From 7d5f991538b2cf784645e7f1de71ff72800f8160 Mon Sep 17 00:00:00 2001
From: Todd Malsbary <todd.malsbary@intel.com>
Date: Tue, 23 Feb 2021 09:28:48 -0800
Subject: Add cmk addon helm chart

The chart follows the instructions laid out in the CMK operator
manual, with the following notes:
- The nodes are prepared by running each CMK subcommand as a Pod
  instead of running cmk cluster-init.  The first reason for this is
  that the existing addon only deploys CMK to the worker nodes in the
  cluster.  This is not possible using cluster-init without explicitly
  providing the list of worker nodes to cluster-init, and this list is
  unknown by helm.  Instead it is sufficient to rely on the
  node-role.kubernetes.io/master:NoSchedule taint.  The second reason
  is that cluster-init creates resources which are unknown to helm,
  thus uninstall does not behave as expected.
- The v1.4.1 version of CMK is chosen.  In v1.5.2, the description key
  of the cmk-nodereport resource is not correct.
- All values listed as possibly requiring modification are exposed in
  values.yaml

Issue-ID: MULTICLOUD-1324
Signed-off-by: Todd Malsbary <todd.malsbary@intel.com>
Change-Id: Ibc75462de3729cd88edeb4b15602d57fe12791ca
---
 .../helm/cpu-manager/templates/clusterrole.yaml    | 59 ++++++++++++++++++++++
 1 file changed, 59 insertions(+)
 create mode 100644 kud/deployment_infra/helm/cpu-manager/templates/clusterrole.yaml

(limited to 'kud/deployment_infra/helm/cpu-manager/templates/clusterrole.yaml')

diff --git a/kud/deployment_infra/helm/cpu-manager/templates/clusterrole.yaml b/kud/deployment_infra/helm/cpu-manager/templates/clusterrole.yaml
new file mode 100644
index 00000000..003a5b61
--- /dev/null
+++ b/kud/deployment_infra/helm/cpu-manager/templates/clusterrole.yaml
@@ -0,0 +1,59 @@
+{{- if .Values.rbac.create }}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRole
+metadata:
+  name: {{ include "cpu-manager.fullname" . }}-custom-resource-definition-controller
+  labels:
+    {{- include "cpu-manager.labels" . | nindent 4 }}
+rules:
+- apiGroups: ["intel.com"]
+  resources: ["*"]
+  verbs: ["*"]
+- apiGroups: ["apiextensions.k8s.io"]
+  resources: ["customresourcedefinitions", "customresourcedefinitions.extensions"]
+  verbs: ["*"]
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRole
+metadata:
+  name: {{ include "cpu-manager.fullname" . }}-daemonset-controller
+  labels:
+    {{- include "cpu-manager.labels" . | nindent 4 }}
+rules:
+- apiGroups: ["extensions", "apps"]
+  resources: ["daemonsets", "daemonsets.extensions", "daemonsets.apps"]
+  verbs: ["*"]
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRole
+metadata:
+  name: {{ include "cpu-manager.fullname" . }}-version-controller
+  labels:
+    {{- include "cpu-manager.labels" . | nindent 4 }}
+rules:
+  - nonResourceURLs: ["*"]
+    verbs:
+      - get
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRole
+metadata:
+  name: {{ include "cpu-manager.fullname" . }}-webhook-installer
+  labels:
+    {{- include "cpu-manager.labels" . | nindent 4 }}
+rules:
+- apiGroups: ["", "apps", "extensions", "admissionregistration.k8s.io"]
+  resources: ["secrets", "configmaps", "deployments", "services", "mutatingwebhookconfigurations"]
+  verbs: ["*"]
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRole
+metadata:
+  name: {{ include "cpu-manager.fullname" . }}-node-lister
+  labels:
+    {{- include "cpu-manager.labels" . | nindent 4 }}
+rules:
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["*"]
+{{- end }}
-- 
cgit 1.2.3-korg