Skip to content

Commit b2247c4

Browse files
tamalsahatamalsaha
authored
Add appcatalog and metrics user roles to ace-user-roles (#194)
Signed-off-by: Tamal Saha <[email protected]>
1 parent a5db346 commit b2247c4

File tree

14 files changed

+194
-57
lines changed

14 files changed

+194
-57
lines changed

‎charts/ace-user-roles/README.md

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -45,10 +45,20 @@ The command removes all the Kubernetes components associated with the chart and
4545

4646
The following table lists the configurable parameters of the `ace-user-roles` chart and their default values.
4747

48-
| Parameter | Description | Default |
49-
|------------------|-----------------------------|-----------------|
50-
| nameOverride | Overrides name template | <code>""</code> |
51-
| fullnameOverride | Overrides fullname template | <code>""</code> |
48+
| Parameter | Description | Default |
49+
|----------------------------------------|-----------------------------|-------------------|
50+
| nameOverride | Overrides name template | <code>""</code> |
51+
| fullnameOverride | Overrides fullname template | <code>""</code> |
52+
| enableClusterRoles.ace | | <code>true</code> |
53+
| enableClusterRoles.appcatalog | | <code>true</code> |
54+
| enableClusterRoles.catalog | | <code>true</code> |
55+
| enableClusterRoles.cert-manager | | <code>true</code> |
56+
| enableClusterRoles.kubedb-ui | | <code>true</code> |
57+
| enableClusterRoles.kubestash | | <code>true</code> |
58+
| enableClusterRoles.license-proxyserver | | <code>true</code> |
59+
| enableClusterRoles.metrics | | <code>true</code> |
60+
| enableClusterRoles.prometheus | | <code>true</code> |
61+
| enableClusterRoles.stash | | <code>true</code> |
5262

5363

5464
Specify each parameter using the `--set key=value[,key=value]` argument to `helm upgrade -i`. For example:

‎charts/ace-user-roles/templates/ace/user-roles.yaml

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
{{- if dig "ace" false .Values.enableClusterRoles }}
2+
13
apiVersion: rbac.authorization.k8s.io/v1
24
kind: ClusterRole
35
metadata:
@@ -12,7 +14,7 @@ rules:
1214
- drivers.x-helm.dev
1315
resources:
1416
- appreleases
15-
verbs: ["create", "delete", "deletecollection", "patch", "update"]
17+
verbs: ["create", "update", "patch", "delete", "deletecollection"]
1618
---
1719
kind: ClusterRole
1820
apiVersion: rbac.authorization.k8s.io/v1
@@ -29,3 +31,5 @@ rules:
2931
resources:
3032
- appreleases
3133
verbs: ["get", "list", "watch"]
34+
35+
{{- end }}

‎charts/ace-user-roles/templates/appcatalog/appcatalog-user-roles.yaml

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
{{- if dig "appcatalog" false .Values.enableClusterRoles }}
2+
3+
apiVersion: rbac.authorization.k8s.io/v1
4+
kind: ClusterRole
5+
metadata:
6+
name: appscode:appcatalog:admin
7+
labels:
8+
rbac.authorization.k8s.io/aggregate-to-admin: "true"
9+
annotations:
10+
"helm.sh/hook": pre-install,pre-upgrade
11+
"helm.sh/hook-delete-policy": before-hook-creation
12+
rules:
13+
- apiGroups:
14+
- appcatalog.appscode.com
15+
resources:
16+
- "*"
17+
verbs: ["*"]
18+
---
19+
kind: ClusterRole
20+
apiVersion: rbac.authorization.k8s.io/v1
21+
metadata:
22+
name: appscode:appcatalog:view
23+
labels:
24+
rbac.authorization.k8s.io/aggregate-to-view: "true"
25+
annotations:
26+
"helm.sh/hook": pre-install,pre-upgrade
27+
"helm.sh/hook-delete-policy": before-hook-creation
28+
rules:
29+
- apiGroups:
30+
- appcatalog.appscode.com
31+
resources:
32+
- "*"
33+
verbs: ["get", "list", "watch"]
34+
35+
{{- end }}

‎charts/ace-user-roles/templates/catalog-manager/user-roles.yaml renamed to ‎charts/ace-user-roles/templates/catalog/user-roles.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
{{- if dig "catalog" false .Values.enableClusterRoles }}
2+
13
apiVersion: rbac.authorization.k8s.io/v1
24
kind: ClusterRole
35
metadata:
@@ -45,3 +47,5 @@ rules:
4547
resources:
4648
- "*"
4749
verbs: ["get", "list", "watch"]
50+
51+
{{- end }}

‎charts/ace-user-roles/templates/cert-manager/user-roles.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
{{- if dig "cert-manager" false .Values.enableClusterRoles }}
2+
13
# kubectl get clusterrole cert-manager-edit
24
apiVersion: rbac.authorization.k8s.io/v1
35
kind: ClusterRole
@@ -57,3 +59,5 @@ rules:
5759
- challenges
5860
- orders
5961
verbs: ["get", "list", "watch"]
62+
63+
{{- end }}

‎charts/ace-user-roles/templates/kubedb-ui/user-roles.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
{{- if dig "kubedb-ui" false .Values.enableClusterRoles }}
2+
13
apiVersion: rbac.authorization.k8s.io/v1
24
kind: ClusterRole
35
metadata:
@@ -52,3 +54,5 @@ subjects:
5254
- kind: Group
5355
name: system:authenticated
5456
apiGroup: rbac.authorization.k8s.io
57+
58+
{{- end }}

‎charts/ace-user-roles/templates/kubestash/user_roles.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
{{- if dig "kubestash" false .Values.enableClusterRoles }}
2+
13
apiVersion: rbac.authorization.k8s.io/v1
24
kind: ClusterRole
35
metadata:
@@ -50,3 +52,5 @@ rules:
5052
resources:
5153
- "*"
5254
verbs: ["get", "list", "watch"]
55+
56+
{{- end }}

‎charts/ace-user-roles/templates/license-proxyserver/license-checker-cluster-role.yaml

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{{- if dig "license-proxyserver" false .Values.enableClusterRoles }}
2+
3+
apiVersion: rbac.authorization.k8s.io/v1
4+
kind: ClusterRole
5+
metadata:
6+
name: appscode:license-checker
7+
annotations:
8+
"helm.sh/hook": pre-install,pre-upgrade
9+
"helm.sh/hook-delete-policy": before-hook-creation
10+
rules:
11+
# Get cluster id
12+
- apiGroups:
13+
- ""
14+
resources:
15+
- namespaces
16+
verbs: ["get"]
17+
- apiGroups:
18+
- ""
19+
resources:
20+
- configmaps
21+
resourceNames: ["ace-info"]
22+
verbs: ["get"]
23+
# Issue license
24+
- apiGroups:
25+
- proxyserver.licenses.appscode.com
26+
resources:
27+
- licenserequests
28+
verbs: ["create"]
29+
# Detect workload/owner of operator pod
30+
- apiGroups:
31+
- ""
32+
resources:
33+
- pods
34+
verbs: ["get"]
35+
- apiGroups:
36+
- apps
37+
resources:
38+
- deployments
39+
- replicasets
40+
verbs: ["get"]
41+
# Write events in case of license verification failure
42+
- apiGroups:
43+
- ""
44+
resources:
45+
- events
46+
verbs: ["get", "list", "create", "patch"]
47+
48+
{{- end }}

‎charts/ace-user-roles/templates/license-proxyserver/license-reader-cluster-role.yaml

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
{{- if dig "license-proxyserver" false .Values.enableClusterRoles }}
2+
3+
apiVersion: rbac.authorization.k8s.io/v1
4+
kind: ClusterRole
5+
metadata:
6+
name: appscode:license-reader
7+
annotations:
8+
"helm.sh/hook": pre-install,pre-upgrade
9+
"helm.sh/hook-delete-policy": before-hook-creation
10+
rules:
11+
# Detect license server endpoint for kubedb addons
12+
- apiGroups:
13+
- apiregistration.k8s.io
14+
resources:
15+
- apiservices
16+
verbs: ["get"]
17+
- nonResourceURLs:
18+
- /appscode/license
19+
verbs: ["get"]
20+
21+
{{- end }}

‎charts/ace-user-roles/templates/metrics/metrics-user-roles.yaml

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
{{- if dig "metrics" false .Values.enableClusterRoles }}
2+
3+
apiVersion: rbac.authorization.k8s.io/v1
4+
kind: ClusterRole
5+
metadata:
6+
name: appscode:metrics:admin
7+
labels:
8+
rbac.authorization.k8s.io/aggregate-to-admin: "true"
9+
annotations:
10+
"helm.sh/hook": pre-install,pre-upgrade
11+
"helm.sh/hook-delete-policy": before-hook-creation
12+
rules:
13+
- apiGroups:
14+
- metrics.appscode.com
15+
resources:
16+
- "*"
17+
verbs: ["*"]
18+
---
19+
kind: ClusterRole
20+
apiVersion: rbac.authorization.k8s.io/v1
21+
metadata:
22+
name: appscode:metrics:view
23+
labels:
24+
rbac.authorization.k8s.io/aggregate-to-view: "true"
25+
annotations:
26+
"helm.sh/hook": pre-install,pre-upgrade
27+
"helm.sh/hook-delete-policy": before-hook-creation
28+
rules:
29+
- apiGroups:
30+
- metrics.appscode.com
31+
resources:
32+
- "*"
33+
verbs: ["get", "list", "watch"]
34+
35+
{{- end }}

‎charts/ace-user-roles/templates/others.yaml

Lines changed: 0 additions & 52 deletions
This file was deleted.

‎charts/ace-user-roles/templates/prometheus/user-roles.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
{{- if dig "prometheus" false .Values.enableClusterRoles }}
2+
13
apiVersion: rbac.authorization.k8s.io/v1
24
kind: ClusterRole
35
metadata:
@@ -45,3 +47,5 @@ rules:
4547
resources:
4648
- "*"
4749
verbs: ["get", "list", "watch"]
50+
51+
{{- end }}

‎charts/ace-user-roles/templates/stash/user-roles.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
{{- if dig "stash" false .Values.enableClusterRoles }}
2+
13
apiVersion: rbac.authorization.k8s.io/v1
24
kind: ClusterRole
35
metadata:
@@ -46,3 +48,5 @@ rules:
4648
resources:
4749
- "*"
4850
verbs: ["get", "list", "watch"]
51+
52+
{{- end }}

‎charts/ace-user-roles/values.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,3 +6,15 @@
66
nameOverride: ""
77
# Overrides fullname template
88
fullnameOverride: ""
9+
10+
enableClusterRoles:
11+
ace: true
12+
appcatalog: true
13+
catalog: true
14+
cert-manager: true
15+
kubedb-ui: true
16+
kubestash: true
17+
license-proxyserver: true
18+
metrics: true
19+
prometheus: true
20+
stash: true

0 commit comments

Comments
 (0)