From d114d64e3170d9bdc3843747ea96b4d843f2e901 Mon Sep 17 00:00:00 2001
From: Alex Snast <alexsn@fb.com>
Date: Thu, 15 Aug 2019 11:56:36 +0300
Subject: [PATCH] [stable/jaeger-operator] adding cluster role support (#14629)

Signed-off-by: Alex Snast <alexsn@fb.com>
---
 stable/jaeger-operator/Chart.yaml                  | 2 +-
 stable/jaeger-operator/README.md                   | 1 +
 stable/jaeger-operator/templates/deployment.yaml   | 4 ++++
 stable/jaeger-operator/templates/role-binding.yaml | 6 +++---
 stable/jaeger-operator/templates/role.yaml         | 4 ++--
 stable/jaeger-operator/values.yaml                 | 1 +
 6 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/stable/jaeger-operator/Chart.yaml b/stable/jaeger-operator/Chart.yaml
index ab905ec1fe..3ef342463f 100644
--- a/stable/jaeger-operator/Chart.yaml
+++ b/stable/jaeger-operator/Chart.yaml
@@ -1,7 +1,7 @@
 apiVersion: v1
 description: jaeger-operator Helm chart for Kubernetes
 name: jaeger-operator
-version: 2.8.0
+version: 2.9.0
 appVersion: 1.13.1
 home: https://www.jaegertracing.io/
 icon: https://www.jaegertracing.io/img/jaeger-icon-reverse-color.svg
diff --git a/stable/jaeger-operator/README.md b/stable/jaeger-operator/README.md
index f2c480a15e..4d97303ac1 100644
--- a/stable/jaeger-operator/README.md
+++ b/stable/jaeger-operator/README.md
@@ -49,6 +49,7 @@ The following table lists the configurable parameters of the jaeger-operator cha
 | `rbac.create`           | All required roles and rolebindings will be created                                                         | `true`                          |
 | `serviceAccount.create` | Service account to use                                                                                      | `true`                          |
 | `rbac.pspEnabled`       | Pod security policy for pod will be created and included in rbac role                                       | `false`                         |
+| `rbac.clusterRole`      | ClusterRole will be used by operator ServiceAccount                                                         | `false`                         |
 | `serviceAccount.name`   | Service account name to use. If not set and create is true, a name is generated using the fullname template | ``                              |
 | `resources`             | K8s pod resorces                                                                                            | `None`                          |
 | `nodeSelector`          | Node labels for pod assignment                                                                              | `{}`                            |
diff --git a/stable/jaeger-operator/templates/deployment.yaml b/stable/jaeger-operator/templates/deployment.yaml
index 24eed5057f..24c8d3cff2 100644
--- a/stable/jaeger-operator/templates/deployment.yaml
+++ b/stable/jaeger-operator/templates/deployment.yaml
@@ -33,9 +33,13 @@ spec:
           args: ["start"]
           env:
             - name: WATCH_NAMESPACE
+              {{- if .Values.rbac.clusterRole }}
+              value: ""
+              {{- else }}
               valueFrom:
                 fieldRef:
                   fieldPath: metadata.namespace
+              {{- end }}
             - name: POD_NAME
               valueFrom:
                 fieldRef:
diff --git a/stable/jaeger-operator/templates/role-binding.yaml b/stable/jaeger-operator/templates/role-binding.yaml
index fe20773976..533f828bcc 100644
--- a/stable/jaeger-operator/templates/role-binding.yaml
+++ b/stable/jaeger-operator/templates/role-binding.yaml
@@ -1,6 +1,6 @@
 {{- if .Values.rbac.create }}
-kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: {{ if .Values.rbac.clusterRole }}Cluster{{ end }}RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: {{ include "jaeger-operator.fullname" . }}
   namespace: {{ .Release.Namespace }}
@@ -11,7 +11,7 @@ subjects:
   namespace: {{ .Release.Namespace }}
   name: {{ include "jaeger-operator.serviceAccountName" . }}
 roleRef:
-  kind: Role
+  kind: {{ if .Values.rbac.clusterRole }}Cluster{{ end }}Role
   name: {{ include "jaeger-operator.fullname" . }}
   apiGroup: rbac.authorization.k8s.io
 {{- end }}
diff --git a/stable/jaeger-operator/templates/role.yaml b/stable/jaeger-operator/templates/role.yaml
index b5f5c8a9d4..cac90b86a4 100644
--- a/stable/jaeger-operator/templates/role.yaml
+++ b/stable/jaeger-operator/templates/role.yaml
@@ -1,6 +1,6 @@
 {{- if .Values.rbac.create }}
-kind: Role
-apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: {{ if .Values.rbac.clusterRole }}Cluster{{ end }}Role
+apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: {{ include "jaeger-operator.fullname" . }}
   namespace: {{ .Release.Namespace }}
diff --git a/stable/jaeger-operator/values.yaml b/stable/jaeger-operator/values.yaml
index 7dbc785afd..637cda5856 100644
--- a/stable/jaeger-operator/values.yaml
+++ b/stable/jaeger-operator/values.yaml
@@ -10,6 +10,7 @@ rbac:
   # Specifies whether RBAC resources should be created
   create: true
   pspEnabled: false
+  clusterRole: false
 
 serviceAccount:
   # Specifies whether a ServiceAccount should be created