update to watch namespaces & use comma separated list

deploy/chart/ingressmonitorcontroller/README.md

@@ -28,7 +28,7 @@ helm install stakater/ingressmonitorcontroller
 | Key | Default | Description |
 |-----|---------|-------------|
 | global.labels | `` | Labels to be added to all components |
-| watchNamespace | `` | Whether to watch any single namespace, set empty to watch all namespaces |
+| watchNamespaces | `` | comma separated namespace names, set empty to watch all namespaces |
 | useFullName | `false` |  |
 | deployment.annotations | `"configmap.reloader.stakater.com/reload": "ingressmonitorcontroller"` |  Additional annotations on deployment |
 | deployment.labels | `` | Additional labels on deployment |

deploy/chart/ingressmonitorcontroller/templates/clusterrole.yaml

@@ -1,4 +1,4 @@
-{{- if and ( .Values.rbac.create ) (eq .Values.watchNamespace "") }}
+{{- if and ( .Values.rbac.create ) (eq .Values.watchNamespaces "") }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
@@ -41,7 +41,8 @@ rules:
   - replicasets
   - statefulsets
   verbs:
-  - "*"
+  - "list"
+  - "get"
 - apiGroups:
   - monitoring.coreos.com
   resources:

deploy/chart/ingressmonitorcontroller/templates/clusterrolebinding.yaml

@@ -1,4 +1,4 @@
-{{- if and ( .Values.rbac.create ) (eq .Values.watchNamespace "") }}
+{{- if and ( .Values.rbac.create ) (eq .Values.watchNamespaces "") }}
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:

deploy/chart/ingressmonitorcontroller/templates/deployment.yaml

@@ -31,8 +31,8 @@ spec:
       containers:
       - env:
         - name: WATCH_NAMESPACE
-        {{- if .Values.watchNamespace }}
-          value: {{ .Values.watchNamespace | quote }}
+        {{- if .Values.watchNamespaces }}
+          value: {{ .Values.watchNamespaces | quote }}
         {{- else }}
           valueFrom:
             fieldRef:

deploy/chart/ingressmonitorcontroller/templates/role.yaml

@@ -1,8 +1,10 @@
-{{- if and ( .Values.rbac.create ) ( ne .Values.watchNamespace "") }}
+{{- if and ( .Values.rbac.create ) ( ne .Values.watchNamespaces "") }}
+{{- range .Values.watchNamespaces | split "," }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
-  name: {{ template "name" . }}-role
+  name: {{ template "name" $ }}-role
+  namespace: {{ . | quote }}
   labels:
 {{ include "labels" $ | indent 4 }}
 rules:
@@ -41,7 +43,8 @@ rules:
   - replicasets
   - statefulsets
   verbs:
-  - "*"
+  - "list"
+  - "get"
 - apiGroups:
   - monitoring.coreos.com
   resources:
@@ -78,4 +81,6 @@ rules:
   - patch
   - update
   - watch
+---
+{{- end }}
 {{- end }}

deploy/chart/ingressmonitorcontroller/templates/rolebinding.yaml

@@ -1,17 +1,21 @@
-{{- if and ( .Values.rbac.create ) (ne .Values.watchNamespace "") }}
+{{- if and ( .Values.rbac.create ) (ne .Values.watchNamespaces "") }}
+{{- range .Values.watchNamespaces | split "," }}
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: {{ template "name" . }}-role-binding
+  name: {{ template "name" $ }}-role-binding
+  namespace: {{ . | quote }}
   labels:
 {{ include "labels" $ | indent 4 }}
 roleRef:
   kind: Role
-  name: {{ template "name" . }}-role
+  name: {{ template "name" $ }}-role
   apiGroup: rbac.authorization.k8s.io
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ . | quote }}
 subjects:
 - kind: ServiceAccount
-  name: {{ template "serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
+  name: {{ template "serviceAccountName" $ }}
+  namespace: {{ $.Release.Namespace }}
+---
+{{- end }}
 {{- end }}

deploy/chart/ingressmonitorcontroller/values.yaml

@@ -2,10 +2,9 @@ global:
 # labels added on all components of chart in addition to some default labels
   labels: {}
 
+# can have comma separated namespace names
 # if empty, IMC will look in all namespaces, 
-# you can restrict to single namespace
-# if setting this, you need to deploy IMC also in that namespace
-watchNamespace: ""
+watchNamespaces: ""
 useFullName: false
 deployment:
   labels: {}