[stable/nginx-ingress] fixes #9636 adds necessary permissions when running in scoped mode (#9637)

Signed-off-by: John Norwood <norwood.john.m@gmail.com>

stable/nginx-ingress/Chart.yaml

@@ -1,5 +1,5 @@
 name: nginx-ingress
-version: 1.0.0
+version: 1.0.1
 appVersion: 0.21.0
 home: https://github.com/kubernetes/ingress-nginx
 description: An nginx Ingress controller that uses ConfigMap to store the nginx configuration.

stable/nginx-ingress/templates/scoped-clusterrole.yaml

@@ -0,0 +1,20 @@
+{{- if and .Values.rbac.create .Values.controller.scope.enabled -}}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRole
+metadata:
+  labels:
+    app: {{ template "nginx-ingress.name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+  name: {{ template "nginx-ingress.fullname" . }}-scoped
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - nodes
+    verbs:
+      - get
+      - list
+      - watch
+{{- end -}}

stable/nginx-ingress/templates/scoped-clusterrolebinding.yaml

@@ -0,0 +1,19 @@
+{{- if and .Values.rbac.create .Values.controller.scope.enabled -}}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app: {{ template "nginx-ingress.name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+  name: {{ template "nginx-ingress.fullname" . }}-scoped
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "nginx-ingress.fullname" . }}-scoped
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "nginx-ingress.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end -}}