Merge pull request #20 from HaveFun83/helm-chart-rbac

added role- and rolebinding as helm-chart value

helm-charts/kubeinvaders/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v1
 description: A Helm chart for KubeInvaders
 name: kubeinvaders
 appVersion: 0.2.8
-version: 0.1.0
+version: 0.1.1
 home: https://github.com/lucky-sideburn/KubeInvaders
 
 sources:

helm-charts/kubeinvaders/templates/_helpers.tpl

@@ -30,3 +30,25 @@ Create chart name and version as used by the chart label.
 {{- define "kubeinvaders.chart" -}}
 {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
 {{- end -}}
+
+{{/*
+Create the name of the cluster role to use
+*/}}
+{{- define "kubeinvaders.clusterRoleName" -}}
+{{- if .Values.clusterRole.create -}}
+    {{ default (include "kubeinvaders.fullname" .) .Values.clusterRole.name }}
+{{- else -}}
+    {{ default "default" .Values.clusterRole.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "kubeinvaders.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create -}}
+    {{ default (include "kubeinvaders.fullname" .) .Values.serviceAccount.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccount.name }}
+{{- end -}}
+{{- end -}}

helm-charts/kubeinvaders/templates/clusterrole-binding.yaml

@@ -1,17 +0,0 @@
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: kubeinvaders
-  labels:
-    app: kubeinvaders
-    chart: {{ template "kubeinvaders.chart" . }}
-    release: {{ .Release.Name }}
-    heritage: {{ .Release.Service }}
-subjects:
-- kind: ServiceAccount
-  name: kubeinvaders
-  namespace: {{ .Release.Namespace }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: kubeinvaders

helm-charts/kubeinvaders/templates/clusterrole.yaml

@@ -1,13 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: kubeinvaders
-  labels:
-    app: kubeinvaders
-    chart: {{ template "kubeinvaders.chart" . }}
-    release: {{ .Release.Name }}
-    heritage: {{ .Release.Service }}
-rules:
-- apiGroups: [""]
-  resources: ["pods"]
-  verbs: ["get", "watch", "list", "delete"]

helm-charts/kubeinvaders/templates/rbac-role.yaml

@@ -0,0 +1,37 @@
+{{- if and .Values.rbac.create (eq .Values.clusterRole.create false) -}}
+{{- range $namespace := (append .Values.allowedNamespaces .Release.Namespace) }}
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: kubeinvaders-role
+  namespace: {{ $namespace }}
+  labels:
+    app: kubeinvaders
+    chart: {{ template "kubeinvaders.chart" $ }}
+    release: {{ $.Release.Name }}
+    heritage: {{ $.Release.Service }}
+rules:
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["get", "watch", "list", "delete"]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: kubeinvaders-rolebinding
+  namespace: {{ $namespace }}
+  labels:
+    app: kubeinvaders
+    chart: {{ template "kubeinvaders.chart" $ }}
+    release: {{ $.Release.Name }}
+    heritage: {{ $.Release.Service }}
+subjects:
+- kind: ServiceAccount
+  name: {{ template "kubeinvaders.serviceAccountName" $ }}
+  namespace: {{ $namespace }}
+roleRef:
+  kind: Role
+  name: kubeinvaders-role
+  apiGroup: rbac.authorization.k8s.io
+{{- end -}}
+{{- end -}}

helm-charts/kubeinvaders/templates/rbac.yaml

@@ -0,0 +1,37 @@
+{{- if .Values.rbac.create -}}
+{{if .Values.clusterRole.create -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: kubeinvaders
+  labels:
+    app: kubeinvaders
+    chart: {{ template "kubeinvaders.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+rules:
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["get", "watch", "list", "delete"]
+{{- end -}}
+{{- if or .Values.clusterRole.create .Values.clusterRole.name }}
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ template "kubeinvaders.clusterRoleName" . }}
+  labels:
+    app: kubeinvaders
+    chart: {{ template "kubeinvaders.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+subjects:
+- kind: ServiceAccount
+  name: {{ template "kubeinvaders.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: kubeinvaders
+{{- end -}}
+{{- end -}}

helm-charts/kubeinvaders/templates/serviceaccount.yaml

@@ -3,9 +3,9 @@ kind: ServiceAccount
 metadata:
   annotations:
     "helm.sh/hook": "pre-install"
-  name: kubeinvaders
+  name: {{ template "kubeinvaders.serviceAccountName" . }}
   labels:
-    app: kubeinvaders
-    chart: kubeinvaders
+    app: {{ template "kubeinvaders.name" . }}
+    chart: {{ template "kubeinvaders.chart" . }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}

helm-charts/kubeinvaders/values.yaml

@@ -1,6 +1,26 @@
 # Default values for kubeinvaders.
 # This is a YAML-formatted file.
 # Declare variables to be passed into your templates.
+rbac:
+  # Specifies whether RBAC resources should be created
+  create: true
+
+serviceAccount:
+  # Specifies whether a service account should be created
+  create: true
+  # The name of the service account to use.
+  # If not set and create is true, a name is generated using the fullname template
+  name:
+
+clusterRole:
+  create: true
+  # The name of a cluster role to bind to; if not set and create is
+  # true, a name based on fullname is generated
+  name:
+
+# If clusterRole "false" specifies which namespaces
+# kubeinvaders should have access to
+allowedNamespaces: []
 
 replicaCount: 1