From fe0ac7aed599d3688a0ac04fa2fcb121ab7759b9 Mon Sep 17 00:00:00 2001
From: teerakarna <ateerakarna@gmail.com>
Date: Mon, 30 Sep 2019 17:49:38 +0100
Subject: [PATCH] Upgraded to 0.8.2 and added RBAC rules for self service
 cert.pem for all authenticated users (#17555)

Signed-off-by: Albert Asawaroengchai <ateerakarna@gmail.com>
---
 stable/sealed-secrets/Chart.yaml              |  4 ++--
 .../templates/role-binding.yaml               | 23 +++++++++++++++++--
 stable/sealed-secrets/templates/role.yaml     | 23 ++++++++++++++++++-
 stable/sealed-secrets/values.yaml             |  2 +-
 4 files changed, 46 insertions(+), 6 deletions(-)

diff --git a/stable/sealed-secrets/Chart.yaml b/stable/sealed-secrets/Chart.yaml
index 12a6b368da..b70a7e754c 100644
--- a/stable/sealed-secrets/Chart.yaml
+++ b/stable/sealed-secrets/Chart.yaml
@@ -1,7 +1,7 @@
 name: sealed-secrets
 description: A Helm chart for Sealed Secrets
-version: 1.4.0
-appVersion: 0.8.1
+version: 1.4.1
+appVersion: 0.8.2
 kubeVersion: ">=1.9.0-0"
 home: https://github.com/bitnami-labs/sealed-secrets
 apiVersion: v1
diff --git a/stable/sealed-secrets/templates/role-binding.yaml b/stable/sealed-secrets/templates/role-binding.yaml
index bc87630cac..9eda534baf 100644
--- a/stable/sealed-secrets/templates/role-binding.yaml
+++ b/stable/sealed-secrets/templates/role-binding.yaml
@@ -2,7 +2,7 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: {{ template "sealed-secrets.fullname" . }}
+  name: {{ template "sealed-secrets.fullname" . }}-key-admin
   labels:
     app.kubernetes.io/name: {{ template "sealed-secrets.name" . }}
     helm.sh/chart: {{ template "sealed-secrets.chart" . }}
@@ -12,10 +12,29 @@ metadata:
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
-  name: sealed-secrets-key-admin
+  name: {{ template "sealed-secrets.fullname" . }}-key-admin
 subjects:
   - apiGroup: ""
     kind: ServiceAccount
     name: {{ template "sealed-secrets.serviceAccountName" . }}
     namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "sealed-secrets.fullname" . }}-service-proxier
+  labels:
+    app.kubernetes.io/name: {{ template "sealed-secrets.name" . }}
+    helm.sh/chart: {{ template "sealed-secrets.chart" . }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "sealed-secrets.fullname" . }}-service-proxier
+subjects:
+- apiGroup: rbac.authorization.k8s.io
+  kind: Group
+  name: system:authenticated
 {{ end }}
diff --git a/stable/sealed-secrets/templates/role.yaml b/stable/sealed-secrets/templates/role.yaml
index 5bf55efe6a..f7e4bd4db8 100644
--- a/stable/sealed-secrets/templates/role.yaml
+++ b/stable/sealed-secrets/templates/role.yaml
@@ -2,7 +2,7 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
-  name: sealed-secrets-key-admin
+  name: {{ template "sealed-secrets.fullname" . }}-key-admin
   labels:
     app.kubernetes.io/name: {{ template "sealed-secrets.name" . }}
     helm.sh/chart: {{ template "sealed-secrets.chart" . }}
@@ -25,4 +25,25 @@ rules:
     verbs:
       - create
       - list
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ template "sealed-secrets.fullname" . }}-service-proxier
+  labels:
+    app.kubernetes.io/name: {{ template "sealed-secrets.name" . }}
+    helm.sh/chart: {{ template "sealed-secrets.chart" . }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+rules:
+- apiGroups:
+  - ""
+  resourceNames:
+  - 'http:{{ template "sealed-secrets.fullname" . }}:'
+  - {{ template "sealed-secrets.fullname" . }}
+  resources:
+  - services/proxy
+  verbs:
+  - get
 {{ end }}
diff --git a/stable/sealed-secrets/values.yaml b/stable/sealed-secrets/values.yaml
index 643fdddd37..35dd4dd8ae 100644
--- a/stable/sealed-secrets/values.yaml
+++ b/stable/sealed-secrets/values.yaml
@@ -1,6 +1,6 @@
 image:
   repository: quay.io/bitnami/sealed-secrets-controller
-  tag: v0.8.1
+  tag: v0.8.2
   pullPolicy: IfNotPresent
 
 resources: {}