fix(helm): fix manager.rbac.strict being no-op (#2084)

Signed-off-by: Hristo Hristov <me@hhristov.info>

charts/capsule/README.md

@@ -170,6 +170,7 @@ The following Values have changed key or Value:
 | manager.rbac.create | bool | `true` | Specifies whether RBAC resources should be created. |
 | manager.rbac.existingClusterRoles | list | `[]` | Specifies further cluster roles to be added to the Capsule manager service account. |
 | manager.rbac.existingRoles | list | `[]` | Specifies further cluster roles to be added to the Capsule manager service account. |
+| manager.rbac.minimal | bool | `false` | DEPRECATED: use strict instead. Former name of the strict option; takes effect when either flag is true. |
 | manager.rbac.role.extraResources | list | `[]` | Extra namespaced RBAC PolicyRules to add to a Role created by this chart and bound to the Capsule ServiceAccount. |
 | manager.rbac.strict | bool | `false` | Strongly restrict the RBAC assigned to Capsule Controller. When set to true you must aggregate further permissions by yourself. |
 | manager.readinessProbe | object | `{"httpGet":{"path":"/readyz","port":10080}}` | Configure the readiness probe using Deployment probe spec |

charts/capsule/templates/rbac.yaml

@@ -106,7 +106,7 @@ subjects:
 - kind: ServiceAccount
   name: {{ include "capsule.serviceAccountName" . }}
   namespace: {{ .Release.Namespace }}
-    {{- if $.Values.manager.rbac.minimal }}
+    {{- if or $.Values.manager.rbac.strict $.Values.manager.rbac.minimal }}
 ---
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1

charts/capsule/values.schema.json

@@ -693,6 +693,10 @@
                             "description": "Specifies further cluster roles to be added to the Capsule manager service account.",
                             "type": "array"
                         },
+                        "minimal": {
+                            "description": "DEPRECATED: use strict instead. Former name of the strict option; takes effect when either flag is true.",
+                            "type": "boolean"
+                        },
                         "role": {
                             "type": "object",
                             "properties": {

charts/capsule/values.yaml

@@ -156,6 +156,10 @@ manager:
     # When set to true you must aggregate further permissions by yourself.
     strict: false
 
+    # -- DEPRECATED: use strict instead.
+    # Former name of the strict option; takes effect when either flag is true.
+    minimal: false
+
     # -- Specifies further cluster roles to be added to the Capsule manager service account.
     existingClusterRoles: []
     # - cluster-admin