From 7d5f991538b2cf784645e7f1de71ff72800f8160 Mon Sep 17 00:00:00 2001
From: Todd Malsbary <todd.malsbary@intel.com>
Date: Tue, 23 Feb 2021 09:28:48 -0800
Subject: Add cmk addon helm chart

The chart follows the instructions laid out in the CMK operator
manual, with the following notes:
- The nodes are prepared by running each CMK subcommand as a Pod
  instead of running cmk cluster-init.  The first reason for this is
  that the existing addon only deploys CMK to the worker nodes in the
  cluster.  This is not possible using cluster-init without explicitly
  providing the list of worker nodes to cluster-init, and this list is
  unknown by helm.  Instead it is sufficient to rely on the
  node-role.kubernetes.io/master:NoSchedule taint.  The second reason
  is that cluster-init creates resources which are unknown to helm,
  thus uninstall does not behave as expected.
- The v1.4.1 version of CMK is chosen.  In v1.5.2, the description key
  of the cmk-nodereport resource is not correct.
- All values listed as possibly requiring modification are exposed in
  values.yaml

Issue-ID: MULTICLOUD-1324
Signed-off-by: Todd Malsbary <todd.malsbary@intel.com>
Change-Id: Ibc75462de3729cd88edeb4b15602d57fe12791ca
---
 .../cpu-manager/templates/clusterrolebinding.yaml  | 91 ++++++++++++++++++++++
 1 file changed, 91 insertions(+)
 create mode 100644 kud/deployment_infra/helm/cpu-manager/templates/clusterrolebinding.yaml

(limited to 'kud/deployment_infra/helm/cpu-manager/templates/clusterrolebinding.yaml')

diff --git a/kud/deployment_infra/helm/cpu-manager/templates/clusterrolebinding.yaml b/kud/deployment_infra/helm/cpu-manager/templates/clusterrolebinding.yaml
new file mode 100644
index 00000000..2d08c820
--- /dev/null
+++ b/kud/deployment_infra/helm/cpu-manager/templates/clusterrolebinding.yaml
@@ -0,0 +1,91 @@
+{{- if .Values.rbac.create }}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "cpu-manager.fullname" . }}-role-binding-daemonset
+  labels:
+    {{- include "cpu-manager.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "cpu-manager.fullname" . }}-daemonset-controller
+subjects:
+- kind: ServiceAccount
+  name: {{ include "cpu-manager.serviceAccountName" . }}
+  namespace: {{ $.Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "cpu-manager.fullname" . }}-role-binding-node
+  labels:
+    {{- include "cpu-manager.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:node
+subjects:
+- kind: ServiceAccount
+  name: {{ include "cpu-manager.serviceAccountName" . }}
+  namespace: {{ $.Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "cpu-manager.fullname" . }}-role-binding-crd
+  labels:
+    {{- include "cpu-manager.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "cpu-manager.fullname" . }}-custom-resource-definition-controller
+subjects:
+- kind: ServiceAccount
+  name: {{ include "cpu-manager.serviceAccountName" . }}
+  namespace: {{ $.Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "cpu-manager.fullname" . }}-role-binding-version
+  labels:
+    {{- include "cpu-manager.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "cpu-manager.fullname" . }}-version-controller
+subjects:
+- kind: ServiceAccount
+  name: {{ include "cpu-manager.serviceAccountName" . }}
+  namespace: {{ $.Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "cpu-manager.fullname" . }}-role-binding-webhook-installer
+  labels:
+    {{- include "cpu-manager.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "cpu-manager.fullname" . }}-webhook-installer
+subjects:
+- kind: ServiceAccount
+  name: {{ include "cpu-manager.serviceAccountName" . }}
+  namespace: {{ $.Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "cpu-manager.fullname" . }}-role-binding-node-lister
+  labels:
+    {{- include "cpu-manager.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "cpu-manager.fullname" . }}-node-lister
+subjects:
+- kind: ServiceAccount
+  name: {{ include "cpu-manager.serviceAccountName" . }}
+  namespace: {{ $.Release.Namespace }}
+{{- end }}
-- 
cgit 1.2.3-korg