gistfile1.txt

apiVersion: extensions/v1beta1
kind: PodSecurityPolicy
metadata:
  name: istio
spec:
  allowPrivilegeEscalation: true
  allowedCapabilities:
  - NET_ADMIN
  fsGroup:
    rule: RunAsAny
  privileged: true
  runAsUser:
    rule: RunAsAny
  seLinux:
    rule: RunAsAny
  supplementalGroups:
    rule: RunAsAny
  volumes:
  - '*'
------

apiVersion: authorization.openshift.io/v1
kind: ClusterRole
metadata:
  name: istio
rules:
- apiGroups:
  - extensions
  attributeRestrictions: null
  resourceNames:
  - istio
  resources:
  - podsecuritypolicies
  verbs:
  - use

------

apiVersion: authorization.openshift.io/v1
groupNames: null
kind: ClusterRoleBinding
metadata:
  name: istio-user
roleRef:
  name: istio
subjects:
- kind: ServiceAccount
  name: default
  namespace: bluegreen
userNames:
- system:serviceaccount:bluegreen:default