mirror of
https://github.com/stakater/Reloader.git
synced 2026-08-21 21:16:27 +00:00
Michał MarszałekandClaude Opus 4.8
50153d05ea
Add a third RBAC posture between watch-globally (ClusterRole) and single namespace: give Reloader an explicit list of namespaces to watch. The chart creates a namespace-scoped Role + RoleBinding in each listed namespace (no ClusterRole), and one install covers them all. Go: - new --namespaces flag / options.Namespaces - resolveWatchNamespaces() picks list -> KUBERNETES_NAMESPACE -> all - controller creation loops over the watched namespaces - namespaces-to-ignore is now only honored in global mode (watchGlobally=true); in single-namespace and scoped modes the watched set is already explicit Helm: - new reloader.namespaces value (active when watchGlobally=false); accepts either a YAML list or a comma-separated string for consistency with the sibling namespace options - reloader-watchNamespaces helper (release ns always auto-included, deduped) - shared reloader-namespaced-rules template reused per namespace - role.yaml/rolebinding.yaml range over the list; deployment passes --namespaces - --namespaces-to-ignore only rendered when watchGlobally=true - fail guard for watchGlobally=true + namespaces set Tests: unit test for resolveWatchNamespaces; scoped-namespaces e2e case. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
85 lines
2.8 KiB
YAML
85 lines
2.8 KiB
YAML
{{- if and (not (.Values.reloader.watchGlobally)) (.Values.reloader.rbac.enabled) }}
|
|
{{- $apiVersion := "rbac.authorization.k8s.io/v1" }}
|
|
{{- if not (.Capabilities.APIVersions.Has "rbac.authorization.k8s.io/v1") }}
|
|
{{- $apiVersion = "rbac.authorization.k8s.io/v1beta1" }}
|
|
{{- end }}
|
|
{{- if .Values.reloader.namespaces }}
|
|
{{- range $ns := (include "reloader-watchNamespaces" . | mustFromJson) }}
|
|
apiVersion: {{ $apiVersion }}
|
|
kind: RoleBinding
|
|
metadata:
|
|
annotations:
|
|
{{ include "reloader-helm3.annotations" $ | indent 4 }}
|
|
labels:
|
|
{{ include "reloader-labels.chart" $ | indent 4 }}
|
|
{{- if $.Values.reloader.rbac.labels }}
|
|
{{ tpl (toYaml $.Values.reloader.rbac.labels) $ | indent 4 }}
|
|
{{- end }}
|
|
{{- if $.Values.reloader.matchLabels }}
|
|
{{ tpl (toYaml $.Values.reloader.matchLabels) $ | indent 4 }}
|
|
{{- end }}
|
|
name: {{ template "reloader-fullname" $ }}-role-binding
|
|
namespace: {{ $ns }}
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: {{ template "reloader-fullname" $ }}-role
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: {{ template "reloader-serviceAccountName" $ }}
|
|
namespace: {{ $.Values.namespace | default $.Release.Namespace }}
|
|
---
|
|
{{- end }}
|
|
{{- else }}
|
|
apiVersion: {{ $apiVersion }}
|
|
kind: RoleBinding
|
|
metadata:
|
|
annotations:
|
|
{{ include "reloader-helm3.annotations" . | indent 4 }}
|
|
labels:
|
|
{{ include "reloader-labels.chart" . | indent 4 }}
|
|
{{- if .Values.reloader.rbac.labels }}
|
|
{{ tpl (toYaml .Values.reloader.rbac.labels) . | indent 4 }}
|
|
{{- end }}
|
|
{{- if .Values.reloader.matchLabels }}
|
|
{{ tpl (toYaml .Values.reloader.matchLabels) . | indent 4 }}
|
|
{{- end }}
|
|
name: {{ template "reloader-fullname" . }}-role-binding
|
|
namespace: {{ .Values.namespace | default .Release.Namespace }}
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: {{ template "reloader-fullname" . }}-role
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: {{ template "reloader-serviceAccountName" . }}
|
|
namespace: {{ .Values.namespace | default .Release.Namespace }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
---
|
|
{{- if .Values.reloader.rbac.enabled }}
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
annotations:
|
|
{{ include "reloader-helm3.annotations" . | indent 4 }}
|
|
labels:
|
|
{{ include "reloader-labels.chart" . | indent 4 }}
|
|
{{- if .Values.reloader.rbac.labels }}
|
|
{{ tpl (toYaml .Values.reloader.rbac.labels) . | indent 4 }}
|
|
{{- end }}
|
|
{{- if .Values.reloader.matchLabels }}
|
|
{{ tpl (toYaml .Values.reloader.matchLabels) . | indent 4 }}
|
|
{{- end }}
|
|
name: {{ template "reloader-fullname" . }}-metadata-role-binding
|
|
namespace: {{ .Values.namespace | default .Release.Namespace }}
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: {{ template "reloader-fullname" . }}-metadata-role
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: {{ template "reloader-serviceAccountName" . }}
|
|
namespace: {{ .Values.namespace | default .Release.Namespace }}
|
|
{{- end }} |