feat(chart): option to not create clusterRoles; (datainfrahq#172)

Co-authored-by: Marius Kimmina <[email protected]>
TessaIO · Dec 10, 2024 · d6ddc80 · d6ddc80
1 parent aa879ec
commit d6ddc80
Show file tree

Hide file tree

Showing 4 changed files with 11 additions and 1 deletion.
diff --git a/chart/templates/rbac_manager.yaml b/chart/templates/rbac_manager.yaml
@@ -182,6 +182,7 @@ rules:
 {{- end }}
 
 ---
+{{- if .Values.global.createClusterRole }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
@@ -357,6 +358,7 @@ rules:
     - get
     - list
     - watch
+{{- end }}
 
 {{- $operatorName := (include "druid-operator.fullname" .) -}}
 {{- if and ($env.WATCH_NAMESPACE) (ne $env.WATCH_NAMESPACE "default") }}
@@ -382,6 +384,7 @@ roleRef:
 {{- end }}
 {{- end }}
 ---
+{{- if .Values.global.createClusterRole }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
@@ -399,3 +402,4 @@ subjects:
   - kind: ServiceAccount
     name: {{ include "druid-operator.fullname" . }}
     namespace: {{ .Release.Namespace }}
+{{- end }}
diff --git a/chart/templates/rbac_metrics.yaml b/chart/templates/rbac_metrics.yaml
@@ -1,4 +1,5 @@
 ---
+{{- if .Values.global.createClusterRole }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
@@ -13,3 +14,4 @@ rules:
       - /metrics
     verbs:
       - get
+{{- end }}
diff --git a/chart/templates/rbac_proxy.yaml b/chart/templates/rbac_proxy.yaml
@@ -1,4 +1,5 @@
 ---
+{{- if .Values.global.createClusterRole }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
@@ -39,3 +40,4 @@ subjects:
   - kind: ServiceAccount
     name: {{ include "druid-operator.fullname" . }}
     namespace: {{ .Release.Namespace }}
+{{- end }}
diff --git a/chart/values.yaml b/chart/values.yaml
@@ -2,6 +2,9 @@
 # This is a YAML-formatted file.
 # Declare variables to be passed into your templates.
 
+global:
+  createClusterRole: true
+
 env:
   DENY_LIST: "default,kube-system" # Comma-separated list of namespaces to ignore
   RECONCILE_WAIT: "10s" # Reconciliation delay
@@ -22,7 +25,6 @@ kube_rbac_proxy:
     pullPolicy: IfNotPresent
     tag: "v0.13.1"
 
-
 imagePullSecrets: []
 nameOverride: ""
 fullnameOverride: ""