Skip to content

Commit 5cb0c45

Browse files
jastBytesjastBytes
authored
Merge pull request #10 from finleap-connect/fix/helm-chart
Helm Chart Problems
2 parents 50388b0 + 0ba0351 commit 5cb0c45

31 files changed

+221
-296
lines changed

‎.gitignore

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,10 @@
66
!/tools/vault-install
77
/bin
88
/reports
9+
/tmp
910

1011
*.coverprofile
1112

12-
1313
# Binaries for programs and plugins
1414
*.exe
1515
*.exe~

‎Makefile

-2
Original file line numberDiff line numberDiff line change
@@ -61,8 +61,6 @@ manifests: $(CONTROLLER_GEN) $(KUSTOMIZE) ## Generate manifests e.g. CRD, RBAC e
6161
$(CONTROLLER_GEN) crd:trivialVersions=false rbac:roleName=manager-role webhook paths="./..." output:crd:artifacts:config=config/crd/bases
6262
echo "# Generated by 'make manifests'\n" > $(HELM_CHART_DIR)/templates/crds.yaml
6363
$(KUSTOMIZE) build config/crd-templates >> $(HELM_CHART_DIR)/templates/crds.yaml
64-
echo "# Generated by 'make manifests'\n" > $(HELM_CHART_DIR)/templates/rbac.yaml
65-
$(KUSTOMIZE) build config/rbac-templates >> $(HELM_CHART_DIR)/templates/rbac.yaml
6664
echo "# Generated by 'make manifests'\n" > $(HELM_CHART_DIR)/templates/webhook.yaml
6765
$(KUSTOMIZE) build config/webhook-templates >> $(HELM_CHART_DIR)/templates/webhook.yaml
6866

‎charts/vault-operator/templates/_helpers.tpl

+11-2
Original file line numberDiff line numberDiff line change
@@ -40,8 +40,6 @@ helm.sh/chart: {{ include "vault-operator.chart" . }}
4040
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
4141
{{- end }}
4242
app.kubernetes.io/managed-by: {{ .Release.Service }}
43-
app: vault-operator
44-
control-plane: controller-manager
4543
{{- end }}
4644

4745
{{/*
@@ -51,3 +49,14 @@ Selector labels
5149
app.kubernetes.io/name: {{ include "vault-operator.name" . }}
5250
app.kubernetes.io/instance: {{ .Release.Name }}
5351
{{- end }}
52+
53+
{{/*
54+
Create the name of the service account to use
55+
*/}}
56+
{{- define "vault-operator.serviceAccountName" -}}
57+
{{- if .Values.serviceAccount.create }}
58+
{{- default (include "vault-operator.fullname" .) .Values.serviceAccount.name }}
59+
{{- else }}
60+
{{- default "default" .Values.serviceAccount.name }}
61+
{{- end }}
62+
{{- end }}

‎charts/vault-operator/templates/cert.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,8 @@ metadata:
2424
{{- include "vault-operator.labels" . | nindent 4 }}
2525
spec:
2626
dnsNames:
27-
- vault-operator-webhook-service.{{ .Release.Namespace }}.svc
28-
- vault-operator-webhook-service.{{ .Release.Namespace }}.svc.cluster.local
27+
- {{ include "vault-operator.fullname" . }}-webhook.{{ .Release.Namespace }}.svc
28+
- {{ include "vault-operator.fullname" . }}-webhook.svc.cluster.local
2929
issuerRef:
3030
kind: Issuer
3131
name: selfsigned-issuer

‎charts/vault-operator/templates/crds.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ spec:
1414
webhookClientConfig:
1515
caBundle: Cg==
1616
service:
17-
name: vault-operator-webhook-service
17+
name: '{{ include "vault-operator.fullname" . }}-webhook'
1818
namespace: '{{ .Release.Namespace }}'
1919
path: /convert
2020
group: vault.finleap.cloud

‎charts/vault-operator/templates/deployment.yaml

+1-2
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@ metadata:
44
name: {{ include "vault-operator.fullname" . }}
55
labels:
66
{{- include "vault-operator.labels" . | nindent 4 }}
7-
control-plane: controller-manager
87
spec:
98
replicas: {{ .Values.replicaCount }}
109
selector:
@@ -23,7 +22,7 @@ spec:
2322
imagePullSecrets:
2423
{{- toYaml . | nindent 8 }}
2524
{{- end }}
26-
serviceAccountName: vault-operator
25+
serviceAccountName: {{ include "vault-operator.serviceAccountName" . }}
2726
securityContext:
2827
{{- toYaml .Values.podSecurityContext | nindent 8 }}
2928
containers:

