Skip to content

Commit 370b78e

Browse files
mbaldessarimbaldessari
authored
Merge pull request #492 from mbaldessari/imperative-admin
Add an imperative-admin-sa service account
2 parents e9d1a4f + 1cbcc98 commit 370b78e

10 files changed

Lines changed: 252 additions & 13 deletions

‎clustergroup/templates/imperative/clusterrole.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
{{- if not (eq .Values.enabled "plumbing") }}
22
{{/* This is always defined as we always unseal the cluster with an imperative job */}}
3+
{{- if $.Values.clusterGroup.imperative.serviceAccountCreate }}
34
---
45
apiVersion: rbac.authorization.k8s.io/v1
56
kind: ClusterRole
@@ -18,4 +19,19 @@ rules:
1819
- list
1920
- watch
2021
{{- end }}
22+
{{- end }} {{/* if $.Values.clusterGroup.imperative.serviceAccountCreate */}}
23+
{{- if $.Values.clusterGroup.imperative.adminServiceAccountCreate }}
24+
---
25+
apiVersion: rbac.authorization.k8s.io/v1
26+
kind: ClusterRole
27+
metadata:
28+
name: {{ $.Values.clusterGroup.imperative.adminClusterRoleName }}
29+
rules:
30+
- apiGroups:
31+
- '*'
32+
resources:
33+
- '*'
34+
verbs:
35+
- '*'
36+
{{- end }} {{/* if $.Values.clusterGroup.imperative.adminServiceAccountCreate */}}
2137
{{- end }}

‎clustergroup/templates/imperative/rbac.yaml‎

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,11 @@
11
{{- if not (eq .Values.enabled "plumbing") }}
22
{{/* This is always defined as we always unseal the cluster with an imperative job */}}
3+
{{- if $.Values.clusterGroup.imperative.serviceAccountCreate -}}
34
---
45
apiVersion: rbac.authorization.k8s.io/v1
56
kind: ClusterRoleBinding
67
metadata:
7-
name: {{ $.Values.clusterGroup.imperative.namespace }}-cluster-admin-rolebinding
8+
name: {{ $.Values.clusterGroup.imperative.namespace }}-cluster-rolebinding
89
roleRef:
910
apiGroup: rbac.authorization.k8s.io
1011
kind: ClusterRole
@@ -17,7 +18,7 @@ subjects:
1718
apiVersion: rbac.authorization.k8s.io/v1
1819
kind: RoleBinding
1920
metadata:
20-
name: {{ $.Values.clusterGroup.imperative.namespace }}-admin-rolebinding
21+
name: {{ $.Values.clusterGroup.imperative.namespace }}-rolebinding
2122
namespace: {{ $.Values.clusterGroup.imperative.namespace }}
2223
roleRef:
2324
apiGroup: rbac.authorization.k8s.io
@@ -28,3 +29,19 @@ subjects:
2829
name: {{ $.Values.clusterGroup.imperative.serviceAccountName }}
2930
namespace: {{ $.Values.clusterGroup.imperative.namespace }}
3031
{{- end }}
32+
{{- if $.Values.clusterGroup.imperative.adminServiceAccountCreate }}
33+
---
34+
apiVersion: rbac.authorization.k8s.io/v1
35+
kind: ClusterRoleBinding
36+
metadata:
37+
name: {{ $.Values.clusterGroup.imperative.namespace }}-admin-clusterrolebinding
38+
roleRef:
39+
apiGroup: rbac.authorization.k8s.io
40+
kind: ClusterRole
41+
name: {{ $.Values.clusterGroup.imperative.adminClusterRoleName }}
42+
subjects:
43+
- kind: ServiceAccount
44+
name: {{ $.Values.clusterGroup.imperative.adminServiceAccountName }}
45+
namespace: {{ $.Values.clusterGroup.imperative.namespace }}
46+
{{- end }}
47+
{{- end }}

