[bitnami/kubernetes-event-exporter] feat: configurable cluster role rules (#20875)

* [bitnami/kubernetes-event-exporter] feat: allow cluster role rules to be configured

The cluster role template contains a hardcoded catchall rule which is too broad. Allow the cluster
role rules to be overridden by the user with a default value that follows the principle of least
privilege. I tested this by:

- applying this rule in my own cluster and observing the kubernetes-event-exporter logs to ensure
there were no permissions errors thrown
- running `helm template -g . --debug` in the chart dir and observing the output

Signed-off-by: Gregory Whorley <greg@whorley.com>

* bump chart version

Signed-off-by: Gregory Whorley <greg@whorley.com>

* fix param

Signed-off-by: Gregory Whorley <greg@whorley.com>

* Update README.md with readme-generator-for-helm

Signed-off-by: Bitnami Containers <bitnami-bot@vmware.com>

* change permissions back to original setting

Signed-off-by: Gregory Whorley <greg@whorley.com>

---------

Signed-off-by: Gregory Whorley <greg@whorley.com>
Signed-off-by: Bitnami Containers <bitnami-bot@vmware.com>
Signed-off-by: Juan José Martos <jotamartos@gmail.com>
Co-authored-by: Bitnami Containers <bitnami-bot@vmware.com>
Co-authored-by: Juan José Martos <jotamartos@gmail.com>

Author: 3 people

bitnami/kubernetes-event-exporter/Chart.yaml

@@ -31,4 +31,4 @@ maintainers:
 name: kubernetes-event-exporter
 sources:
 - https://github.com/bitnami/charts/tree/main/bitnami/kubernetes-event-exporter
-version: 2.8.3
+version: 2.9.0

bitnami/kubernetes-event-exporter/README.md

@@ -93,6 +93,7 @@ The command removes all the Kubernetes components associated with the chart and
 | `config.receivers`                                  | Array containing event receivers                                                                                          | `[]`                                        |
 | `config.route.routes`                               | Array containing event route configuration                                                                                | `[]`                                        |
 | `rbac.create`                                       | Create the RBAC roles for API accessibility                                                                               | `true`                                      |
+| `rbac.rules`                                        | List of rules for the cluster role                                                                                        | `[]`                                        |
 | `serviceAccount.create`                             | Specifies whether a ServiceAccount should be created                                                                      | `true`                                      |
 | `serviceAccount.name`                               | Name of the service account to use. If not set and create is true, a name is generated using the fullname template.       | `""`                                        |
 | `serviceAccount.automountServiceAccountToken`       | Automount service account token for the server service account                                                            | `true`                                      |

bitnami/kubernetes-event-exporter/templates/clusterrole.yaml

@@ -13,7 +13,7 @@ metadata:
   annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
   {{- end }}
 rules:
-  - apiGroups: ["*"]
-    resources: ["*"]
-    verbs: ["get", "watch", "list"]
+{{- range .Values.rbac.rules }}
+  - {{ toYaml . | indent 4 | trim }}
+{{- end }}
 {{- end }}

bitnami/kubernetes-event-exporter/values.yaml

@@ -133,6 +133,12 @@ rbac:
   ## @param rbac.create Create the RBAC roles for API accessibility
   ##
   create: true
+  ## @param rbac.rules [array] List of rules for the cluster role
+  ##
+  rules:
+    - apiGroups: ["*"]
+      resources: ["*"]
+      verbs: ["get", "watch", "list"]
 ## Pods Service Account
 ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
 ## @param serviceAccount.create Specifies whether a ServiceAccount should be created