DevFW-CICD/argocd-helm
16
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Added a general flag providerRBAC.enabled to toggle all of the providers

Browse source 
Signed-off-by: Richard Johansson <richard.jimmy.johansson@gmail.com>
This commit is contained in:
Richard Johansson 2023-01-19 13:59:58 +01:00
parent 83a4d3b400
commit 30dcd535ad
4 changed files with 39 additions and 32 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
charts/argo-rollouts/README.md
View file

@ -43,12 +43,6 @@ If dashboard is installed by `--set dashboard.enabled=true`, checkout the argo-r
| clusterInstall | bool | `true` | `false` runs controller in namespaced mode (does not require cluster RBAC) | | clusterInstall | bool | `true` | `false` runs controller in namespaced mode (does not require cluster RBAC) |
| crdAnnotations | object | `{}` | Annotations to be added to all CRDs | | crdAnnotations | object | `{}` | Annotations to be added to all CRDs |
| createClusterAggregateRoles | bool | `true` | flag to enable creation of cluster aggregate roles (requires cluster RBAC) | | createClusterAggregateRoles | bool | `true` | flag to enable creation of cluster aggregate roles (requires cluster RBAC) |
| enabledProviders.ambassador | bool | `true` | Adds RBAC for the Ambassador provider |
| enabledProviders.awsAppMesh | bool | `true` | Adds RBAC for the AWS App Mesh provider |
| enabledProviders.awsLoadBalancerController | bool | `true` | Adds RBAC for the AWS Load Balancer Controller provider |
| enabledProviders.istio | bool | `true` | Adds RBAC for the Istio provider |
| enabledProviders.smi | bool | `true` | Adds RBAC for the SMI provider |
| enabledProviders.traefik | bool | `true` | Adds RBAC for the Traefik provider |
| extraObjects | list | `[]` | Additional manifests to deploy within the chart. A list of objects. | | extraObjects | list | `[]` | Additional manifests to deploy within the chart. A list of objects. |
| fullnameOverride | string | `nil` | String to fully override "argo-rollouts.fullname" template | | fullnameOverride | string | `nil` | String to fully override "argo-rollouts.fullname" template |
| imagePullSecrets | list | `[]` | Secrets with credentials to pull images from a private registry. Registry secret names as an array. | | imagePullSecrets | list | `[]` | Secrets with credentials to pull images from a private registry. Registry secret names as an array. |
@ -61,6 +55,13 @@ If dashboard is installed by `--set dashboard.enabled=true`, checkout the argo-r
| notifications.secret.items | object | `{}` | Generic key:value pairs to be inserted into the notifications secret | | notifications.secret.items | object | `{}` | Generic key:value pairs to be inserted into the notifications secret |
| notifications.templates | object | `{}` | Notification templates | | notifications.templates | object | `{}` | Notification templates |
| notifications.triggers | object | `{}` | The trigger defines the condition when the notification should be sent | | notifications.triggers | object | `{}` | The trigger defines the condition when the notification should be sent |
| providerRBAC.enabled | bool | `true` | Adds provider-specific RBAC rules to the controller Role and ClusterRole |
| providerRBAC.providers.ambassador | bool | `true` | Adds RBAC rules for the Ambassador provider |
| providerRBAC.providers.awsAppMesh | bool | `true` | Adds RBAC rules for the AWS App Mesh provider |
| providerRBAC.providers.awsLoadBalancerController | bool | `true` | Adds RBAC rules for the AWS Load Balancer Controller provider |
| providerRBAC.providers.istio | bool | `true` | Adds RBAC rules for the Istio provider |
| providerRBAC.providers.smi | bool | `true` | Adds RBAC rules for the SMI provider |
| providerRBAC.providers.traefik | bool | `true` | Adds RBAC rules for the Traefik provider |
### Controller ### Controller

14
charts/argo-rollouts/templates/controller/clusterrole.yaml
View file

@ -154,7 +154,8 @@ rules:
- update - update
- patch - patch
- delete - delete
{{- if .Values.enabledProviders.istio }} {{- if .Values.providerRBAC.enabled }}
{{- if .Values.providerRBAC.providers.istio }}
# virtualservice/destinationrule access needed for using the Istio provider # virtualservice/destinationrule access needed for using the Istio provider
- apiGroups: - apiGroups:
- networking.istio.io - networking.istio.io
@ -168,7 +169,7 @@ rules:
- patch - patch
- list - list
{{- end }} {{- end }}
{{- if .Values.enabledProviders.smi }} {{- if .Values.providerRBAC.providers.smi }}
# trafficsplit access needed for using the SMI provider # trafficsplit access needed for using the SMI provider
- apiGroups: - apiGroups:
- split.smi-spec.io - split.smi-spec.io
@ -181,7 +182,7 @@ rules:
- update - update
- patch - patch
{{- end }} {{- end }}
{{- if .Values.enabledProviders.ambassador }} {{- if .Values.providerRBAC.providers.ambassador }}
# ambassador access needed for Ambassador provider # ambassador access needed for Ambassador provider
- apiGroups: - apiGroups:
- getambassador.io - getambassador.io
@ -197,7 +198,7 @@ rules:
- list - list
- delete - delete
{{- end }} {{- end }}
{{- if .Values.enabledProviders.awsLoadBalancerController }} {{- if .Values.providerRBAC.providers.awsLoadBalancerController }}
# Endpoints and TargetGroupBindings needed for ALB target group verification when using AWS Load Balancer Controller # Endpoints and TargetGroupBindings needed for ALB target group verification when using AWS Load Balancer Controller
- apiGroups: - apiGroups:
- "" - ""
@ -213,7 +214,7 @@ rules:
- list - list
- get - get
{{- end }} {{- end }}
{{- if .Values.enabledProviders.awsAppMesh }} {{- if .Values.providerRBAC.providers.awsAppMesh }}
# AppMesh virtualservices/virtualrouter CRD read-only access needed for using the App Mesh provider # AppMesh virtualservices/virtualrouter CRD read-only access needed for using the App Mesh provider
- apiGroups: - apiGroups:
- appmesh.k8s.aws - appmesh.k8s.aws
@ -236,7 +237,7 @@ rules:
- update - update
- patch - patch
{{- end }} {{- end }}
{{- if .Values.enabledProviders.traefik }} {{- if .Values.providerRBAC.providers.traefik }}
# Traefik access needed when using the Traefik provider # Traefik access needed when using the Traefik provider
- apiGroups: - apiGroups:
- traefik.containo.us - traefik.containo.us
@ -248,3 +249,4 @@ rules:
- update - update
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- end }}

14
charts/argo-rollouts/templates/controller/role.yaml
View file

@ -154,7 +154,8 @@ rules:
- update - update
- patch - patch
- delete - delete
{{- if .Values.enabledProviders.istio }} {{- if .Values.providerRBAC.enabled }}
{{- if .Values.providerRBAC.providers.istio }}
# virtualservice/destinationrule access needed for using the Istio provider # virtualservice/destinationrule access needed for using the Istio provider
- apiGroups: - apiGroups:
- networking.istio.io - networking.istio.io
@ -168,7 +169,7 @@ rules:
- patch - patch
- list - list
{{- end }} {{- end }}
{{- if .Values.enabledProviders.smi }} {{- if .Values.providerRBAC.providers.smi }}
# trafficsplit access needed for using the SMI provider # trafficsplit access needed for using the SMI provider
- apiGroups: - apiGroups:
- split.smi-spec.io - split.smi-spec.io
@ -181,7 +182,7 @@ rules:
- update - update
- patch - patch
{{- end }} {{- end }}
{{- if .Values.enabledProviders.ambassador }} {{- if .Values.providerRBAC.providers.ambassador }}
# ambassador access needed for Ambassador provider # ambassador access needed for Ambassador provider
- apiGroups: - apiGroups:
- getambassador.io - getambassador.io
@ -197,7 +198,7 @@ rules:
- list - list
- delete - delete
{{- end }} {{- end }}
{{- if .Values.enabledProviders.awsLoadBalancerController }} {{- if .Values.providerRBAC.providers.awsLoadBalancerController }}
# Endpoints and TargetGroupBindings needed for ALB target group verification when using AWS Load Balancer Controller # Endpoints and TargetGroupBindings needed for ALB target group verification when using AWS Load Balancer Controller
- apiGroups: - apiGroups:
- "" - ""
@ -213,7 +214,7 @@ rules:
- list - list
- get - get
{{- end }} {{- end }}
{{- if .Values.enabledProviders.awsAppMesh }} {{- if .Values.providerRBAC.providers.awsAppMesh }}
# AppMesh virtualservices/virtualrouter CRD read-only access needed for using the App Mesh provider # AppMesh virtualservices/virtualrouter CRD read-only access needed for using the App Mesh provider
- apiGroups: - apiGroups:
- appmesh.k8s.aws - appmesh.k8s.aws
@ -236,7 +237,7 @@ rules:
- update - update
- patch - patch
{{- end }} {{- end }}
{{- if .Values.enabledProviders.traefik }} {{- if .Values.providerRBAC.providers.traefik }}
# Traefik access needed when using the Traefik provider # Traefik access needed when using the Traefik provider
- apiGroups: - apiGroups:
- traefik.containo.us - traefik.containo.us
@ -248,3 +249,4 @@ rules:
- update - update
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- end }}

30
charts/argo-rollouts/values.yaml
View file

@ -190,20 +190,22 @@ podLabels: {}
imagePullSecrets: [] imagePullSecrets: []
# - name: argo-pull-secret # - name: argo-pull-secret
## Adds provider-specific RBAC permissions to the controller role and cluster role providerRBAC:
enabledProviders: # -- Adds provider-specific RBAC rules to the controller Role and ClusterRole
# -- Adds RBAC for the Istio provider enabled: true
istio: true providers:
# -- Adds RBAC for the SMI provider # -- Adds RBAC rules for the Istio provider
smi: true istio: true
# -- Adds RBAC for the Ambassador provider # -- Adds RBAC rules for the SMI provider
ambassador: true smi: true
# -- Adds RBAC for the AWS Load Balancer Controller provider # -- Adds RBAC rules for the Ambassador provider
awsLoadBalancerController: true ambassador: true
# -- Adds RBAC for the AWS App Mesh provider # -- Adds RBAC rules for the AWS Load Balancer Controller provider
awsAppMesh: true awsLoadBalancerController: true
# -- Adds RBAC for the Traefik provider # -- Adds RBAC rules for the AWS App Mesh provider
traefik: true awsAppMesh: true
# -- Adds RBAC rules for the Traefik provider
traefik: true
dashboard: dashboard:
# -- Deploy dashboard server # -- Deploy dashboard server