Skip to content

Commit 251894a

Browse files
ihcsimihcsim
authored
feat: add harvester/rancher integration rbac chart (#475)
Signed-off-by: Ivan Sim <ivan.sim@suse.com>
1 parent e191cb8 commit 251894a

File tree

9 files changed

+336
-0
lines changed

9 files changed

+336
-0
lines changed

‎charts/harvester-rbac/.helmignore‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎charts/harvester-rbac/Chart.yaml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
apiVersion: v2
2+
name: harvester-rbac
3+
description: A Helm chart for Harvester/Rancher integration RBAC
4+
5+
# A chart can be either an 'application' or a 'library' chart.
6+
#
7+
# Application charts are a collection of templates that can be packaged into versioned archives
8+
# to be deployed.
9+
#
10+
# Library charts provide useful utilities or functions for the chart developer. They're included as
11+
# a dependency of application charts to inject those utilities and functions into the rendering
12+
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
13+
type: application
14+
15+
# This is the chart version. This version number should be incremented each time you make changes
16+
# to the chart and its templates, including the app version.
17+
# Versions are expected to follow Semantic Versioning (https://semver.org/)
18+
version: 0.0.1-dev
19+
20+
# This is the version number of the application being deployed. This version number should be
21+
# incremented each time you make changes to the application. Versions are not expected to
22+
# follow Semantic Versioning. They should reflect the version the application is using.
23+
# It is recommended to use it with quotes.
24+
appVersion: v0.1.0
25+
26+
maintainers:
27+
- name: harvester
28+
29+
annotations:
30+
catalog.cattle.io/certified: rancher
31+
catalog.cattle.io/display-name: Harvester RBAC
32+
catalog.cattle.io/kube-version: ">= 1.31.0-0"
33+
catalog.cattle.io/rancher-version: ">= 2.13.0-0"
34+
catalog.cattle.io/release-name: harvester-rbac
35+
catalog.cattle.io/ui-component: harvester-rbac
36+
37+
kubeVersion: ">=1.31.0-0"

‎charts/harvester-rbac/templates/NOTES.txt‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
The following Harvester/Rancher integration RBAC role template resources have been installed:
2+
3+
* Manage Virtualization Resources (cluster scope)
4+
* View Virtualization Resources (cluster scope)
5+
* Manage Virtualization Resources (namespaced scope)
6+
* View Virtualization Resources (namespaced scope)
7+
8+
They can be found in the "Cluster" and "Project/Namespace" sections of the "Role Template" page.
9+
10+
For more information, see https://docs.harvesterhci.io/latest/rancher/rancher-rbac

‎charts/harvester-rbac/templates/_helpers.tpl‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
{{/*
2+
Expand the name of the chart.
3+
*/}}
4+
{{- define "harvester-rbac.name" -}}
5+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
6+
{{- end }}
7+
8+
{{/*
9+
Create a default fully qualified app name.
10+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
11+
If release name contains chart name it will be used as a full name.
12+
*/}}
13+
{{- define "harvester-rbac.fullname" -}}
14+
{{- if .Values.fullnameOverride }}
15+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
16+
{{- else }}
17+
{{- $name := default .Chart.Name .Values.nameOverride }}
18+
{{- if contains $name .Release.Name }}
19+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
20+
{{- else }}
21+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
22+
{{- end }}
23+
{{- end }}
24+
{{- end }}
25+
26+
{{/*
27+
Create chart name and version as used by the chart label.
28+
*/}}
29+
{{- define "harvester-rbac.chart" -}}
30+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
31+
{{- end }}
32+
33+
{{/*
34+
Common labels
35+
*/}}
36+
{{- define "harvester-rbac.labels" -}}
37+
helm.sh/chart: {{ include "harvester-rbac.chart" . }}
38+
{{ include "harvester-rbac.selectorLabels" . }}
39+
{{- if .Chart.AppVersion }}
40+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
41+
{{- end }}
42+
app.kubernetes.io/managed-by: {{ .Release.Service }}
43+
{{- end }}
44+
45+
{{/*
46+
Selector labels
47+
*/}}
48+
{{- define "harvester-rbac.selectorLabels" -}}
49+
app.kubernetes.io/name: {{ include "harvester-rbac.name" . }}
50+
app.kubernetes.io/instance: {{ .Release.Name }}
51+
{{- end }}

‎charts/harvester-rbac/templates/virt-cluster-manage.yaml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
apiVersion: management.cattle.io/v3
2+
builtin: false
3+
context: cluster
4+
description: Provides management access to all resources in Harvester
5+
displayName: Manage Virtualization Resources
6+
external: false
7+
hidden: false
8+
kind: RoleTemplate
9+
metadata:
10+
labels:
11+
{{- include "harvester-rbac.labels" . | nindent 4 }}
12+
name: virt-cluster-manage
13+
roleTemplateNames:
14+
- monitoring-ui-view
15+
- cluster-member
16+
- storage-manage
17+
- nodes-manage
18+
- projects-view
19+
- edit
20+
- projectroletemplatebindings-manage
21+
- project-member
22+
rules:
23+
- apiGroups:
24+
- ""
25+
resources:
26+
- namespaces
27+
verbs:
28+
- "*"
29+
- apiGroups:
30+
- loadbalancer.harvesterhci.io
31+
resources:
32+
- "*"
33+
verbs:
34+
- "*"
35+
- apiGroups:
36+
- network.harvesterhci.io
37+
resources:
38+
- "*"
39+
verbs:
40+
- "*"
41+
- apiGroups:
42+
- node.harvesterhci.io
43+
resources:
44+
- "*"
45+
verbs:
46+
- "*"
47+
- apiGroups:
48+
- devices.harvesterhci.io
49+
resources:
50+
- "*"
51+
verbs:
52+
- "*"
53+
- apiGroups:
54+
- harvesterhci.io
55+
resources:
56+
- "*"
57+
verbs:
58+
- "*"
59+
{{- with .Values.clusterRole.virtClusterManage.additionalRules }}
60+
{{- toYaml . | nindent 2 }}
61+
{{- end }}

‎charts/harvester-rbac/templates/virt-cluster-view.yaml‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
apiVersion: management.cattle.io/v3
2+
builtin: false
3+
context: cluster
4+
description: Provides view-only access to all resources in Harvester
5+
displayName: View Virtualization Resources
6+
external: false
7+
hidden: false
8+
kind: RoleTemplate
9+
metadata:
10+
labels:
11+
{{- include "harvester-rbac.labels" . | nindent 4 }}
12+
name: virt-view-cluster
13+
roleTemplateNames:
14+
- projects-view
15+
- monitoring-ui-view
16+
- clusterroletemplatebindings-view
17+
- nodes-view
18+
rules:
19+
- apiGroups:
20+
- harvesterhci.io
21+
resources:
22+
- supportbundles
23+
verbs:
24+
- "*"
25+
- apiGroups:
26+
- network.harvesterhci.io
27+
resources:
28+
- "*"
29+
verbs:
30+
- get
31+
- list
32+
- watch
33+
- apiGroups:
34+
- loadbalancer.harvesterhci.io
35+
resources:
36+
- "*"
37+
verbs:
38+
- get
39+
- list
40+
- watch
41+
- apiGroups:
42+
- devices.harvesterhci.io
43+
resources:
44+
- "*"
45+
verbs:
46+
- get
47+
- list
48+
- watch
49+
- apiGroups:
50+
- node.harvesterhci.io
51+
resources:
52+
- "*"
53+
verbs:
54+
- get
55+
- list
56+
- watch
57+
- apiGroups:
58+
- harvesterhci.io
59+
resources:
60+
- "*"
61+
verbs:
62+
- get
63+
- list
64+
- watch
65+
- apiGroups:
66+
- harvesterhci.io
67+
resources:
68+
- settings
69+
verbs:
70+
- get
71+
- list
72+
- watch
73+
- create
74+
{{- with .Values.clusterRole.virtClusterView.additionalRules }}
75+
{{- toYaml . | nindent 2 }}
76+
{{- end }}

‎charts/harvester-rbac/templates/virt-project-manage.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
apiVersion: management.cattle.io/v3
2+
builtin: false
3+
context: project
4+
description: Provides management access to projects in Harvester
5+
displayName: Manage Virtualization Resources
6+
external: false
7+
hidden: false
8+
kind: RoleTemplate
9+
metadata:
10+
labels:
11+
{{- include "harvester-rbac.labels" . | nindent 4 }}
12+
name: virt-project-manage
13+
roleTemplateNames:
14+
- project-member
15+
- monitoring-ui-view
16+
rules:
17+
- apiGroups:
18+
- loadbalancer.harvesterhci.io
19+
resources:
20+
- "*"
21+
verbs:
22+
- "*"
23+
{{- with .Values.projectRole.virtProjectManage.additionalRules }}
24+
{{- toYaml . | nindent 2 }}
25+
{{- end }}

‎charts/harvester-rbac/templates/virt-project-view.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
apiVersion: management.cattle.io/v3
2+
builtin: false
3+
context: project
4+
displayName: View Virtualization Resources
5+
external: false
6+
hidden: false
7+
kind: RoleTemplate
8+
metadata:
9+
labels:
10+
{{- include "harvester-rbac.labels" . | nindent 4 }}
11+
name: virt-project-view
12+
roleTemplateNames:
13+
- read-only
14+
- monitoring-ui-view
15+
rules:
16+
- apiGroups:
17+
- loadbalancer.harvesterhci.io
18+
resources:
19+
- "*"
20+
verbs:
21+
- get
22+
- list
23+
- watch
24+
{{- with .Values.projectRole.virtProjectView.additionalRules }}
25+
{{- toYaml . | nindent 2 }}
26+
{{- end }}

‎charts/harvester-rbac/values.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Default values for harvester-rbac.
2+
# This is a YAML-formatted file.
3+
# Declare variables to be passed into your templates.
4+
5+
clusterRole:
6+
virtClusterManage:
7+
additionalRules:
8+
# - apiGroups: [""]
9+
# resources: [""]
10+
# verbs: [""]
11+
virtClusterView:
12+
additionalRules:
13+
# - apiGroups: [""]
14+
# resources: [""]
15+
# verbs: [""]
16+
17+
projectRole:
18+
virtProjectManage:
19+
additionalRules:
20+
# - apiGroups: [""]
21+
# resources: [""]
22+
# verbs: [""]
23+
virtProjectView:
24+
additionalRules:
25+
# - apiGroups: [""]
26+
# resources: [""]
27+
# verbs: [""]

0 commit comments

Comments
 (0)