‎charts/vault-operator/templates/leaderelection-rbac.yaml

+57
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: Role
3+
metadata:
4+
name: {{ include "vault-operator.fullname" . }}-leaderelection
5+
labels:
6+
{{- include "vault-operator.labels" . | nindent 4 }}
7+
rules:
8+
- apiGroups:
9+
- ""
10+
resources:
11+
- configmaps
12+
verbs:
13+
- get
14+
- list
15+
- watch
16+
- create
17+
- update
18+
- patch
19+
- delete
20+
- apiGroups:
21+
- ""
22+
resources:
23+
- configmaps/status
24+
verbs:
25+
- get
26+
- update
27+
- patch
28+
- apiGroups:
29+
- ""
30+
resources:
31+
- events
32+
verbs:
33+
- create
34+
- apiGroups:
35+
- coordination.k8s.io
36+
resources:
37+
- leases
38+
verbs:
39+
- create
40+
- get
41+
- list
42+
- update
43+
---
44+
apiVersion: rbac.authorization.k8s.io/v1
45+
kind: RoleBinding
46+
metadata:
47+
name: {{ include "vault-operator.fullname" . }}-leaderelection
48+
labels:
49+
{{- include "vault-operator.labels" . | nindent 4 }}
50+
roleRef:
51+
apiGroup: rbac.authorization.k8s.io
52+
kind: Role
53+
name: {{ include "vault-operator.fullname" . }}-leaderelection
54+
subjects:
55+
- kind: ServiceAccount
56+
name: {{ include "vault-operator.serviceAccountName" . }}
57+
namespace: "{{ .Release.Namespace }}"

‎charts/vault-operator/templates/manager-rbac.yaml

+61
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
name: {{ include "vault-operator.fullname" . }}-manager
5+
labels:
6+
{{- include "vault-operator.labels" . | nindent 4 }}
7+
rules:
8+
- apiGroups:
9+
- ""
10+
resources:
11+
- events
12+
verbs:
13+
- create
14+
- patch
15+
- apiGroups:
16+
- ""
17+
resources:
18+
- secrets
19+
verbs:
20+
- create
21+
- delete
22+
- get
23+
- list
24+
- patch
25+
- update
26+
- watch
27+
- apiGroups:
28+
- vault.finleap.cloud
29+
resources:
30+
- vaultsecrets
31+
verbs:
32+
- create
33+
- delete
34+
- get
35+
- list
36+
- patch
37+
- update
38+
- watch
39+
- apiGroups:
40+
- vault.finleap.cloud
41+
resources:
42+
- vaultsecrets/status
43+
verbs:
44+
- get
45+
- patch
46+
- update
47+
---
48+
apiVersion: rbac.authorization.k8s.io/v1
49+
kind: ClusterRoleBinding
50+
metadata:
51+
name: {{ include "vault-operator.fullname" . }}-manager
52+
labels:
53+
{{- include "vault-operator.labels" . | nindent 4 }}
54+
roleRef:
55+
apiGroup: rbac.authorization.k8s.io
56+
kind: ClusterRole
57+
name: {{ include "vault-operator.fullname" . }}-manager
58+
subjects:
59+
- kind: ServiceAccount
60+
name: {{ include "vault-operator.serviceAccountName" . }}
61+
namespace: '{{ .Release.Namespace }}'

‎charts/vault-operator/templates/metrics-rbac.yaml

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
apiVersion: rbac.authorization.k8s.io/v1beta1
2+
kind: ClusterRole
3+
metadata:
4+
name: {{ include "vault-operator.fullname" . }}-metrics-reader
5+
labels:
6+
{{- include "vault-operator.labels" . | nindent 4 }}
7+
rules:
8+
- nonResourceURLs:
9+
- /metrics
10+
verbs:
11+
- get

‎charts/vault-operator/templates/proxy-rbac.yaml

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
name: {{ include "vault-operator.fullname" . }}-proxy
5+
labels:
6+
{{- include "vault-operator.labels" . | nindent 4 }}
7+
rules:
8+
- apiGroups:
9+
- authentication.k8s.io
10+
resources:
11+
- tokenreviews
12+
verbs:
13+
- create
14+
- apiGroups:
15+
- authorization.k8s.io
16+
resources:
17+
- subjectaccessreviews
18+
verbs:
19+
- create
20+
---
21+
apiVersion: rbac.authorization.k8s.io/v1
22+
kind: ClusterRoleBinding
23+
metadata:
24+
name: {{ include "vault-operator.fullname" . }}-proxy
25+
roleRef:
26+
apiGroup: rbac.authorization.k8s.io
27+
kind: ClusterRole
28+
name: {{ include "vault-operator.fullname" . }}-proxy
29+
subjects:
30+
- kind: ServiceAccount
31+
name: {{ include "vault-operator.serviceAccountName" . }}
32+
namespace: '{{ .Release.Namespace }}'

0 commit comments

Comments
 (0)