Skip to content

Remove role for Profile-CRD from chart #697

@ArcticXWolf

Description

@ArcticXWolf

Followup on #696.
Now that we can disable the creation of the CRDs in the helm chart, we can also move the creation of the roles for the Profiles CRD behind the toggle, as they are not needed if the CRD does not exist.

Expected Behaviour

If I disable the creation of the CRDs in the helm chart, I expect the chart to not create roles and role-bindings concerning the non-existing CRDs.

Current Behaviour

The chart creates the roles in all cases, if the CRDs are created or not.

Possible Solution

Wrap the following lines inside a {{- if .Values.createCRDs }} ... {{- end}} block:

- apiGroups:
- "openfaas.com"
resources:
- "profiles"
verbs:
- "get"
- "list"
- "watch"

---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: Role
metadata:
labels:
app: {{ template "openfaas.name" . }}
chart: {{ .Chart.Name }}-{{ .Chart.Version }}
component: faas-controller
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
name: {{ .Release.Name }}-profiles
namespace: {{ .Release.Namespace | quote }}
rules:
- apiGroups:
- "openfaas.com"
resources:
- "profiles"
verbs:
- "get"
- "list"
- "watch"

---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: RoleBinding
metadata:
labels:
app: {{ template "openfaas.name" . }}
chart: {{ .Chart.Name }}-{{ .Chart.Version }}
component: faas-controller
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
name: {{ .Release.Name }}-profiles
namespace: {{ .Release.Namespace | quote }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: {{ .Release.Name }}-profiles
subjects:
- kind: ServiceAccount
name: {{ .Release.Name }}-controller
namespace: {{ .Release.Namespace | quote }}

Context / Usecase

Without this change, users that have to skip creating the CRDs due to access rights might not be able to install the chart. For example I cannot create the role {{ .Release.Name }}-profiles and thus cannot install the chart.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions