From fee2557f9925898f00d12f63e0d89fb696be1e1d Mon Sep 17 00:00:00 2001
From: Sergio Millan <sermilrod@gmail.com>
Date: Sun, 27 Jan 2019 06:19:43 +0000
Subject: [PATCH] allowing option to deploy namespaced grafana rbac rules
 (#10846)

Signed-off-by: Sergio Millan Rodriguez <sergio.rodriguez@ticketmaster.co.uk>
---
 stable/grafana/Chart.yaml                       |  2 +-
 stable/grafana/README.md                        |  1 +
 stable/grafana/templates/clusterrole.yaml       |  2 +-
 .../grafana/templates/clusterrolebinding.yaml   |  4 ++--
 stable/grafana/templates/role.yaml              | 17 +++++++++++++++--
 stable/grafana/templates/rolebinding.yaml       | 11 +++++++++++
 stable/grafana/values.yaml                      |  1 +
 7 files changed, 32 insertions(+), 6 deletions(-)

diff --git a/stable/grafana/Chart.yaml b/stable/grafana/Chart.yaml
index ca0d07ca61..1cfef8b772 100755
--- a/stable/grafana/Chart.yaml
+++ b/stable/grafana/Chart.yaml
@@ -1,6 +1,6 @@
 apiVersion: v1
 name: grafana
-version: 1.25.3
+version: 1.25.4
 appVersion: 5.4.3
 kubeVersion: "^1.8.0-0"
 description: The leading tool for querying and visualizing time series and metrics.
diff --git a/stable/grafana/README.md b/stable/grafana/README.md
index 657ef8467c..a172c84fa1 100644
--- a/stable/grafana/README.md
+++ b/stable/grafana/README.md
@@ -88,6 +88,7 @@ The command removes all the Kubernetes components associated with the chart and
 | `admin.userKey`                           | The key in the existing admin secret containing the username. | `"admin-user"`                          |
 | `admin.passwordKey`                       | The key in the existing admin secret containing the password. | `"admin-password"`                      |
 | `rbac.create`                             | Create and use RBAC resources | `true` |
+| `rbac.namespaced`                         | Creates Role and Rolebinding instead of the default ClusterRole and ClusteRoleBindings for the grafana instance  | `false` |
 | `rbac.pspEnabled`                         | Create PodSecurityPolicy (with `rbac.create`, grant roles permissions as well) | `true` |
 | `rbac.pspUseAppArmor`                     | Enforce AppArmor in created PodSecurityPolicy (requires `rbac.pspEnabled`)  | `true` |
 
diff --git a/stable/grafana/templates/clusterrole.yaml b/stable/grafana/templates/clusterrole.yaml
index 47452f48cd..ccfc723748 100644
--- a/stable/grafana/templates/clusterrole.yaml
+++ b/stable/grafana/templates/clusterrole.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.rbac.create }}
+{{- if and .Values.rbac.create (not .Values.rbac.namespaced) }}
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
diff --git a/stable/grafana/templates/clusterrolebinding.yaml b/stable/grafana/templates/clusterrolebinding.yaml
index 093e5518e7..0ffe9ff2f6 100644
--- a/stable/grafana/templates/clusterrolebinding.yaml
+++ b/stable/grafana/templates/clusterrolebinding.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.rbac.create }}
+{{- if and .Values.rbac.create (not .Values.rbac.namespaced) }}
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
@@ -20,4 +20,4 @@ roleRef:
   kind: ClusterRole
   name: {{ template "grafana.fullname" . }}-clusterrole
   apiGroup: rbac.authorization.k8s.io
-{{- end}}
+{{- end -}}
diff --git a/stable/grafana/templates/role.yaml b/stable/grafana/templates/role.yaml
index 8091d49f2c..f61656942b 100644
--- a/stable/grafana/templates/role.yaml
+++ b/stable/grafana/templates/role.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.rbac.create }}
+{{- if .Values.rbac.create -}}
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: Role
 metadata:
@@ -8,11 +8,24 @@ metadata:
     chart: {{ .Chart.Name }}-{{ .Chart.Version }}
     heritage: {{ .Release.Service }}
     release: {{ .Release.Name }}
-{{- if .Values.rbac.pspEnabled }}
+{{- with .Values.annotations }}
+  annotations:
+{{ toYaml . | indent 4 }}
+{{- end }}
+{{- if or .Values.rbac.pspEnabled (and .Values.rbac.namespaced (or .Values.sidecar.dashboards.enabled .Values.sidecar.datasources.enabled)) }}
 rules:
+{{- if .Values.rbac.pspEnabled }}
 - apiGroups:      ['extensions']
   resources:      ['podsecuritypolicies']
   verbs:          ['use']
   resourceNames:  [{{ template "grafana.fullname" . }}]
 {{- end }}
+{{- if and .Values.rbac.namespaced (or .Values.sidecar.dashboards.enabled .Values.sidecar.datasources.enabled) }}
+- apiGroups: [""] # "" indicates the core API group
+  resources: ["configmaps"]
+  verbs: ["get", "watch", "list"]
+{{- end }}
+{{- else }}
+rules: []
+{{- end }}
 {{- end }}
diff --git a/stable/grafana/templates/rolebinding.yaml b/stable/grafana/templates/rolebinding.yaml
index 199e8fe4ed..8b6671b85a 100644
--- a/stable/grafana/templates/rolebinding.yaml
+++ b/stable/grafana/templates/rolebinding.yaml
@@ -8,6 +8,10 @@ metadata:
     chart: {{ .Chart.Name }}-{{ .Chart.Version }}
     heritage: {{ .Release.Service }}
     release: {{ .Release.Name }}
+{{- with .Values.annotations }}
+  annotations:
+{{ toYaml . | indent 4 }}
+{{- end }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
@@ -15,4 +19,11 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: {{ template "grafana.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+{{- if .Values.rbac.namespaced }}
+roleRef:
+  kind: Role
+  name: {{ template "grafana.fullname" . }}
+  apiGroup: rbac.authorization.k8s.io
+{{- end }}
 {{- end -}}
diff --git a/stable/grafana/values.yaml b/stable/grafana/values.yaml
index eb338816b4..c16a4f9cfd 100644
--- a/stable/grafana/values.yaml
+++ b/stable/grafana/values.yaml
@@ -2,6 +2,7 @@ rbac:
   create: true
   pspEnabled: true
   pspUseAppArmor: true
+  namespaced: false
 serviceAccount:
   create: true
   name: