Skip to content

Commit 7ba83bf

Browse files
ian-floresian-flores
committed
fix: restore missing RBAC Role, cert-manager, and metrics templates
Address review findings from helm/v2-alpha migration: - Add namespace-scoped Role with all operator permissions to manager-role.yaml (was dropped by v2-alpha plugin) - Fix volumeMounts placement in manager.yaml (was incorrectly nested inside securityContext else branch) - Restore cert-manager Issuer and Certificate templates for webhook and metrics TLS - Restore metrics Service template for Prometheus scraping - Improve post-generate script robustness for volumeMounts insertion
1 parent a788543 commit 7ba83bf

File tree

5 files changed

+551
-40
lines changed

5 files changed

+551
-40
lines changed

‎dist/chart/templates/certmanager/certificate.yaml‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{{- if .Values.certManager.enable }}
2+
# Self-signed Issuer
3+
apiVersion: cert-manager.io/v1
4+
kind: Issuer
5+
metadata:
6+
labels:
7+
app.kubernetes.io/component: certmanager
8+
app.kubernetes.io/created-by: team-operator
9+
app.kubernetes.io/managed-by: {{ .Release.Service }}
10+
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
11+
app.kubernetes.io/part-of: team-operator
12+
name: {{ include "team-operator.resourceName" (dict "suffix" "selfsigned-issuer" "context" $) }}
13+
namespace: {{ .Release.Namespace }}
14+
spec:
15+
selfSigned: {}
16+
---
17+
# Certificate for the webhook
18+
apiVersion: cert-manager.io/v1
19+
kind: Certificate
20+
metadata:
21+
annotations:
22+
{{- if .Values.crd.keep }}
23+
"helm.sh/resource-policy": keep
24+
{{- end }}
25+
labels:
26+
app.kubernetes.io/component: certmanager
27+
app.kubernetes.io/created-by: team-operator
28+
app.kubernetes.io/managed-by: {{ .Release.Service }}
29+
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
30+
app.kubernetes.io/part-of: team-operator
31+
name: {{ include "team-operator.resourceName" (dict "suffix" "serving-cert" "context" $) }}
32+
namespace: {{ .Release.Namespace }}
33+
spec:
34+
dnsNames:
35+
- {{ include "team-operator.resourceName" (dict "suffix" "webhook-service" "context" $) }}.{{ .Release.Namespace }}.svc
36+
- {{ include "team-operator.resourceName" (dict "suffix" "webhook-service" "context" $) }}.{{ .Release.Namespace }}.svc.cluster.local
37+
issuerRef:
38+
kind: Issuer
39+
name: {{ include "team-operator.resourceName" (dict "suffix" "selfsigned-issuer" "context" $) }}
40+
secretName: {{ include "team-operator.resourceName" (dict "suffix" "webhook-server-cert" "context" $) }}
41+
{{- if .Values.metrics.enable }}
42+
---
43+
# Certificate for the metrics
44+
apiVersion: cert-manager.io/v1
45+
kind: Certificate
46+
metadata:
47+
annotations:
48+
{{- if .Values.crd.keep }}
49+
"helm.sh/resource-policy": keep
50+
{{- end }}
51+
labels:
52+
app.kubernetes.io/component: certmanager
53+
app.kubernetes.io/created-by: team-operator
54+
app.kubernetes.io/managed-by: {{ .Release.Service }}
55+
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
56+
app.kubernetes.io/part-of: team-operator
57+
name: {{ include "team-operator.resourceName" (dict "suffix" "metrics-certs" "context" $) }}
58+
namespace: {{ .Release.Namespace }}
59+
spec:
60+
dnsNames:
61+
- {{ include "team-operator.resourceName" (dict "suffix" "metrics-service" "context" $) }}.{{ .Release.Namespace }}.svc
62+
- {{ include "team-operator.resourceName" (dict "suffix" "metrics-service" "context" $) }}.{{ .Release.Namespace }}.svc.cluster.local
63+
issuerRef:
64+
kind: Issuer
65+
name: {{ include "team-operator.resourceName" (dict "suffix" "selfsigned-issuer" "context" $) }}
66+
secretName: {{ include "team-operator.resourceName" (dict "suffix" "metrics-server-cert" "context" $) }}
67+
{{- end }}
68+
{{- end }}

‎dist/chart/templates/manager/manager.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -82,13 +82,13 @@ spec:
8282
{{- toYaml .Values.manager.securityContext | nindent 20 }}
8383
{{- else }}
8484
{}
85+
{{- end }}
8586
{{- if .Values.certManager.enable }}
8687
volumeMounts:
8788
- mountPath: /tmp/k8s-webhook-server/serving-certs
8889
name: cert
8990
readOnly: true
9091
{{- end }}
91-
{{- end }}
9292
securityContext:
9393
{{- if .Values.manager.podSecurityContext }}
9494
{{- toYaml .Values.manager.podSecurityContext | nindent 14 }}

‎dist/chart/templates/metrics/metrics-service.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
{{- if .Values.metrics.enable }}
2+
apiVersion: v1
3+
kind: Service
4+
metadata:
5+
name: {{ include "team-operator.resourceName" (dict "suffix" "metrics-service" "context" $) }}
6+
namespace: {{ .Release.Namespace }}
7+
labels:
8+
app.kubernetes.io/component: metrics
9+
app.kubernetes.io/created-by: team-operator
10+
app.kubernetes.io/managed-by: {{ .Release.Service }}
11+
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
12+
app.kubernetes.io/part-of: team-operator
13+
control-plane: controller-manager
14+
spec:
15+
ports:
16+
- port: {{ .Values.metrics.port }}
17+
targetPort: {{ .Values.metrics.port }}
18+
protocol: TCP
19+
name: https
20+
selector:
21+
control-plane: controller-manager
22+
{{- end }}

‎dist/chart/templates/rbac/manager-role.yaml‎

Lines changed: 200 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,3 +15,203 @@ rules:
1515
- patch
1616
- update
1717
- watch
18+
---
19+
apiVersion: rbac.authorization.k8s.io/v1
20+
kind: Role
21+
metadata:
22+
labels:
23+
app.kubernetes.io/component: rbac
24+
app.kubernetes.io/created-by: team-operator
25+
app.kubernetes.io/instance: manager-role
26+
app.kubernetes.io/managed-by: {{ .Release.Service }}
27+
app.kubernetes.io/name: role
28+
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
29+
app.kubernetes.io/part-of: team-operator
30+
name: {{ include "team-operator.resourceName" (dict "suffix" "manager-role" "context" $) }}
31+
namespace: {{ .Values.watchNamespace }}
32+
rules:
33+
- apiGroups:
34+
- ""
35+
resources:
36+
- configmaps
37+
- persistentvolumeclaims
38+
- pods
39+
- pods/attach
40+
- pods/exec
41+
- secrets
42+
- serviceaccounts
43+
- services
44+
verbs:
45+
- create
46+
- delete
47+
- get
48+
- list
49+
- patch
50+
- update
51+
- watch
52+
- apiGroups:
53+
- ""
54+
resources:
55+
- events
56+
verbs:
57+
- watch
58+
- apiGroups:
59+
- ""
60+
resources:
61+
- pods/log
62+
verbs:
63+
- get
64+
- list
65+
- watch
66+
- apiGroups:
67+
- apps
68+
resources:
69+
- daemonsets
70+
- deployments
71+
- statefulsets
72+
verbs:
73+
- create
74+
- delete
75+
- get
76+
- list
77+
- patch
78+
- update
79+
- watch
80+
- apiGroups:
81+
- batch
82+
resources:
83+
- jobs
84+
verbs:
85+
- create
86+
- delete
87+
- get
88+
- list
89+
- patch
90+
- update
91+
- watch
92+
- apiGroups:
93+
- core.posit.team
94+
resources:
95+
- chronicles
96+
- connects
97+
- flightdecks
98+
- packagemanagers
99+
- postgresdatabases
100+
- sites
101+
- workbenches
102+
verbs:
103+
- create
104+
- delete
105+
- get
106+
- list
107+
- patch
108+
- update
109+
- watch
110+
- apiGroups:
111+
- core.posit.team
112+
resources:
113+
- chronicles/finalizers
114+
- connects/finalizers
115+
- flightdecks/finalizers
116+
- packagemanagers/finalizers
117+
- postgresdatabases/finalizers
118+
- sites/finalizers
119+
- workbenches/finalizers
120+
verbs:
121+
- update
122+
- apiGroups:
123+
- core.posit.team
124+
resources:
125+
- chronicles/status
126+
- connects/status
127+
- flightdecks/status
128+
- packagemanagers/status
129+
- postgresdatabases/status
130+
- sites/status
131+
- workbenches/status
132+
verbs:
133+
- get
134+
- patch
135+
- update
136+
- apiGroups:
137+
- k8s.keycloak.org
138+
resources:
139+
- keycloakrealmimports
140+
- keycloaks
141+
verbs:
142+
- create
143+
- delete
144+
- get
145+
- list
146+
- patch
147+
- update
148+
- watch
149+
- apiGroups:
150+
- metrics.k8s.io
151+
resources:
152+
- pods
153+
verbs:
154+
- get
155+
- apiGroups:
156+
- networking.k8s.io
157+
resources:
158+
- ingresses
159+
- networkpolicies
160+
verbs:
161+
- create
162+
- delete
163+
- get
164+
- list
165+
- patch
166+
- update
167+
- watch
168+
- apiGroups:
169+
- policy
170+
resources:
171+
- poddisruptionbudgets
172+
verbs:
173+
- create
174+
- delete
175+
- get
176+
- list
177+
- patch
178+
- update
179+
- watch
180+
- apiGroups:
181+
- rbac.authorization.k8s.io
182+
resources:
183+
- rolebindings
184+
- roles
185+
verbs:
186+
- create
187+
- delete
188+
- get
189+
- list
190+
- patch
191+
- update
192+
- watch
193+
- apiGroups:
194+
- secrets-store.csi.x-k8s.io
195+
resources:
196+
- secretproviderclasses
197+
- secretsproviderclass
198+
verbs:
199+
- create
200+
- delete
201+
- get
202+
- list
203+
- patch
204+
- update
205+
- watch
206+
- apiGroups:
207+
- traefik.io
208+
resources:
209+
- middlewares
210+
verbs:
211+
- create
212+
- delete
213+
- get
214+
- list
215+
- patch
216+
- update
217+
- watch

0 commit comments

Comments
 (0)