From e1dea71e72d3fb444c95f8c606f7ef2506d724ea Mon Sep 17 00:00:00 2001
From: "O. Yuanying" <yuanying@fraction.jp>
Date: Tue, 15 Aug 2017 08:08:09 +0900
Subject: [PATCH] [stable/kubernetes-dashboard] Add RBAC support (#1415)

* [stable/kubernetes-dashboard] Add RBAC support

* Bump chart version
---
 stable/kubernetes-dashboard/Chart.yaml        |  2 +-
 stable/kubernetes-dashboard/README.md         |  3 +++
 .../templates/deployment.yaml                 |  1 +
 .../templates/rolebinding.yaml                | 19 +++++++++++++++++++
 .../templates/serviceaccount.yaml             | 11 +++++++++++
 stable/kubernetes-dashboard/values.yaml       |  9 +++++++++
 6 files changed, 44 insertions(+), 1 deletion(-)
 create mode 100644 stable/kubernetes-dashboard/templates/rolebinding.yaml
 create mode 100644 stable/kubernetes-dashboard/templates/serviceaccount.yaml

diff --git a/stable/kubernetes-dashboard/Chart.yaml b/stable/kubernetes-dashboard/Chart.yaml
index 6805262c1a..b7de04eb1e 100644
--- a/stable/kubernetes-dashboard/Chart.yaml
+++ b/stable/kubernetes-dashboard/Chart.yaml
@@ -1,5 +1,5 @@
 name: kubernetes-dashboard
-version: 0.1.1
+version: 0.2.0
 appVersion: 1.6.3
 description: General-purpose web UI for Kubernetes clusters
 keywords:
diff --git a/stable/kubernetes-dashboard/README.md b/stable/kubernetes-dashboard/README.md
index 1a0521386c..e8ce4e4eb5 100644
--- a/stable/kubernetes-dashboard/README.md
+++ b/stable/kubernetes-dashboard/README.md
@@ -49,6 +49,9 @@ The following tables lists the configurable parameters of the kubernetes-dashboa
 | `ingress.enabled`     | Enable ingress controller resource | `false`                                                                  |
 | `ingress.hosts`       | Dashboard Hostnames                | `nil`                                                                    |
 | `ingress.tls`         | Ingress TLS configuration          | `[]`                                                                     |
+| `rbac.create`         | Create & use RBAC resources        | `false`                                                                  |
+| `rbac.serviceAccountName` |  ServiceAccount kubernetes-dashboard will use (ignored if rbac.create=true) | `default`        |
+
 Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example,
 
 ```console
diff --git a/stable/kubernetes-dashboard/templates/deployment.yaml b/stable/kubernetes-dashboard/templates/deployment.yaml
index 3d2b743b26..49f5750c36 100644
--- a/stable/kubernetes-dashboard/templates/deployment.yaml
+++ b/stable/kubernetes-dashboard/templates/deployment.yaml
@@ -24,6 +24,7 @@ spec:
         chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
         kubernetes.io/cluster-service: "true"
     spec:
+      serviceAccountName: {{ if .Values.rbac.create }}{{ template "fullname" . }}{{ else }}"{{ .Values.rbac.serviceAccountName }}"{{ end }}
       nodeSelector:
 {{ toYaml .Values.nodeSelector | indent 10 }}
       containers:
diff --git a/stable/kubernetes-dashboard/templates/rolebinding.yaml b/stable/kubernetes-dashboard/templates/rolebinding.yaml
new file mode 100644
index 0000000000..c9207d4596
--- /dev/null
+++ b/stable/kubernetes-dashboard/templates/rolebinding.yaml
@@ -0,0 +1,19 @@
+{{- if .Values.rbac.create }}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app: {{ template "name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+  name: {{ template "fullname" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "fullname" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end -}}
diff --git a/stable/kubernetes-dashboard/templates/serviceaccount.yaml b/stable/kubernetes-dashboard/templates/serviceaccount.yaml
new file mode 100644
index 0000000000..7da36a033e
--- /dev/null
+++ b/stable/kubernetes-dashboard/templates/serviceaccount.yaml
@@ -0,0 +1,11 @@
+{{- if .Values.rbac.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app: {{ template "name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+  name: {{ template "fullname" . }}
+{{- end -}}
diff --git a/stable/kubernetes-dashboard/values.yaml b/stable/kubernetes-dashboard/values.yaml
index 25c8f75f74..3ae1764de6 100644
--- a/stable/kubernetes-dashboard/values.yaml
+++ b/stable/kubernetes-dashboard/values.yaml
@@ -45,3 +45,12 @@ ingress:
   #   - secretName: kubernetes-dashboard-tls
   #     hosts:
   #       - kubernetes-dashboard.domain.com
+
+rbac:
+  ## If true, create & use RBAC resources
+  #
+  create: false
+
+  ## Ignored if rbac.create is true
+  #
+  serviceAccountName: default