‎clustergroup/templates/imperative/serviceaccount.yaml‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,18 @@
11
{{- if not (eq .Values.enabled "plumbing") }}
22
{{/* This is always defined as we always unseal the cluster with an imperative job */}}
3-
{{- if $.Values.clusterGroup.imperative.serviceAccountCreate -}}
3+
{{- if $.Values.clusterGroup.imperative.serviceAccountCreate }}
44
apiVersion: v1
55
kind: ServiceAccount
66
metadata:
77
name: {{ $.Values.clusterGroup.imperative.serviceAccountName }}
88
namespace: {{ $.Values.clusterGroup.imperative.namespace }}
99
{{- end }}
10+
{{- if $.Values.clusterGroup.imperative.adminServiceAccountCreate }}
11+
---
12+
apiVersion: v1
13+
kind: ServiceAccount
14+
metadata:
15+
name: {{ $.Values.clusterGroup.imperative.adminServiceAccountName }}
16+
namespace: {{ $.Values.clusterGroup.imperative.namespace }}
17+
{{- end }}
1018
{{- end }}

‎clustergroup/values.schema.json‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -677,6 +677,15 @@
677677
},
678678
"roleYaml": {
679679
"type": "string"
680+
},
681+
"adminServiceAccountCreate": {
682+
"type": "boolean"
683+
},
684+
"adminServiceAccountName": {
685+
"type": "string"
686+
},
687+
"adminClusterRoleName": {
688+
"type": "string"
680689
}
681690
},
682691
"required": [

‎clustergroup/values.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,10 @@ clusterGroup:
5151
clusterRoleYaml: ""
5252
roleName: imperative-role
5353
roleYaml: ""
54+
adminServiceAccountCreate: true
55+
adminServiceAccountName: imperative-admin-sa
56+
adminClusterRoleName: imperative-admin-cluster-role
57+
5458
managedClusterGroups: {}
5559
namespaces: []
5660
# - name: factory

‎tests/clustergroup-industrial-edge-factory.expected.yaml‎

Lines changed: 39 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,13 @@ metadata:
6464
name: imperative-sa
6565
namespace: imperative
6666
---
67+
# Source: clustergroup/templates/imperative/serviceaccount.yaml
68+
apiVersion: v1
69+
kind: ServiceAccount
70+
metadata:
71+
name: imperative-admin-sa
72+
namespace: imperative
73+
---
6774
# Source: clustergroup/templates/imperative/configmap.yaml
6875
apiVersion: v1
6976
kind: ConfigMap
@@ -116,6 +123,9 @@ data:
116123
initContainers: []
117124
imperative:
118125
activeDeadlineSeconds: 3600
126+
adminClusterRoleName: imperative-admin-cluster-role
127+
adminServiceAccountCreate: true
128+
adminServiceAccountName: imperative-admin-sa
119129
clusterRoleName: imperative-cluster-role
120130
clusterRoleYaml: ""
121131
cronJobName: imperative-cronjob
@@ -264,11 +274,24 @@ rules:
264274
- list
265275
- watch
266276
---
277+
# Source: clustergroup/templates/imperative/clusterrole.yaml
278+
apiVersion: rbac.authorization.k8s.io/v1
279+
kind: ClusterRole
280+
metadata:
281+
name: imperative-admin-cluster-role
282+
rules:
283+
- apiGroups:
284+
- '*'
285+
resources:
286+
- '*'
287+
verbs:
288+
- '*'
289+
---
267290
# Source: clustergroup/templates/imperative/rbac.yaml
268291
apiVersion: rbac.authorization.k8s.io/v1
269292
kind: ClusterRoleBinding
270293
metadata:
271-
name: imperative-cluster-admin-rolebinding
294+
name: imperative-cluster-rolebinding
272295
roleRef:
273296
apiGroup: rbac.authorization.k8s.io
274297
kind: ClusterRole
@@ -278,6 +301,20 @@ subjects:
278301
name: imperative-sa
279302
namespace: imperative
280303
---
304+
# Source: clustergroup/templates/imperative/rbac.yaml
305+
apiVersion: rbac.authorization.k8s.io/v1
306+
kind: ClusterRoleBinding
307+
metadata:
308+
name: imperative-admin-clusterrolebinding
309+
roleRef:
310+
apiGroup: rbac.authorization.k8s.io
311+
kind: ClusterRole
312+
name: imperative-admin-cluster-role
313+
subjects:
314+
- kind: ServiceAccount
315+
name: imperative-admin-sa
316+
namespace: imperative
317+
---
281318
# Source: clustergroup/templates/plumbing/argocd-super-role.yaml
282319
# WARNING: ONLY USE THIS FOR MANAGING CLUSTERS NOT FOR REGULAR USERS
283320
apiVersion: rbac.authorization.k8s.io/v1
@@ -340,7 +377,7 @@ rules:
340377
apiVersion: rbac.authorization.k8s.io/v1
341378
kind: RoleBinding
342379
metadata:
343-
name: imperative-admin-rolebinding
380+
name: imperative-rolebinding
344381
namespace: imperative
345382
roleRef:
346383
apiGroup: rbac.authorization.k8s.io

