[incubator/vault] Add RBAC to vault. (#14344)

* Add RBAC to vault.

Signed-off-by: Aravind Valkodai <Aravind.Valkodai@qlik.com>

* Add RBAC to vault.

Signed-off-by: Aravind Valkodai <Aravind.Valkodai@qlik.com>

* Updates to RBAC to use create instead of enabled,

Signed-off-by: Aravind Valkodai <Aravind.Valkodai@qlik.com>

* Bump chart version

Signed-off-by: Aravind Valkodai <Aravind.Valkodai@qlik.com>

* Enabling serviceAccount to be enabled by default.

Signed-off-by: Aravind Valkodai <Aravind.Valkodai@qlik.com>

incubator/vault/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 description: A Helm chart for Vault, a tool for managing secrets
 name: vault
-version: 0.18.11
+version: 0.18.12
 appVersion: 1.1.2
 home: https://www.vaultproject.io/
 icon: https://www.vaultproject.io/assets/images/mega-nav/logo-vault-0f83e3d2.svg

incubator/vault/README.md

@@ -78,8 +78,9 @@ The following table lists the configurable parameters of the Vault chart and the
 | `priorityClassName`               | Priority class name for pods             | `""`                                |
 | `minReadySeconds`                 | Minimum number of seconds that newly created replicas must be ready without any containers crashing | `0`                                |
 | `podLabels`                       | Extra labels for pods                    | `{}`                                |
-| `serviceAccount.create`           | Specifies whether a ServiceAccount should be created | `false`                 |
+| `serviceAccount.create`           | Specifies whether a ServiceAccount should be created | `true`                 |
 | `serviceAccount.name`             | The name of the ServiceAccount to create | Generated from fullname template    |
+| `rbac.create`                     | Specifies whether RBAC should be created | `true`                              |
 | `consulAgent.join`                | If set, start start a consul agent       | `nil`                               |
 | `consulAgent.repository`          | Container image for consul agent         | `consul`                            |
 | `consulAgent.tag`                 | Container image tag for consul agent     | `1.4.0`                             |

incubator/vault/templates/role.yaml

@@ -0,0 +1,20 @@
+{{- if .Values.rbac.create -}}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "vault.serviceAccountName" . }}
+  labels:
+    app: {{ template "vault.name" . }}
+    chart: {{ template "vault.chart" . }}
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+  namespace: default
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:auth-delegator
+subjects:
+- kind: ServiceAccount
+  name: {{ template "vault.serviceAccountName" . }}
+  namespace: default
+{{- end -}}

incubator/vault/values.yaml

@@ -144,7 +144,7 @@ minReadySeconds: 0
 serviceAccount:
   ## Specifies whether a ServiceAccount should be created
   ##
-  create: false
+  create: true
   ## The name of the ServiceAccount to use.
   ## If not set and create is true, a name is generated using the fullname template
   name:
@@ -239,3 +239,7 @@ vault:
       #   bucket: ""
       #   # Use a custom secret to mount this file.
       #   credentials_file: ""
+
+rbac:
+   ## Enable RBAC
+  create: true