Add Istio permissions to cluster role

[haines]

Description

Add the permissions shown here to the cluster role created by the Helm chart, so that it can work with Istio.

Checklist

• Unit tests updated
• End user documentation updated

[agilgur5]

Bitnami's chart has this config for Istio as well as ones for other CRs

[tariq1890]

yes this would be a great addition to the repo. Requesting your attention on this @Raffo

[haines]

@njuettner could you please take a look?

[sekka1]

I need this as well. Can a maintainer review this?

[sekka1]

/assign @Raffo

[haines]

@njuettner could you please take a look?

[haines]

/assign @stevehipwell

[haines]

/unassign @Raffo

[stevehipwell]

@haines this is a great bug fix. I'll be using it myself once it's been merged, you've probably saved me having to figure out why this chart wouldn't work with Istio (I only have it in non-Istio clusters).

I think that these RBAC rules should be conditionally created, and as we already have the information in the sources value this would be my preference. Please see suggestions.

[haines]

Thanks for the suggestions @stevehipwell! I've applied them now.

I particularly like the conditional creation of RBAC rules - no need to grant unused permissions. Should this also be applied to the other sources that already have permissions in the cluster role (services, ingresses, pods, and nodes)? I can do this as part of this PR, or create a follow-up if you would prefer.

[stevehipwell]

/assign @Raffo

[haines]

@stevehipwell now that you're an approver in the chart owners file, are you able to merge this?

[stevehipwell]

/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: agilgur5, haines, stevehipwell

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• charts/OWNERS [stevehipwell]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[stevehipwell]

@Raffo could you do the lgtm when this finishes CI?

[Raffo]

/lgtm

[stevehipwell]

@Raffo the chart release action failed again due to gh-pages being protected. What's the protected status of the gh-pages branch currently set to? If possible could you paste images here? I'll add a comment below with the manual changes to make to gh-pages once the protection issue has been sorted out.

[stevehipwell]

@Raffo the item to be appended to entries.external-dns is below and the new value for generated should be "2021-11-03T11:40:00.848784158Z".

  - annotations:
      artifacthub.io/changes: |
        - kind: changed
          description: "Update image to v0.10.1"
    apiVersion: v2
    appVersion: 0.10.1
    description: ExternalDNS synchronizes exposed Kubernetes Services and Ingresses with
      DNS providers.
    home: https://github.com/kubernetes-sigs/external-dns/
    icon: https://github.com/kubernetes-sigs/external-dns/raw/master/img/external-dns.png
    keywords:
    - kubernetes
    - external-dns
    - dns
    maintainers:
    - email: steve.hipwell@gmail.com
      name: stevehipwell
    name: external-dns
    sources:
    - https://github.com/kubernetes-sigs/external-dns/
    type: application
    urls:
    - https://github.com/kubernetes-sigs/external-dns/releases/download/external-dns-helm-chart-1.4.1/external-dns-1.4.1.tgz
    version: 1.4.1

[Raffo]

@stevehipwell

I removed that check multiple times and left literally no protection. I believe there is some job that sets it, likely the jobs owned by the kubernetes-sigs org. Can you try reaching out in the CNCF slack to see if we can get that removed for that particular branch?

I will do the manual edit in the meantime.

[stevehipwell]

@Raffo do you have a suggestion for channel?

[Raffo]

@stevehipwell I would try github-management or kubernetes-contributor, unsure if there are better channels.

[stevehipwell]

@Raffo kubernetes/test-infra#24222 should fix the issue, but the protection might need manually removing after it's been merged.

[stevehipwell]

@Raffo I don't think you added the release entry to index.yaml and just modified the timestamp. Could you add the entry and bump the timestamp and see if that publishes the chart?

[Raffo]

@stevehipwell the entry you posted seems the same to one that's already there?

[stevehipwell]

@Raffo it's similar but version and urls are different. I forgot to ask @haines to update the annotations for this PR, but it looks like he's picked up on this for his latest PR.

[Raffo]

@stevehipwell oh sorry, I didn't see the diff, I can add it then.

[stevehipwell]

@Raffo no worries, hopefully this will be the last time!

[Raffo]

Done!

[stevehipwell]

@Raffo I can confirm that the chart is now published.