Skip to content

Commit 25b3693

Browse files
mkerkstramkerkstra
committed
feat(operator chart): add RBAC (ClusterRole/Binding, namespaced Role/Binding for leader election)
1 parent c737fa2 commit 25b3693

File tree

3 files changed

+211
-0
lines changed

3 files changed

+211
-0
lines changed

‎infra/charts/feast-operator/templates/clusterrole.yaml‎

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
{{- if .Values.rbac.create }}
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: ClusterRole
4+
metadata:
5+
name: {{ include "feast-operator.fullname" . }}-manager-role
6+
labels:
7+
{{- include "feast-operator.labels" . | nindent 4 }}
8+
{{- with (include "feast-operator.annotations" .) }}
9+
annotations:
10+
{{- . | nindent 4 }}
11+
{{- end }}
12+
rules:
13+
- apiGroups:
14+
- apps
15+
resources:
16+
- deployments
17+
verbs:
18+
- create
19+
- delete
20+
- get
21+
- list
22+
- update
23+
- watch
24+
- apiGroups:
25+
- batch
26+
resources:
27+
- cronjobs
28+
verbs:
29+
- create
30+
- delete
31+
- get
32+
- list
33+
- patch
34+
- update
35+
- watch
36+
- apiGroups:
37+
- ""
38+
resources:
39+
- configmaps
40+
- persistentvolumeclaims
41+
- serviceaccounts
42+
- services
43+
verbs:
44+
- create
45+
- delete
46+
- get
47+
- list
48+
- update
49+
- watch
50+
- apiGroups:
51+
- ""
52+
resources:
53+
- pods
54+
- secrets
55+
verbs:
56+
- get
57+
- list
58+
- apiGroups:
59+
- ""
60+
resources:
61+
- pods/exec
62+
verbs:
63+
- create
64+
- apiGroups:
65+
- feast.dev
66+
resources:
67+
- featurestores
68+
verbs:
69+
- create
70+
- delete
71+
- get
72+
- list
73+
- patch
74+
- update
75+
- watch
76+
- apiGroups:
77+
- feast.dev
78+
resources:
79+
- featurestores/finalizers
80+
verbs:
81+
- update
82+
- apiGroups:
83+
- feast.dev
84+
resources:
85+
- featurestores/status
86+
verbs:
87+
- get
88+
- patch
89+
- update
90+
- apiGroups:
91+
- rbac.authorization.k8s.io
92+
resources:
93+
- rolebindings
94+
- roles
95+
verbs:
96+
- create
97+
- delete
98+
- get
99+
- list
100+
- update
101+
- watch
102+
- apiGroups:
103+
- route.openshift.io
104+
resources:
105+
- routes
106+
verbs:
107+
- create
108+
- delete
109+
- get
110+
- list
111+
- update
112+
- watch
113+
{{- end }}
114+
---
115+
{{- if .Values.rbac.create }}
116+
apiVersion: rbac.authorization.k8s.io/v1
117+
kind: ClusterRole
118+
metadata:
119+
name: {{ include "feast-operator.fullname" . }}-metrics-auth-role
120+
labels:
121+
{{- include "feast-operator.labels" . | nindent 4 }}
122+
rules:
123+
- apiGroups:
124+
- authentication.k8s.io
125+
resources:
126+
- tokenreviews
127+
verbs:
128+
- create
129+
- apiGroups:
130+
- authorization.k8s.io
131+
resources:
132+
- subjectaccessreviews
133+
verbs:
134+
- create
135+
{{- end }}

‎infra/charts/feast-operator/templates/clusterrolebinding.yaml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
{{- if .Values.rbac.create }}
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: ClusterRoleBinding
4+
metadata:
5+
name: {{ include "feast-operator.fullname" . }}-manager-rolebinding
6+
labels:
7+
{{- include "feast-operator.labels" . | nindent 4 }}
8+
{{- with (include "feast-operator.annotations" .) }}
9+
annotations:
10+
{{- . | nindent 4 }}
11+
{{- end }}
12+
roleRef:
13+
apiGroup: rbac.authorization.k8s.io
14+
kind: ClusterRole
15+
name: {{ include "feast-operator.fullname" . }}-manager-role
16+
subjects:
17+
- kind: ServiceAccount
18+
name: {{ include "feast-operator.serviceAccountName" . }}
19+
namespace: {{ include "feast-operator.namespace" . }}
20+
{{- end }}
21+
---
22+
{{- if .Values.rbac.create }}
23+
apiVersion: rbac.authorization.k8s.io/v1
24+
kind: ClusterRoleBinding
25+
metadata:
26+
name: {{ include "feast-operator.fullname" . }}-metrics-auth-rolebinding
27+
labels:
28+
{{- include "feast-operator.labels" . | nindent 4 }}
29+
{{- with (include "feast-operator.annotations" .) }}
30+
annotations:
31+
{{- . | nindent 4 }}
32+
{{- end }}
33+
roleRef:
34+
apiGroup: rbac.authorization.k8s.io
35+
kind: ClusterRole
36+
name: {{ include "feast-operator.fullname" . }}-metrics-auth-role
37+
subjects:
38+
- kind: ServiceAccount
39+
name: {{ include "feast-operator.serviceAccountName" . }}
40+
namespace: {{ include "feast-operator.namespace" . }}
41+
{{- end }}

‎infra/charts/feast-operator/templates/role.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
{{- if .Values.rbac.create }}
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: Role
4+
metadata:
5+
name: {{ include "feast-operator.fullname" . }}-leader-election-role
6+
namespace: {{ include "feast-operator.namespace" . }}
7+
labels:
8+
{{- include "feast-operator.labels" . | nindent 4 }}
9+
rules:
10+
- apiGroups: [""]
11+
resources: ["configmaps"]
12+
verbs: ["get","list","watch","create","update","patch","delete"]
13+
- apiGroups: ["coordination.k8s.io"]
14+
resources: ["leases"]
15+
verbs: ["get","list","watch","create","update","patch","delete"]
16+
- apiGroups: [""]
17+
resources: ["events"]
18+
verbs: ["create","patch"]
19+
---
20+
apiVersion: rbac.authorization.k8s.io/v1
21+
kind: RoleBinding
22+
metadata:
23+
name: {{ include "feast-operator.fullname" . }}-leader-election-rolebinding
24+
namespace: {{ include "feast-operator.namespace" . }}
25+
labels:
26+
{{- include "feast-operator.labels" . | nindent 4 }}
27+
roleRef:
28+
apiGroup: rbac.authorization.k8s.io
29+
kind: Role
30+
name: {{ include "feast-operator.fullname" . }}-leader-election-role
31+
subjects:
32+
- kind: ServiceAccount
33+
name: {{ include "feast-operator.serviceAccountName" . }}
34+
namespace: {{ include "feast-operator.namespace" . }}
35+
{{- end }}

0 commit comments

Comments
 (0)