RBAC for pre-install hook

ci/build.sh

@@ -76,7 +76,7 @@ if [ "$TRAVIS_BRANCH" != "master" ] && [ "$TRAVIS_EVENT_TYPE" == "push" ] && [ -
   sudo helm dependency update
   cd ../../../
 
-  with_files=`ls deploy/helm/sumologic/templates/*.yaml  | grep -v "setup-job.yaml" | sed 's#deploy/helm/sumologic/templates#-x templates#g' | sed 's/yaml/yaml \\\/g'`
+  with_files=`ls deploy/helm/sumologic/templates/*.yaml  | grep -v "setup-*.yaml" | sed 's#deploy/helm/sumologic/templates#-x templates#g' | sed 's/yaml/yaml \\\/g'`
   eval 'sudo helm template deploy/helm/sumologic $with_files --namespace "\$NAMESPACE" --name collection --set dryRun=true >> deploy/kubernetes/fluentd-sumologic.yaml.tmpl --set sumologic.endpoint="bogus" --set sumologic.accessId="bogus" --set sumologic.accessKey="bogus"'
 
   if [[ $(git diff deploy/kubernetes/fluentd-sumologic.yaml.tmpl) ]]; then

deploy/helm/sumologic/templates/setup/setup-clusterrole.yaml

@@ -0,0 +1,19 @@
+{{- if .Values.sumologic.setupEnabled }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name:  {{ template "sumologic.fullname" . }}-setup
+  annotations:
+    "helm.sh/hook": pre-install
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+  labels:
+    app: {{ template "sumologic.labels.app" . }}
+    {{ template "sumologic.labels.common" . }}
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+      - namespaces
+    verbs: ["get", "create", "describe"]
+{{- end }}

deploy/helm/sumologic/templates/setup/setup-clusterrolebinding.yaml

@@ -0,0 +1,21 @@
+{{- if .Values.sumologic.setupEnabled }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name:  {{ template "sumologic.fullname" . }}-setup
+  annotations:
+    "helm.sh/hook": pre-install
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+  labels:
+    app: {{ template "sumologic.labels.app" . }}
+    {{ template "sumologic.labels.common" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "sumologic.fullname" . }}-setup
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "sumologic.fullname" . }}-setup
+    namespace: {{ .Release.Namespace }}
+
+{{- end }}

deploy/helm/sumologic/templates/setup-job.yaml → deploy/helm/sumologic/templates/setup/setup-job.yaml

@@ -2,7 +2,7 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: {{ include "sumologic.fullname" . }}-init
+  name: {{ template "sumologic.fullname" . }}-setup
   namespace: {{ .Release.Namespace }}
   annotations:
     "helm.sh/hook": pre-install
@@ -14,6 +14,7 @@ spec:
   template:
     spec:
       restartPolicy: OnFailure
+      serviceAccountName: {{ template "sumologic.fullname" . }}-setup
       containers:
       - name: setup
         image: {{ .Values.image.repository }}:{{ .Values.image.tag }}

deploy/helm/sumologic/templates/setup/setup-serviceaccount.yaml

@@ -0,0 +1,12 @@
+{{- if .Values.sumologic.setupEnabled }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name:  {{ template "sumologic.fullname" . }}-setup
+  annotations:
+    "helm.sh/hook": pre-install
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+  labels:
+    app: {{ template "sumologic.labels.app" . }}
+    {{ template "sumologic.labels.common" . }}
+{{- end }}