterrolebindings
  - clusterroles
  - roles
  - rolebindings
  verbs:
  - '*'
- apiGroups:
  - coordination.k8s.io
  resources:
  - leases
  verbs:
  - get
  - create
  - update
- apiGroups:
  - ""
  resources:
  - configmaps

terminationGracePeri: {{ $.Values.terminationGracePeri }} {{- with .Values.priorityClassName }} priorityClassName: {{ . }} {{- end }} manifests/charts/gateway/templates/role.yaml {{/*Set up roles for Istio Gateway. Not required for gateway-api*/}} {{- if .Values.rbac.enabled }} apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: {{ include "gateway.serviceAccountName" . }} namespace: {{ .Release.Namespace }} labels: {{- include "gateway.labels" . | nindent 4}} annotations: {{- .Values.annotations...

Jacek Ewertowski <******@****.***> 1655335912 +0200

message SELinuxOptions {
  // User is a SELinux user label that applies to the container.
  // +optional
  optional string user = 1;

  // Role is a SELinux role label that applies to the container.
  // +optional
  optional string role = 2;

  // Type is a SELinux type label that applies to the container.
  // +optional
  optional string type = 3;

name: envoy.filters.http.rbac
typedConfig:
  '@type': type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC
  rules:
    policies:
      ns[foo]-policy[httpbin-1]-rule[0]:
        permissions:
        - andRules:
            rules:
            - orRules:
                rules:
                - header:
                    name: :authority
                    stringMatch:
                      exact: exact.com

  k8s.io.api.core.v1.Affinity affinity = 20;

  // Additional annotations to apply to the istio-cni Pods.
  google.protobuf.Struct podAnnotations = 10 [deprecated = true];

  // PodSecurityPolicy cluster role. No longer used anywhere.
  string psp_cluster_role = 11;

  // Configuration log level of istio-cni binary. By default, istio-cni sends all logs to the UDS server.
  // To see the logs, change global.logging.level to cni:debug.

deterclosed <******@****.***> 1711183043 +0800

        {
            "apiGroups": [
                "rbac.authorization.k8s.io"
            ],
            "resources": [
                "clusterrolebindings",
                "clusterroles",
                "roles",
                "rolebindings"
            ],
            "verbs": [
                "*"
            ]
        },
        {
            "apiGroups": [
                "coordination.k8s.io"

  - update
- apiGroups:
  - policy
  resources:
  - poddisruptionbudgets
  verbs:
  - '*'
- apiGroups:
  - rbac.authorization.k8s.io
  resources:
  - clusterrolebindings
  - clusterroles
  - roles
  - rolebindings
  verbs:
  - '*'
- apiGroups:
  - coordination.k8s.io
  resources:
  - leases
  verbs:
  - get
  - create
  - update
- apiGroups:
  - ""
  resources:

							if err := filter.GetTypedConfig().UnmarshalTo(tcpConfig); err != nil {
								t.Fatal(err)
							}
							if tcpConfig.GetCluster() == util.BlackHoleCluster {
								// Ignore the tcp_proxy filter with black hole cluster that just doesn't have access log.
								continue
							}
							if len(tcpConfig.AccessLog) < 1 {
								t.Fatalf("tcp_proxy want at least 1 access log, got 0")
							}