feat(chart): allow custom role bindings

Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>
projectcapsule · Nov 30, 2023 · 2792b58 · 2792b58
1 parent 21c0d04
commit 2792b58
Show file tree

Hide file tree

Showing 4 changed files with 51 additions and 44 deletions.
diff --git a/charts/capsule/README.md b/charts/capsule/README.md
@@ -114,6 +114,9 @@ Here the values you can override:
 | manager.options.logLevel | string | `"4"` | Set the log verbosity of the capsule with a value from 1 to 10 |
 | manager.options.nodeMetadata | object | `{"forbiddenAnnotations":{"denied":[],"deniedRegex":""},"forbiddenLabels":{"denied":[],"deniedRegex":""}}` | Allows to set the forbidden metadata for the worker nodes that could be patched by a Tenant |
 | manager.options.protectedNamespaceRegex | string | `""` | If specified, disallows creation of namespaces matching the passed regexp |
+| manager.rbac.create | bool | `true` | Specifies whether RBAC resources should be created. |
+| manager.rbac.existingClusterRoles | list | `[]` | Specifies further cluster roles to be added to the Capsule manager service account. |
+| manager.rbac.existingRoles | list | `[]` | Specifies further cluster roles to be added to the Capsule manager service account. |
 | manager.readinessProbe | object | `{"httpGet":{"path":"/readyz","port":10080}}` | Configure the readiness probe using Deployment probe spec |
 | manager.resources.limits.cpu | string | `"200m"` |  |
 | manager.resources.limits.memory | string | `"128Mi"` |  |

diff --git a/charts/capsule/ci/test-values.yaml b/charts/capsule/ci/test-values.yaml
@@ -1,5 +1,12 @@
 fullnameOverride: capsule
 manager:
+    # Manager RBAC
+  rbac:
+    create: true
+    existingClusterRoles:
+    - "view"
+    existingRoles:
+    - "some-role"
   resources:
     limits:
       cpu: 500m

diff --git a/charts/capsule/templates/rbac.yaml b/charts/capsule/templates/rbac.yaml
@@ -1,77 +1,63 @@
-kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ include "capsule.fullname" . }}-proxy-role
-  labels:
-    {{- include "capsule.labels" . | nindent 4 }}
-  {{- with .Values.customAnnotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-rules:
-- apiGroups:
-  - authentication.k8s.io
-  resources:
-  - tokenreviews
-  verbs:
-  - create
-- apiGroups:
-  - authorization.k8s.io
-  resources:
-  - subjectaccessreviews
-  verbs:
-  - create
+{{- if $.Values.manager.rbac.create }}
 ---
-kind: ClusterRole
+kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: {{ include "capsule.fullname" . }}-metrics-reader
+  name: {{ include "capsule.fullname" . }}-manager-rolebinding
   labels:
     {{- include "capsule.labels" . | nindent 4 }}
   {{- with .Values.customAnnotations }}
   annotations:
     {{- toYaml . | nindent 4 }}
   {{- end }}
-rules:
-- nonResourceURLs:
-  - /metrics
-  verbs:
-  - get
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+- kind: ServiceAccount
+  name: {{ include "capsule.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+{{- end }}
+{{- range $_, $cr := $.Values.manager.rbac.existingClusterRoles }}
 ---
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: {{ include "capsule.fullname" . }}-proxy-rolebinding
+  name: {{ include "capsule.fullname" $ }}-{{ $cr }}
   labels:
-    {{- include "capsule.labels" . | nindent 4 }}
-  {{- with .Values.customAnnotations }}
+    {{- include "capsule.labels" $ | nindent 4 }}
+  {{- with $.Values.customAnnotations }}
   annotations:
     {{- toYaml . | nindent 4 }}
   {{- end }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: {{ include "capsule.fullname" . }}-proxy-role
+  name: {{ $cr }}
 subjects:
 - kind: ServiceAccount
-  name: {{ include "capsule.serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
+  name: {{ include "capsule.serviceAccountName" $ }}
+  namespace: {{ $.Release.Namespace }}
+{{- end }}
+{{- range $_, $nr := $.Values.manager.rbac.existingRoles }}
 ---
-kind: ClusterRoleBinding
+kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: {{ include "capsule.fullname" . }}-manager-rolebinding
+  name: {{ include "capsule.fullname" $ }}-{{ $nr }}
   labels:
-    {{- include "capsule.labels" . | nindent 4 }}
-  {{- with .Values.customAnnotations }}
+    {{- include "capsule.labels" $ | nindent 4 }}
+  {{- with $.Values.customAnnotations }}
   annotations:
     {{- toYaml . | nindent 4 }}
   {{- end }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: cluster-admin
+  kind: Role
+  name: {{ $nr }}
 subjects:
 - kind: ServiceAccount
-  name: {{ include "capsule.serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
+  name: {{ include "capsule.serviceAccountName" $ }}
+  namespace: {{ $.Release.Namespace }}
+{{- end }}
diff --git a/charts/capsule/values.yaml b/charts/capsule/values.yaml
@@ -14,6 +14,17 @@ tls:
 # Manager Options
 manager:
 
+  # Manager RBAC
+  rbac:
+    # -- Specifies whether RBAC resources should be created.
+    create: true
+    # -- Specifies further cluster roles to be added to the Capsule manager service account.
+    existingClusterRoles: []
+    # - cluster-admin
+    # -- Specifies further cluster roles to be added to the Capsule manager service account.
+    existingRoles: []
+    # - namespace-admin
+
   # -- Set the controller deployment mode as `Deployment` or `DaemonSet`.
   kind: Deployment