‎tests/clustergroup-industrial-edge-hub.expected.yaml‎

Lines changed: 39 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -109,6 +109,13 @@ metadata:
109109
name: imperative-sa
110110
namespace: imperative
111111
---
112+
# Source: clustergroup/templates/imperative/serviceaccount.yaml
113+
apiVersion: v1
114+
kind: ServiceAccount
115+
metadata:
116+
name: imperative-admin-sa
117+
namespace: imperative
118+
---
112119
# Source: clustergroup/templates/imperative/configmap.yaml
113120
apiVersion: v1
114121
kind: ConfigMap
@@ -237,6 +244,9 @@ data:
237244
initContainers: []
238245
imperative:
239246
activeDeadlineSeconds: 3600
247+
adminClusterRoleName: imperative-admin-cluster-role
248+
adminServiceAccountCreate: true
249+
adminServiceAccountName: imperative-admin-sa
240250
clusterRoleName: imperative-cluster-role
241251
clusterRoleYaml: ""
242252
cronJobName: imperative-cronjob
@@ -425,11 +435,24 @@ rules:
425435
- list
426436
- watch
427437
---
438+
# Source: clustergroup/templates/imperative/clusterrole.yaml
439+
apiVersion: rbac.authorization.k8s.io/v1
440+
kind: ClusterRole
441+
metadata:
442+
name: imperative-admin-cluster-role
443+
rules:
444+
- apiGroups:
445+
- '*'
446+
resources:
447+
- '*'
448+
verbs:
449+
- '*'
450+
---
428451
# Source: clustergroup/templates/imperative/rbac.yaml
429452
apiVersion: rbac.authorization.k8s.io/v1
430453
kind: ClusterRoleBinding
431454
metadata:
432-
name: imperative-cluster-admin-rolebinding
455+
name: imperative-cluster-rolebinding
433456
roleRef:
434457
apiGroup: rbac.authorization.k8s.io
435458
kind: ClusterRole
@@ -439,6 +462,20 @@ subjects:
439462
name: imperative-sa
440463
namespace: imperative
441464
---
465+
# Source: clustergroup/templates/imperative/rbac.yaml
466+
apiVersion: rbac.authorization.k8s.io/v1
467+
kind: ClusterRoleBinding
468+
metadata:
469+
name: imperative-admin-clusterrolebinding
470+
roleRef:
471+
apiGroup: rbac.authorization.k8s.io
472+
kind: ClusterRole
473+
name: imperative-admin-cluster-role
474+
subjects:
475+
- kind: ServiceAccount
476+
name: imperative-admin-sa
477+
namespace: imperative
478+
---
442479
# Source: clustergroup/templates/plumbing/argocd-super-role.yaml
443480
# WARNING: ONLY USE THIS FOR MANAGING CLUSTERS NOT FOR REGULAR USERS
444481
apiVersion: rbac.authorization.k8s.io/v1
@@ -501,7 +538,7 @@ rules:
501538
apiVersion: rbac.authorization.k8s.io/v1
502539
kind: RoleBinding
503540
metadata:
504-
name: imperative-admin-rolebinding
541+
name: imperative-rolebinding
505542
namespace: imperative
506543
roleRef:
507544
apiGroup: rbac.authorization.k8s.io

