mirror of
https://github.com/projectcapsule/capsule.git
synced 2026-08-18 12:06:43 +00:00
feat(chart): allow additional controller rbac (#1958)
* fix(controller): decode old object for delete requests Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: modernize golang Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: modernize golang Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: modernize golang Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * fix: preserve ca-bundles injected from external providers Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * feat(chart): allow specificing additional controller rbac Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * feat(chart): allow specificing additional controller rbac Signed-off-by: Oliver Baehler <oliver@sudo-i.net> --------- Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
This commit is contained in:
Oliver Bähler
@@ -143,9 +143,11 @@ The following Values have changed key or Value:
|
||||
| manager.options.userNames | list | `[]` | DEPRECATED: use users properties. Names of the users considered as Capsule users. |
|
||||
| manager.options.users | list | `[{"kind":"Group","name":"projectcapsule.dev"}]` | Define entities which are considered part of the Capsule construct. Users not mentioned here will be ignored by Capsule |
|
||||
| manager.options.workers | int | `1` | Workers (MaxConcurrentReconciles) is the maximum number of concurrent Reconciles which can be run (ALPHA). |
|
||||
| manager.rbac.clusterRole.extraResources | list | `[]` | Extra cluster-scoped RBAC PolicyRules to add to a ClusterRole created by this chart and bound to the Capsule ServiceAccount. |
|
||||
| manager.rbac.create | bool | `true` | Specifies whether RBAC resources should be created. |
|
||||
| manager.rbac.existingClusterRoles | list | `[]` | Specifies further cluster roles to be added to the Capsule manager service account. |
|
||||
| manager.rbac.existingRoles | list | `[]` | Specifies further cluster roles to be added to the Capsule manager service account. |
|
||||
| manager.rbac.role.extraResources | list | `[]` | Extra namespaced RBAC PolicyRules to add to a Role created by this chart and bound to the Capsule ServiceAccount. |
|
||||
| manager.rbac.strict | bool | `false` | Strongly restrict the RBAC assigned to Capsule Controller. When set to true you must aggregate further permissions by yourself. |
|
||||
| manager.readinessProbe | object | `{"httpGet":{"path":"/readyz","port":10080}}` | Configure the readiness probe using Deployment probe spec |
|
||||
| manager.resources | object | `{}` | Set the resource requests/limits for the Capsule manager container |
|
||||
|
||||
@@ -7,10 +7,19 @@ manager:
|
||||
options:
|
||||
capsuleUserGroups: ["custom-group-1", "custom-group-2"]
|
||||
userNames: ["custom-user-1", "custom-user-2"]
|
||||
|
||||
rbac:
|
||||
create: true
|
||||
existingClusterRoles:
|
||||
- "view"
|
||||
existingRoles:
|
||||
- "some-role"
|
||||
role:
|
||||
extraResources:
|
||||
- apiGroups: ["storage.k8s.io"]
|
||||
resources: ["storageclasses"]
|
||||
verbs: ["get", "list", "watch", "update", "patch"]
|
||||
clusterRole:
|
||||
extraResources:
|
||||
- apiGroups: ["storage.k8s.io"]
|
||||
resources: ["storageclasses"]
|
||||
verbs: ["get", "list", "watch", "update", "patch"]
|
||||
|
||||
@@ -1,5 +1,75 @@
|
||||
{{- if or (and $.Values.crds.exclusive $.Values.crds.createRBAC) (not $.Values.crds.exclusive) }}
|
||||
{{- if $.Values.manager.rbac.create }}
|
||||
{{- with .Values.manager.rbac.role.extraResources }}
|
||||
---
|
||||
kind: RoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: capsule:{{ include "capsule.fullname" $ }}:extra
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
labels:
|
||||
{{- include "capsule.labels" $ | nindent 4 }}
|
||||
{{- with $.Values.customAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: capsule:{{ $.Release.Name }}:extra
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "capsule.serviceAccountName" $ }}
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: capsule:{{ $.Release.Name }}:extra
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
labels:
|
||||
{{- include "capsule.labels" $ | nindent 4 }}
|
||||
{{- with $.Values.customAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
rules:
|
||||
{{- toYaml . | nindent 2 }}
|
||||
{{- end }}
|
||||
{{- with .Values.manager.rbac.clusterRole.extraResources }}
|
||||
---
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: capsule:{{ include "capsule.fullname" $ }}:extra
|
||||
labels:
|
||||
{{- include "capsule.labels" $ | nindent 4 }}
|
||||
{{- with $.Values.customAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: capsule:{{ $.Release.Name }}:extra
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "capsule.serviceAccountName" $ }}
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: capsule:{{ $.Release.Name }}:extra
|
||||
labels:
|
||||
{{- include "capsule.labels" $ | nindent 4 }}
|
||||
{{- with $.Values.customAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
rules:
|
||||
{{- toYaml . | nindent 2 }}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
@@ -388,7 +458,6 @@ rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch"]
|
||||
|
||||
---
|
||||
kind: RoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
|
||||
@@ -508,6 +508,15 @@
|
||||
"rbac": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"clusterRole": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"extraResources": {
|
||||
"description": "Extra cluster-scoped RBAC PolicyRules to add to a ClusterRole created by this chart and bound to the Capsule ServiceAccount.",
|
||||
"type": "array"
|
||||
}
|
||||
}
|
||||
},
|
||||
"create": {
|
||||
"description": "Specifies whether RBAC resources should be created.",
|
||||
"type": "boolean"
|
||||
@@ -520,6 +529,15 @@
|
||||
"description": "Specifies further cluster roles to be added to the Capsule manager service account.",
|
||||
"type": "array"
|
||||
},
|
||||
"role": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"extraResources": {
|
||||
"description": "Extra namespaced RBAC PolicyRules to add to a Role created by this chart and bound to the Capsule ServiceAccount.",
|
||||
"type": "array"
|
||||
}
|
||||
}
|
||||
},
|
||||
"strict": {
|
||||
"description": "Strongly restrict the RBAC assigned to Capsule Controller. When set to true you must aggregate further permissions by yourself.",
|
||||
"type": "boolean"
|
||||
|
||||
@@ -131,6 +131,17 @@ manager:
|
||||
existingRoles: []
|
||||
# - namespace-admin
|
||||
|
||||
role:
|
||||
# -- Extra namespaced RBAC PolicyRules to add to a Role created by this chart and bound to the Capsule ServiceAccount.
|
||||
extraResources: []
|
||||
|
||||
clusterRole:
|
||||
# -- Extra cluster-scoped RBAC PolicyRules to add to a ClusterRole created by this chart and bound to the Capsule ServiceAccount.
|
||||
extraResources: []
|
||||
# - apiGroups: ["storage.k8s.io"]
|
||||
# resources: ["storageclasses"]
|
||||
# verbs: ["get", "list", "watch", "update", "patch"]
|
||||
|
||||
# -- Set the controller deployment mode as `Deployment` or `DaemonSet`.
|
||||
kind: Deployment
|
||||
|
||||
|
||||
Reference in New Issue
Block a user