Make Pipelines services RBAC kind customizible

oronka · Dec 3, 2020 · 14d9747 · 14d9747
1 parent 03ca7e8
commit 14d9747
Show file tree

Hide file tree

Showing 4 changed files with 12 additions and 2 deletions.
diff --git a/stable/pipelines/CHANGELOG.md b/stable/pipelines/CHANGELOG.md
@@ -2,7 +2,7 @@
 All changes to this chart to be documented in this file
 
 ## [2.3.6] - Dec 3, 2020
-* Update Pipelines services RBAC rules
+* Update Pipelines services RBAC rules and settings
 
 ## [2.3.5] - Dec 3, 2020
 * Change semverCompare checks to support hosted Kubernetes
@@ -31,7 +31,7 @@ All changes to this chart to be documented in this file
 * Added support to provide join-key and master-key from secret
 
 ## [2.2.0] Nov 10, 2020
-* Add steps for using system.yaml via external secret for advanced usecases
+* Add steps for using system.yaml via external secret for advanced use cases
 * **IMPORTANT**
 * Changed .Values.existingSecret to .Values.systemYaml.existingSecret and .Values.systemYaml.dataKey
 * Add configurable support for vault-init container resources

diff --git a/stable/pipelines/templates/pipelines-role.yaml b/stable/pipelines/templates/pipelines-role.yaml
@@ -1,6 +1,10 @@
 {{- if .Values.rbac.create }}
 apiVersion: rbac.authorization.k8s.io/v1
+{{- if .Values.pipelines.rbac.clusterRole }}
 kind: ClusterRole
+{{- else }}
+kind: Role
+{{- end }}
 metadata:
   name: {{ include "pipelines.fullname" . }}
   labels:

diff --git a/stable/pipelines/templates/pipelines-rolebinding.yaml b/stable/pipelines/templates/pipelines-rolebinding.yaml
@@ -1,6 +1,10 @@
 {{- if .Values.rbac.create }}
 apiVersion: rbac.authorization.k8s.io/v1
+{{- if .Values.pipelines.rbac.clusterRole }}
 kind: ClusterRoleBinding
+{{- else }}
+kind: RoleBinding
+{{- end }}
 metadata:
   name: {{ include "pipelines.fullname" . }}
   labels:

diff --git a/stable/pipelines/values.yaml b/stable/pipelines/values.yaml
@@ -509,6 +509,8 @@ pipelines:
   ## Cluster Role Based Access
   ## Ref: https://kubernetes.io/docs/admin/authorization/rbac/
   rbac:
+    ## Sets ClusterRole if enabled, otherwise Role
+    clusterRole: false
     role:
       ## Rules to create. It follows the role specification
       rules: