From e85bf4c92de9ed588c7476e69dcbe5b36caeca98 Mon Sep 17 00:00:00 2001 From: Kyle Schouviller Date: Sat, 31 Aug 2019 17:25:45 -0700 Subject: [PATCH] Enabling extension of Role and ClusterRole rules. (#16673) Signed-off-by: kyschouv --- stable/grafana/Chart.yaml | 2 +- stable/grafana/README.md | 2 ++ stable/grafana/templates/clusterrole.yaml | 7 ++++++- stable/grafana/templates/role.yaml | 5 ++++- stable/grafana/values.yaml | 8 ++++++++ 5 files changed, 21 insertions(+), 3 deletions(-) diff --git a/stable/grafana/Chart.yaml b/stable/grafana/Chart.yaml index 10c93c0435..eff746b4a3 100644 --- a/stable/grafana/Chart.yaml +++ b/stable/grafana/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: grafana -version: 3.8.5 +version: 3.8.6 appVersion: 6.3.4 kubeVersion: "^1.8.0-0" description: The leading tool for querying and visualizing time series and metrics. diff --git a/stable/grafana/README.md b/stable/grafana/README.md index 82c59de92f..74785f6400 100644 --- a/stable/grafana/README.md +++ b/stable/grafana/README.md @@ -120,6 +120,8 @@ The command removes all the Kubernetes components associated with the chart and | `rbac.namespaced` | Creates Role and Rolebinding instead of the default ClusterRole and ClusteRoleBindings for the grafana instance | `false` | | `rbac.pspEnabled` | Create PodSecurityPolicy (with `rbac.create`, grant roles permissions as well) | `true` | | `rbac.pspUseAppArmor` | Enforce AppArmor in created PodSecurityPolicy (requires `rbac.pspEnabled`) | `true` | +| `rbac.extraRoleRules` | Additional rules to add to the Role | [] | +| `rbac.extraClusterRoleRules` | Additional rules to add to the ClusterRole | [] | | `command` | Define command to be executed by grafana container at startup | `nil` | | `testFramework.image` | `test-framework` image repository. | `dduportal/bats` | | `testFramework.tag` | `test-framework` image tag. | `0.4.0` | diff --git a/stable/grafana/templates/clusterrole.yaml b/stable/grafana/templates/clusterrole.yaml index 56097b71a0..d14128001b 100644 --- a/stable/grafana/templates/clusterrole.yaml +++ b/stable/grafana/templates/clusterrole.yaml @@ -12,11 +12,16 @@ metadata: {{ toYaml . | indent 4 }} {{- end }} name: {{ template "grafana.fullname" . }}-clusterrole -{{- if or .Values.sidecar.dashboards.enabled .Values.sidecar.datasources.enabled }} +{{- if or .Values.sidecar.dashboards.enabled (or .Values.sidecar.datasources.enabled .Values.rbac.extraClusterRoleRules) }} rules: +{{- if or .Values.sidecar.dashboards.enabled .Values.sidecar.datasources.enabled }} - apiGroups: [""] # "" indicates the core API group resources: ["configmaps", "secrets"] verbs: ["get", "watch", "list"] +{{- end}} +{{- with .Values.rbac.extraClusterRoleRules }} +{{ toYaml . | indent 0 }} +{{- end}} {{- else }} rules: [] {{- end}} diff --git a/stable/grafana/templates/role.yaml b/stable/grafana/templates/role.yaml index c8a6f9466f..2653f6cfc8 100644 --- a/stable/grafana/templates/role.yaml +++ b/stable/grafana/templates/role.yaml @@ -13,7 +13,7 @@ metadata: annotations: {{ toYaml . | indent 4 }} {{- end }} -{{- if or .Values.rbac.pspEnabled (and .Values.rbac.namespaced (or .Values.sidecar.dashboards.enabled .Values.sidecar.datasources.enabled)) }} +{{- if or .Values.rbac.pspEnabled (and .Values.rbac.namespaced (or .Values.sidecar.dashboards.enabled (or .Values.sidecar.datasources.enabled .Values.rbac.extraRoleRules))) }} rules: {{- if .Values.rbac.pspEnabled }} - apiGroups: ['extensions'] @@ -26,6 +26,9 @@ rules: resources: ["configmaps", "secrets"] verbs: ["get", "watch", "list"] {{- end }} +{{- with .Values.rbac.extraRoleRules }} +{{ toYaml . | indent 0 }} +{{- end}} {{- else }} rules: [] {{- end }} diff --git a/stable/grafana/values.yaml b/stable/grafana/values.yaml index 3d38fee82a..031cc51ee3 100644 --- a/stable/grafana/values.yaml +++ b/stable/grafana/values.yaml @@ -3,6 +3,14 @@ rbac: pspEnabled: true pspUseAppArmor: true namespaced: false + extraRoleRules: [] + # - apiGroups: [] + # resources: [] + # verbs: [] + extraClusterRoleRules: [] + # - apiGroups: [] + # resources: [] + # verbs: [] serviceAccount: create: true name: