Allow adding extra rules to the clusterrole

[jradtilbrook]

Is this a request for help?: Yes

---

Version of Helm and Kubernetes: N/A

Which chart: buildkite

What happened: Not enough or different clusterrole rules required

What you expected to happen: I have a use case that requires different clusterrole rules. I not that you can disable the creation of any RBAC in this chart. Is your intention that if a user needs something different they should create the role and binding separate to this chart? Or would you support breaking out the definition of rules to a helm variable so that users can define their own?

How to reproduce it (as minimally and precisely as possible): N/A

Anything else we need to know: N/A

[rimusz]

it can be done e.g. in values.yaml (hint for the PR):

rbac:
  create: true
  role:
    ## Rules to create. It follows the role specification
    rules:
    - apiGroups:
        - ""
        resources:
        - namespaces
        verbs:
        - watch
        - list
    - apiGroups:
        - ""
        resources:
        - secrets
        verbs:
        - get
        - watch
        - list
    - apiGroups:
        - ""
        - extensions
        - apps
        - batch
        resources:
        - pods
        - replicasets
        - replicationcontrollers
        - statefulsets
        - deployments
        - daemonsets
        - jobs
        - cronjobs
        verbs:
        - get
        - delete # required to delete pods during force upgrade of the same tag
        - watch
        - list
        - update
    - apiGroups:
        - ""
        resources:
        - configmaps
        - secrets
        verbs:
        - get
        - create
        - update

then in the clusterrole.yaml:

rules:
{{ toYaml .Values.rbac.role.rules }}

[jradtilbrook]

Cool! Does that mean you'd accept a PR to add that?

[rimusz]

of course :)

[loeffel-io]

how the holy can i add the value create to rbac.role.rules[2].verbs for example?