Skip to content

Commit 4dd3157

Browse files
illrillillrill
authored
feat(argo-rollouts): Added flags to toggle provider-specific RBAC (argoproj#1777)
* Toggle for provider-specific RBAC + Added missing RBAC rules Signed-off-by: Richard Johansson <[email protected]> * Updated docs with new Helm values Signed-off-by: Richard Johansson <[email protected]> * Added a general flag providerRBAC.enabled to toggle all of the providers Signed-off-by: Richard Johansson <[email protected]> * Aligned with main Signed-off-by: Richard Johansson <[email protected]> * Corrected inline comments Signed-off-by: Richard Johansson <[email protected]> * Fixed incorrect inline comments Signed-off-by: Richard Johansson <[email protected]> Signed-off-by: Richard Johansson <[email protected]>
1 parent 9905dcc commit 4dd3157

File tree

5 files changed

+68
-4
lines changed

5 files changed

+68
-4
lines changed

‎charts/argo-rollouts/Chart.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: v2
22
appVersion: v1.4.0
33
description: A Helm chart for Argo Rollouts
44
name: argo-rollouts
5-
version: 2.22.0
5+
version: 2.22.1
66
home: https://github.com/argoproj/argo-helm
77
icon: https://argoproj.github.io/argo-rollouts/assets/logo.png
88
keywords:
@@ -15,4 +15,4 @@ maintainers:
1515
url: https://argoproj.github.io/
1616
annotations:
1717
artifacthub.io/changes: |
18-
- "[Changed]: Upgrade ArgoRollouts to v1.4.0"
18+
- "[Added]: Flags to toggle provider-specific RBAC rules in Role and ClusterRole"

‎charts/argo-rollouts/README.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,14 @@ If dashboard is installed by `--set dashboard.enabled=true`, checkout the argo-r
5555
| notifications.secret.items | object | `{}` | Generic key:value pairs to be inserted into the notifications secret |
5656
| notifications.templates | object | `{}` | Notification templates |
5757
| notifications.triggers | object | `{}` | The trigger defines the condition when the notification should be sent |
58+
| providerRBAC.enabled | bool | `true` | Toggles addition of provider-specific RBAC rules to the controller Role and ClusterRole |
59+
| providerRBAC.providers.ambassador | bool | `true` | Adds RBAC rules for the Ambassador provider |
60+
| providerRBAC.providers.apisix | bool | `true` | Adds RBAC rules for the Apisix provider |
61+
| providerRBAC.providers.awsAppMesh | bool | `true` | Adds RBAC rules for the AWS App Mesh provider |
62+
| providerRBAC.providers.awsLoadBalancerController | bool | `true` | Adds RBAC rules for the AWS Load Balancer Controller provider |
63+
| providerRBAC.providers.istio | bool | `true` | Adds RBAC rules for the Istio provider |
64+
| providerRBAC.providers.smi | bool | `true` | Adds RBAC rules for the SMI provider |
65+
| providerRBAC.providers.traefik | bool | `true` | Adds RBAC rules for the Traefik provider |
5866

5967
### Controller
6068

‎charts/argo-rollouts/templates/controller/clusterrole.yaml‎

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -149,6 +149,8 @@ rules:
149149
- update
150150
- patch
151151
- delete
152+
{{- if .Values.providerRBAC.enabled }}
153+
{{- if .Values.providerRBAC.providers.istio }}
152154
# virtualservice/destinationrule access needed for using the Istio provider
153155
- apiGroups:
154156
- networking.istio.io
@@ -161,6 +163,8 @@ rules:
161163
- update
162164
- patch
163165
- list
166+
{{- end }}
167+
{{- if .Values.providerRBAC.providers.smi }}
164168
# trafficsplit access needed for using the SMI provider
165169
- apiGroups:
166170
- split.smi-spec.io
@@ -172,6 +176,8 @@ rules:
172176
- get
173177
- update
174178
- patch
179+
{{- end }}
180+
{{- if .Values.providerRBAC.providers.ambassador }}
175181
# ambassador access needed for Ambassador provider
176182
- apiGroups:
177183
- getambassador.io
@@ -186,7 +192,9 @@ rules:
186192
- update
187193
- list
188194
- delete
189-
# Endpoints and TargetGroupBindings needed for ALB target group verification
195+
{{- end }}
196+
{{- if .Values.providerRBAC.providers.awsLoadBalancerController }}
197+
# Endpoints and TargetGroupBindings needed for ALB target group verification when using AWS Load Balancer Controller
190198
- apiGroups:
191199
- ""
192200
resources:
@@ -200,6 +208,8 @@ rules:
200208
verbs:
201209
- list
202210
- get
211+
{{- end }}
212+
{{- if .Values.providerRBAC.providers.awsAppMesh }}
203213
# AppMesh virtualservices/virtualrouter CRD read-only access needed for using the App Mesh provider
204214
- apiGroups:
205215
- appmesh.k8s.aws
@@ -221,6 +231,9 @@ rules:
221231
- list
222232
- update
223233
- patch
234+
{{- end }}
235+
{{- if .Values.providerRBAC.providers.traefik }}
236+
# Traefik access needed when using the Traefik provider
224237
- apiGroups:
225238
- traefik.containo.us
226239
resources:
@@ -229,6 +242,9 @@ rules:
229242
- watch
230243
- get
231244
- update
245+
{{- end }}
246+
{{- if .Values.providerRBAC.providers.apisix }}
247+
# Access needed when using the Apisix provider
232248
- apiGroups:
233249
- apisix.apache.org
234250
resources:
@@ -238,3 +254,5 @@ rules:
238254
- get
239255
- update
240256
{{- end }}
257+
{{- end }}
258+
{{- end }}

‎charts/argo-rollouts/templates/controller/role.yaml‎

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -149,6 +149,8 @@ rules:
149149
- update
150150
- patch
151151
- delete
152+
{{- if .Values.providerRBAC.enabled }}
153+
{{- if .Values.providerRBAC.providers.istio }}
152154
# virtualservice/destinationrule access needed for using the Istio provider
153155
- apiGroups:
154156
- networking.istio.io
@@ -161,6 +163,8 @@ rules:
161163
- update
162164
- patch
163165
- list
166+
{{- end }}
167+
{{- if .Values.providerRBAC.providers.smi }}
164168
# trafficsplit access needed for using the SMI provider
165169
- apiGroups:
166170
- split.smi-spec.io
@@ -172,6 +176,8 @@ rules:
172176
- get
173177
- update
174178
- patch
179+
{{- end }}
180+
{{- if .Values.providerRBAC.providers.ambassador }}
175181
# ambassador access needed for Ambassador provider
176182
- apiGroups:
177183
- getambassador.io
@@ -186,7 +192,9 @@ rules:
186192
- update
187193
- list
188194
- delete
189-
# Endpoints and TargetGroupBindings needed for ALB target group verification
195+
{{- end }}
196+
{{- if .Values.providerRBAC.providers.awsLoadBalancerController }}
197+
# Endpoints and TargetGroupBindings needed for ALB target group verification when using AWS Load Balancer Controller
190198
- apiGroups:
191199
- ""
192200
resources:
@@ -200,6 +208,8 @@ rules:
200208
verbs:
201209
- list
202210
- get
211+
{{- end }}
212+
{{- if .Values.providerRBAC.providers.awsAppMesh }}
203213
# AppMesh virtualservices/virtualrouter CRD read-only access needed for using the App Mesh provider
204214
- apiGroups:
205215
- appmesh.k8s.aws
@@ -221,6 +231,9 @@ rules:
221231
- list
222232
- update
223233
- patch
234+
{{- end }}
235+
{{- if .Values.providerRBAC.providers.traefik }}
236+
# Traefik access needed when using the Traefik provider
224237
- apiGroups:
225238
- traefik.containo.us
226239
resources:
@@ -229,6 +242,9 @@ rules:
229242
- watch
230243
- get
231244
- update
245+
{{- end }}
246+
{{- if .Values.providerRBAC.providers.apisix }}
247+
# Access needed when using the Apisix provider
232248
- apiGroups:
233249
- apisix.apache.org
234250
resources:
@@ -238,3 +254,5 @@ rules:
238254
- get
239255
- update
240256
{{- end }}
257+
{{- end }}
258+
{{- end }}

‎charts/argo-rollouts/values.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -190,6 +190,26 @@ podLabels: {}
190190
imagePullSecrets: []
191191
# - name: argo-pull-secret
192192

193+
providerRBAC:
194+
# -- Toggles addition of provider-specific RBAC rules to the controller Role and ClusterRole
195+
enabled: true
196+
# providerRBAC.enabled must be true in order to toggle the individual providers
197+
providers:
198+
# -- Adds RBAC rules for the Istio provider
199+
istio: true
200+
# -- Adds RBAC rules for the SMI provider
201+
smi: true
202+
# -- Adds RBAC rules for the Ambassador provider
203+
ambassador: true
204+
# -- Adds RBAC rules for the AWS Load Balancer Controller provider
205+
awsLoadBalancerController: true
206+
# -- Adds RBAC rules for the AWS App Mesh provider
207+
awsAppMesh: true
208+
# -- Adds RBAC rules for the Traefik provider
209+
traefik: true
210+
# -- Adds RBAC rules for the Apisix provider
211+
apisix: true
212+
193213
dashboard:
194214
# -- Deploy dashboard server
195215
enabled: false

0 commit comments

Comments
 (0)