From e2aa5016f23d4b9b4cec6150945240ad2bdbac50 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Oliver=20B=C3=A4hler?= <26610571+oliverbaehler@users.noreply.github.com> Date: Mon, 8 Jun 2026 20:10:31 +0200 Subject: [PATCH] feat(chart): allow additional controller rbac (#1958) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix(controller): decode old object for delete requests Signed-off-by: Oliver Bähler * chore: modernize golang Signed-off-by: Oliver Bähler * chore: modernize golang Signed-off-by: Oliver Bähler * chore: modernize golang Signed-off-by: Oliver Bähler * fix: preserve ca-bundles injected from external providers Signed-off-by: Oliver Baehler * feat(chart): allow specificing additional controller rbac Signed-off-by: Oliver Baehler * feat(chart): allow specificing additional controller rbac Signed-off-by: Oliver Baehler --------- Signed-off-by: Oliver Bähler Signed-off-by: Oliver Baehler --- charts/capsule/README.md | 2 + charts/capsule/ci/test-values.yaml | 11 ++++- charts/capsule/templates/rbac.yaml | 71 +++++++++++++++++++++++++++++- charts/capsule/values.schema.json | 18 ++++++++ charts/capsule/values.yaml | 11 +++++ 5 files changed, 111 insertions(+), 2 deletions(-) diff --git a/charts/capsule/README.md b/charts/capsule/README.md index be69ac11..6d00ef6f 100644 --- a/charts/capsule/README.md +++ b/charts/capsule/README.md @@ -143,9 +143,11 @@ The following Values have changed key or Value: | manager.options.userNames | list | `[]` | DEPRECATED: use users properties. Names of the users considered as Capsule users. | | manager.options.users | list | `[{"kind":"Group","name":"projectcapsule.dev"}]` | Define entities which are considered part of the Capsule construct. Users not mentioned here will be ignored by Capsule | | manager.options.workers | int | `1` | Workers (MaxConcurrentReconciles) is the maximum number of concurrent Reconciles which can be run (ALPHA). | +| manager.rbac.clusterRole.extraResources | list | `[]` | Extra cluster-scoped RBAC PolicyRules to add to a ClusterRole created by this chart and bound to the Capsule ServiceAccount. | | manager.rbac.create | bool | `true` | Specifies whether RBAC resources should be created. | | manager.rbac.existingClusterRoles | list | `[]` | Specifies further cluster roles to be added to the Capsule manager service account. | | manager.rbac.existingRoles | list | `[]` | Specifies further cluster roles to be added to the Capsule manager service account. | +| manager.rbac.role.extraResources | list | `[]` | Extra namespaced RBAC PolicyRules to add to a Role created by this chart and bound to the Capsule ServiceAccount. | | manager.rbac.strict | bool | `false` | Strongly restrict the RBAC assigned to Capsule Controller. When set to true you must aggregate further permissions by yourself. | | manager.readinessProbe | object | `{"httpGet":{"path":"/readyz","port":10080}}` | Configure the readiness probe using Deployment probe spec | | manager.resources | object | `{}` | Set the resource requests/limits for the Capsule manager container | diff --git a/charts/capsule/ci/test-values.yaml b/charts/capsule/ci/test-values.yaml index 72533911..c073854a 100644 --- a/charts/capsule/ci/test-values.yaml +++ b/charts/capsule/ci/test-values.yaml @@ -7,10 +7,19 @@ manager: options: capsuleUserGroups: ["custom-group-1", "custom-group-2"] userNames: ["custom-user-1", "custom-user-2"] - rbac: create: true existingClusterRoles: - "view" existingRoles: - "some-role" + role: + extraResources: + - apiGroups: ["storage.k8s.io"] + resources: ["storageclasses"] + verbs: ["get", "list", "watch", "update", "patch"] + clusterRole: + extraResources: + - apiGroups: ["storage.k8s.io"] + resources: ["storageclasses"] + verbs: ["get", "list", "watch", "update", "patch"] diff --git a/charts/capsule/templates/rbac.yaml b/charts/capsule/templates/rbac.yaml index 79462dfa..71927a98 100644 --- a/charts/capsule/templates/rbac.yaml +++ b/charts/capsule/templates/rbac.yaml @@ -1,5 +1,75 @@ {{- if or (and $.Values.crds.exclusive $.Values.crds.createRBAC) (not $.Values.crds.exclusive) }} {{- if $.Values.manager.rbac.create }} +{{- with .Values.manager.rbac.role.extraResources }} +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: capsule:{{ include "capsule.fullname" $ }}:extra + namespace: {{ $.Release.Namespace }} + labels: + {{- include "capsule.labels" $ | nindent 4 }} + {{- with $.Values.customAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: capsule:{{ $.Release.Name }}:extra +subjects: +- kind: ServiceAccount + name: {{ include "capsule.serviceAccountName" $ }} + namespace: {{ $.Release.Namespace }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: capsule:{{ $.Release.Name }}:extra + namespace: {{ $.Release.Namespace }} + labels: + {{- include "capsule.labels" $ | nindent 4 }} + {{- with $.Values.customAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +rules: + {{- toYaml . | nindent 2 }} +{{- end }} + {{- with .Values.manager.rbac.clusterRole.extraResources }} +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: capsule:{{ include "capsule.fullname" $ }}:extra + labels: + {{- include "capsule.labels" $ | nindent 4 }} + {{- with $.Values.customAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: capsule:{{ $.Release.Name }}:extra +subjects: +- kind: ServiceAccount + name: {{ include "capsule.serviceAccountName" $ }} + namespace: {{ $.Release.Namespace }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: capsule:{{ $.Release.Name }}:extra + labels: + {{- include "capsule.labels" $ | nindent 4 }} + {{- with $.Values.customAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +rules: + {{- toYaml . | nindent 2 }} +{{- end }} --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole @@ -388,7 +458,6 @@ rules: - apiGroups: [""] resources: ["secrets"] verbs: ["get", "list", "watch", "create", "update", "patch"] - --- kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1 diff --git a/charts/capsule/values.schema.json b/charts/capsule/values.schema.json index f9c9ab22..3a3cff6a 100644 --- a/charts/capsule/values.schema.json +++ b/charts/capsule/values.schema.json @@ -508,6 +508,15 @@ "rbac": { "type": "object", "properties": { + "clusterRole": { + "type": "object", + "properties": { + "extraResources": { + "description": "Extra cluster-scoped RBAC PolicyRules to add to a ClusterRole created by this chart and bound to the Capsule ServiceAccount.", + "type": "array" + } + } + }, "create": { "description": "Specifies whether RBAC resources should be created.", "type": "boolean" @@ -520,6 +529,15 @@ "description": "Specifies further cluster roles to be added to the Capsule manager service account.", "type": "array" }, + "role": { + "type": "object", + "properties": { + "extraResources": { + "description": "Extra namespaced RBAC PolicyRules to add to a Role created by this chart and bound to the Capsule ServiceAccount.", + "type": "array" + } + } + }, "strict": { "description": "Strongly restrict the RBAC assigned to Capsule Controller. When set to true you must aggregate further permissions by yourself.", "type": "boolean" diff --git a/charts/capsule/values.yaml b/charts/capsule/values.yaml index 56490926..b3d8176b 100644 --- a/charts/capsule/values.yaml +++ b/charts/capsule/values.yaml @@ -131,6 +131,17 @@ manager: existingRoles: [] # - namespace-admin + role: + # -- Extra namespaced RBAC PolicyRules to add to a Role created by this chart and bound to the Capsule ServiceAccount. + extraResources: [] + + clusterRole: + # -- Extra cluster-scoped RBAC PolicyRules to add to a ClusterRole created by this chart and bound to the Capsule ServiceAccount. + extraResources: [] + # - apiGroups: ["storage.k8s.io"] + # resources: ["storageclasses"] + # verbs: ["get", "list", "watch", "update", "patch"] + # -- Set the controller deployment mode as `Deployment` or `DaemonSet`. kind: Deployment