# This rolebinding binds role for creation of leader lock configmap for upgrades 4.2-> 4.3
# cluster-policy-controller is split from openshift-controller-manager in 4.3
# leader lock in openshift-controller-manager NamespaceSecurityAllocationController and in ClusterPolicyController
# cluster-policy-controller container runs in ns openshift-kube-controller-manager static pod
# The locks, role, and rolebinding can be removed in 4.4
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  namespace: openshift-kube-controller-manager
  name: system:openshift:leader-election-lock-cluster-policy-controller
roleRef:
  kind: Role
  name: system:openshift:leader-election-lock-cluster-policy-controller
subjects:
- kind: User
  name: system:kube-controller-manager
- kind: ServiceAccount
  name: namespace-security-allocation-controller
  namespace: openshift-infra
