From 4716d09b653462210f366e38300b51d64b8bdabe Mon Sep 17 00:00:00 2001
From: John Norwood <norwood.john.m@gmail.com>
Date: Tue, 4 Dec 2018 18:38:48 +0000
Subject: [PATCH] [stable/nginx-ingress] fixes #9636 adds necessary permissions
 when running in scoped mode (#9637)

Signed-off-by: John Norwood <norwood.john.m@gmail.com>
---
 stable/nginx-ingress/Chart.yaml               |  2 +-
 .../templates/scoped-clusterrole.yaml         | 20 +++++++++++++++++++
 .../templates/scoped-clusterrolebinding.yaml  | 19 ++++++++++++++++++
 3 files changed, 40 insertions(+), 1 deletion(-)
 create mode 100644 stable/nginx-ingress/templates/scoped-clusterrole.yaml
 create mode 100644 stable/nginx-ingress/templates/scoped-clusterrolebinding.yaml

diff --git a/stable/nginx-ingress/Chart.yaml b/stable/nginx-ingress/Chart.yaml
index 5fb5816c16..fc6f2ca0be 100644
--- a/stable/nginx-ingress/Chart.yaml
+++ b/stable/nginx-ingress/Chart.yaml
@@ -1,5 +1,5 @@
 name: nginx-ingress
-version: 1.0.0
+version: 1.0.1
 appVersion: 0.21.0
 home: https://github.com/kubernetes/ingress-nginx
 description: An nginx Ingress controller that uses ConfigMap to store the nginx configuration.
diff --git a/stable/nginx-ingress/templates/scoped-clusterrole.yaml b/stable/nginx-ingress/templates/scoped-clusterrole.yaml
new file mode 100644
index 0000000000..e376633883
--- /dev/null
+++ b/stable/nginx-ingress/templates/scoped-clusterrole.yaml
@@ -0,0 +1,20 @@
+{{- if and .Values.rbac.create .Values.controller.scope.enabled -}}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRole
+metadata:
+  labels:
+    app: {{ template "nginx-ingress.name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+  name: {{ template "nginx-ingress.fullname" . }}-scoped
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - nodes
+    verbs:
+      - get
+      - list
+      - watch
+{{- end -}}
diff --git a/stable/nginx-ingress/templates/scoped-clusterrolebinding.yaml b/stable/nginx-ingress/templates/scoped-clusterrolebinding.yaml
new file mode 100644
index 0000000000..00227b04ac
--- /dev/null
+++ b/stable/nginx-ingress/templates/scoped-clusterrolebinding.yaml
@@ -0,0 +1,19 @@
+{{- if and .Values.rbac.create .Values.controller.scope.enabled -}}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app: {{ template "nginx-ingress.name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+  name: {{ template "nginx-ingress.fullname" . }}-scoped
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "nginx-ingress.fullname" . }}-scoped
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "nginx-ingress.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end -}}