diff options
| author |   Sylvain Desbureaux <sylvain.desbureaux@orange.com> | 2021-04-19 15:26:15 +0200 |
|---|---|---|
| committer |   Krzysztof Opasiak <k.opasiak@samsung.com> | 2021-05-11 17:42:54 +0000 |
| commit | 6f4e8c05f173a957c61acd0741541f52a552e12c (patch) | |
| tree | ec8dad1ecaf4b5e460046ef04bda975907198c0e /kubernetes/common/serviceAccount/templates/role-binding.yaml | |
| parent | f2c596ce55a2fa00280052d2924d69ffdccbcb71 (diff) | |
[COMMON][ROLES] Create default roles once
Instead of creating all roles every time with service account chart,
let's just create the specific ones for a chart and point to default one
for the three default roles.
In order to lighten serviceAccount chart, whole logic for default role
creation is in `roles-wrapper`.
Issue-ID: OOM-2729
Signed-off-by: Sylvain Desbureaux <sylvain.desbureaux@orange.com>
Change-Id: Ib4d6a2669ca7d747320a4bccb65aac863eb60956
Diffstat (limited to 'kubernetes/common/serviceAccount/templates/role-binding.yaml')
| -rw-r--r-- | kubernetes/common/serviceAccount/templates/role-binding.yaml | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/kubernetes/common/serviceAccount/templates/role-binding.yaml b/kubernetes/common/serviceAccount/templates/role-binding.yaml index 2082f8466b..7c272aecda 100644 --- a/kubernetes/common/serviceAccount/templates/role-binding.yaml +++ b/kubernetes/common/serviceAccount/templates/role-binding.yaml @@ -16,18 +16,24 @@ {{- $dot := . -}} {{- range $role_type := $dot.Values.roles }} +{{/* retrieve the names for generic roles */}} +{{ $name := printf "%s-%s" (include "common.release" $dot) $role_type }} +{{- if not (has $role_type $dot.Values.defaultRoles) }} +{{ $name = include "common.fullname" (dict "suffix" $role_type "dot" $dot ) }} +{{- end }} --- apiVersion: rbac.authorization.k8s.io/v1 # This cluster role binding allows anyone in the "manager" group to read secrets in any namespace. kind: RoleBinding metadata: - name: {{ include "common.fullname" (dict "suffix" $role_type "dot" $dot )}} + name: {{ include "common.fullname" (dict "suffix" $role_type "dot" $dot ) }} namespace: {{ include "common.namespace" $dot }} subjects: - kind: ServiceAccount - name: {{ include "common.fullname" (dict "suffix" $role_type "dot" $dot )}} + name: {{ include "common.fullname" (dict "suffix" $role_type "dot" $dot ) }} roleRef: kind: Role - name: {{ include "common.fullname" (dict "suffix" $role_type "dot" $dot )}} + name: {{ $name }} apiGroup: rbac.authorization.k8s.io {{- end }} + |