Update addon manifests to use policy/v1beta1 and grant permissions in policy API group.

cluster/addons/etcd-empty-dir-cleanup/podsecuritypolicies/etcd-empty-dir-cleanup-psp-role.yaml

@@ -8,7 +8,7 @@ metadata:
     addonmanager.kubernetes.io/mode: Reconcile
 rules:
 - apiGroups:
-  - extensions
+  - policy
   resourceNames:
   - gce.etcd-empty-dir-cleanup
   resources:

cluster/addons/etcd-empty-dir-cleanup/podsecuritypolicies/etcd-empty-dir-cleanup-psp.yaml

-apiVersion: extensions/v1beta1
+apiVersion: policy/v1beta1
 kind: PodSecurityPolicy
 metadata:
   name: gce.etcd-empty-dir-cleanup

cluster/addons/fluentd-gcp/podsecuritypolicies/event-exporter-psp-role.yaml

@@ -8,7 +8,7 @@ metadata:
     addonmanager.kubernetes.io/mode: Reconcile
 rules:
 - apiGroups:
-  - extensions
+  - policy
   resourceNames:
   - gce.event-exporter
   resources:

cluster/addons/fluentd-gcp/podsecuritypolicies/event-exporter-psp.yaml

-apiVersion: extensions/v1beta1
+apiVersion: policy/v1beta1
 kind: PodSecurityPolicy
 metadata:
   name: gce.event-exporter

cluster/addons/fluentd-gcp/podsecuritypolicies/fluentd-gcp-psp-role.yaml

@@ -8,7 +8,7 @@ metadata:
     addonmanager.kubernetes.io/mode: Reconcile
 rules:
 - apiGroups:
-  - extensions
+  - policy
   resourceNames:
   - gce.fluentd-gcp
   resources:

cluster/addons/fluentd-gcp/podsecuritypolicies/fluentd-gcp-psp.yaml

-apiVersion: extensions/v1beta1
+apiVersion: policy/v1beta1
 kind: PodSecurityPolicy
 metadata:
   name: gce.fluentd-gcp

cluster/gce/addons/podsecuritypolicies/persistent-volume-binder-role.yaml

@@ -11,7 +11,7 @@ metadata:
     addonmanager.kubernetes.io/mode: Reconcile
 rules:
 - apiGroups:
-  - extensions
+  - policy
   resourceNames:
   - gce.persistent-volume-binder
   resources:

cluster/gce/addons/podsecuritypolicies/persistent-volume-binder.yaml

-apiVersion: extensions/v1beta1
+apiVersion: policy/v1beta1
 kind: PodSecurityPolicy
 metadata:
   name: gce.persistent-volume-binder

cluster/gce/addons/podsecuritypolicies/privileged-role.yaml

@@ -7,7 +7,7 @@ metadata:
     addonmanager.kubernetes.io/mode: Reconcile
 rules:
 - apiGroups:
-  - extensions
+  - policy
   resourceNames:
   - gce.privileged
   resources:

cluster/gce/addons/podsecuritypolicies/privileged.yaml

-apiVersion: extensions/v1beta1
+apiVersion: policy/v1beta1
 kind: PodSecurityPolicy
 metadata:
   name: gce.privileged

cluster/gce/addons/podsecuritypolicies/unprivileged-addon-role.yaml

@@ -8,7 +8,7 @@ metadata:
     addonmanager.kubernetes.io/mode: Reconcile
 rules:
 - apiGroups:
-  - extensions
+  - policy
   resourceNames:
   - gce.unprivileged-addon
   resources:

cluster/gce/addons/podsecuritypolicies/unprivileged-addon.yaml

-apiVersion: extensions/v1beta1
+apiVersion: policy/v1beta1
 kind: PodSecurityPolicy
 metadata:
   name: gce.unprivileged-addon