resolved comments and stuff

deployments/kubernetes/chart/reloader/templates/clusterrole.yaml

@@ -31,8 +31,6 @@ rules:
       - list
       - get
       - watch
-      - create
-      - delete
 {{- if (include "reloader-namespaceSelector" .) }}
   - apiGroups:
       - ""

deployments/kubernetes/chart/reloader/templates/deployment.yaml

@@ -151,9 +151,7 @@ spec:
               fieldPath: metadata.namespace
 
         - name: RELOADER_DEPLOYMENT_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
+          value: {{ template "reloader-fullname" . }}
           
       {{- if .Values.reloader.enableHA }}
         - name: POD_NAME

deployments/kubernetes/chart/reloader/templates/role.yaml

@@ -103,3 +103,38 @@ rules:
       - create
       - patch
 {{- end }}
+
+---
+
+{{- if .Values.reloader.rbac.enabled }}
+{{- if  (.Capabilities.APIVersions.Has "rbac.authorization.k8s.io/v1") }}
+apiVersion: rbac.authorization.k8s.io/v1
+{{ else }}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+{{- end }}
+kind: Role
+metadata:
+  annotations:
+{{ include "reloader-helm3.annotations" . | indent 4 }}
+  labels:
+{{ include "reloader-labels.chart" . | indent 4 }}
+{{- if .Values.reloader.rbac.labels }}
+{{ tpl (toYaml .Values.reloader.rbac.labels) . | indent 4 }}
+{{- end }}
+{{- if .Values.reloader.matchLabels }}
+{{ tpl (toYaml .Values.reloader.matchLabels) . | indent 4 }}
+{{- end }}
+  name: {{ template "reloader-fullname" . }}-metadata-role
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+    verbs:
+      - list
+      - get
+      - watch
+      - create
+      - update
+{{- end }}

deployments/kubernetes/chart/reloader/templates/rolebinding.yaml

@@ -27,3 +27,34 @@ subjects:
     name: {{ template "reloader-serviceAccountName" . }}
     namespace: {{ .Values.namespace | default .Release.Namespace }}
 {{- end }}
+
+---
+{{- if .Values.reloader.rbac.enabled }}
+{{- if  (.Capabilities.APIVersions.Has "rbac.authorization.k8s.io/v1") }}
+apiVersion: rbac.authorization.k8s.io/v1
+{{ else }}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+{{- end }}
+kind: RoleBinding
+metadata:
+  annotations:
+{{ include "reloader-helm3.annotations" . | indent 4 }}
+  labels:
+{{ include "reloader-labels.chart" . | indent 4 }}
+{{- if .Values.reloader.rbac.labels }}
+{{ tpl (toYaml .Values.reloader.rbac.labels) . | indent 4 }}
+{{- end }}
+{{- if .Values.reloader.matchLabels }}
+{{ tpl (toYaml .Values.reloader.matchLabels) . | indent 4 }}
+{{- end }}
+  name: {{ template "reloader-fullname" . }}-metadata-role-binding
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "reloader-fullname" . }}-metadata-role
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "reloader-serviceAccountName" . }}
+    namespace: {{ .Values.namespace | default .Release.Namespace }}
+{{- end }}

deployments/kubernetes/chart/reloader/values.yaml

@@ -17,7 +17,7 @@ fullnameOverride: ""
 image:
   name: stakater/reloader
   repository: ghcr.io/stakater/reloader
-  tag: v1.4.5
+  tag: test-image
   # digest: sha256:1234567
   pullPolicy: IfNotPresent
 

deployments/kubernetes/reloader.yaml

@@ -76,6 +76,37 @@ subjects:
   name: reloader-reloader
   namespace: default
 ---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: reloader-metadata-role
+  namespace: default
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+    verbs:
+      - list
+      - get
+      - watch
+      - create
+      - update
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: reloader-metadata-role-binding
+  namespace: default
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: reloader-metadata-role
+subjects:
+  - kind: ServiceAccount
+    name: reloader-reloader
+    namespace: default
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -110,9 +141,7 @@ spec:
               fieldPath: metadata.namespace
         
         - name: RELOADER_DEPLOYMENT_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
+          value: default
               
         image: "ghcr.io/stakater/reloader:latest"
         imagePullPolicy: IfNotPresent