‎tests/clustergroup-medical-diagnosis-hub.expected.yaml‎

Lines changed: 39 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -109,6 +109,13 @@ metadata:
109109
name: imperative-sa
110110
namespace: imperative
111111
---
112+
# Source: clustergroup/templates/imperative/serviceaccount.yaml
113+
apiVersion: v1
114+
kind: ServiceAccount
115+
metadata:
116+
name: imperative-admin-sa
117+
namespace: imperative
118+
---
112119
# Source: clustergroup/templates/imperative/configmap.yaml
113120
apiVersion: v1
114121
kind: ConfigMap
@@ -220,6 +227,9 @@ data:
220227
initContainers: []
221228
imperative:
222229
activeDeadlineSeconds: 3600
230+
adminClusterRoleName: imperative-admin-cluster-role
231+
adminServiceAccountCreate: true
232+
adminServiceAccountName: imperative-admin-sa
223233
clusterRoleName: imperative-cluster-role
224234
clusterRoleYaml: ""
225235
cronJobName: imperative-cronjob
@@ -352,11 +362,24 @@ rules:
352362
- list
353363
- watch
354364
---
365+
# Source: clustergroup/templates/imperative/clusterrole.yaml
366+
apiVersion: rbac.authorization.k8s.io/v1
367+
kind: ClusterRole
368+
metadata:
369+
name: imperative-admin-cluster-role
370+
rules:
371+
- apiGroups:
372+
- '*'
373+
resources:
374+
- '*'
375+
verbs:
376+
- '*'
377+
---
355378
# Source: clustergroup/templates/imperative/rbac.yaml
356379
apiVersion: rbac.authorization.k8s.io/v1
357380
kind: ClusterRoleBinding
358381
metadata:
359-
name: imperative-cluster-admin-rolebinding
382+
name: imperative-cluster-rolebinding
360383
roleRef:
361384
apiGroup: rbac.authorization.k8s.io
362385
kind: ClusterRole
@@ -366,6 +389,20 @@ subjects:
366389
name: imperative-sa
367390
namespace: imperative
368391
---
392+
# Source: clustergroup/templates/imperative/rbac.yaml
393+
apiVersion: rbac.authorization.k8s.io/v1
394+
kind: ClusterRoleBinding
395+
metadata:
396+
name: imperative-admin-clusterrolebinding
397+
roleRef:
398+
apiGroup: rbac.authorization.k8s.io
399+
kind: ClusterRole
400+
name: imperative-admin-cluster-role
401+
subjects:
402+
- kind: ServiceAccount
403+
name: imperative-admin-sa
404+
namespace: imperative
405+
---
369406
# Source: clustergroup/templates/plumbing/argocd-super-role.yaml
370407
# WARNING: ONLY USE THIS FOR MANAGING CLUSTERS NOT FOR REGULAR USERS
371408
apiVersion: rbac.authorization.k8s.io/v1
@@ -428,7 +465,7 @@ rules:
428465
apiVersion: rbac.authorization.k8s.io/v1
429466
kind: RoleBinding
430467
metadata:
431-
name: imperative-admin-rolebinding
468+
name: imperative-rolebinding
432469
namespace: imperative
433470
roleRef:
434471
apiGroup: rbac.authorization.k8s.io

0 commit comments

Comments
 (0)