Chris Farhood
d7210fb4e5
Adds a clusterAccess value with five levels: none — no cluster access (default, no RBAC resources created) readonlyns — Role + RoleBinding: get/list/watch in release namespace readwritens — Role + RoleBinding: full access in release namespace readonly — ClusterRole + ClusterRoleBinding: get/list/watch cluster-wide readwrite — ClusterRole + ClusterRoleBinding: full access cluster-wide A ServiceAccount is created for the pod whenever access != none and referenced in the Deployment's serviceAccountName. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
98 lines
1.9 KiB
YAML
98 lines
1.9 KiB
YAML
{{- $access := .Values.clusterAccess | default "none" }}
|
|
{{- $name := include "antigravity.fullname" . }}
|
|
{{- $ns := .Release.Namespace }}
|
|
{{- $labels := include "antigravity.labels" . }}
|
|
|
|
{{- if ne $access "none" }}
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: {{ $name }}
|
|
namespace: {{ $ns }}
|
|
labels:
|
|
{{- $labels | nindent 4 }}
|
|
|
|
{{- if or (eq $access "readonlyns") (eq $access "readwritens") }}
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: {{ $name }}
|
|
namespace: {{ $ns }}
|
|
labels:
|
|
{{- $labels | nindent 4 }}
|
|
rules:
|
|
- apiGroups: ["*"]
|
|
resources: ["*"]
|
|
verbs:
|
|
{{- if eq $access "readonlyns" }}
|
|
- get
|
|
- list
|
|
- watch
|
|
{{- else }}
|
|
- "*"
|
|
{{- end }}
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: {{ $name }}
|
|
namespace: {{ $ns }}
|
|
labels:
|
|
{{- $labels | nindent 4 }}
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: {{ $name }}
|
|
namespace: {{ $ns }}
|
|
roleRef:
|
|
kind: Role
|
|
name: {{ $name }}
|
|
apiGroup: rbac.authorization.k8s.io
|
|
{{- end }}
|
|
|
|
{{- if or (eq $access "readonly") (eq $access "readwrite") }}
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: {{ $name }}
|
|
labels:
|
|
{{- $labels | nindent 4 }}
|
|
rules:
|
|
- apiGroups: ["*"]
|
|
resources: ["*"]
|
|
verbs:
|
|
{{- if eq $access "readonly" }}
|
|
- get
|
|
- list
|
|
- watch
|
|
{{- else }}
|
|
- "*"
|
|
{{- end }}
|
|
- nonResourceURLs: ["*"]
|
|
verbs:
|
|
{{- if eq $access "readonly" }}
|
|
- get
|
|
{{- else }}
|
|
- "*"
|
|
{{- end }}
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: {{ $name }}
|
|
labels:
|
|
{{- $labels | nindent 4 }}
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: {{ $name }}
|
|
namespace: {{ $ns }}
|
|
roleRef:
|
|
kind: ClusterRole
|
|
name: {{ $name }}
|
|
apiGroup: rbac.authorization.k8s.io
|
|
{{- end }}
|
|
|
|
{{- end }}
|