feat(argo-rollouts): readonly dashboard (#1304)

* feat-argo-rollouts-readonly-dashboard

Signed-off-by: foxtel-temujincabigao
<86087373+foxtel-temujincabigao@users.noreply.github.com>"
Signed-off-by: foxtel-temujincabigao <86087373+foxtel-temujincabigao@users.noreply.github.com>

* fixing readme values version link

Signed-off-by: foxtel-temujincabigao
<86087373+foxtel-temujincabigao@users.noreply.github.com>
Signed-off-by: foxtel-temujincabigao <86087373+foxtel-temujincabigao@users.noreply.github.com>

Co-authored-by: Marco Kilchhofer <mkilchhofer@users.noreply.github.com>

charts/argo-rollouts/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 appVersion: "v1.2.0"
 description: A Helm chart for Argo Rollouts
 name: argo-rollouts
-version: 2.15.0
+version: 2.16.0
 icon: https://argoproj.github.io/argo-rollouts/assets/logo.png
 home: https://github.com/argoproj/argo-helm
 maintainers:
@@ -11,4 +11,4 @@ maintainers:
   - name: jessesuen
 annotations:
   artifacthub.io/changes: |
-    - "[Added]: option to enable PodDisruptionBudget for controller and dashboard"
+    - "[Added]: Argo rollouts dashboard cluster role readonly flags"

charts/argo-rollouts/README.md

@@ -121,6 +121,7 @@ If dashboard is installed by `--set dashboard.enabled=true`, checkout the argo-r
 | dashboard.pdb.minAvailable | string | `nil` | Minimum number / percentage of pods that should remain scheduled |
 | dashboard.podSecurityContext | object | `{"runAsNonRoot":true}` | Security Context to set on pod level |
 | dashboard.priorityClassName | string | `""` | [priorityClassName] for the dashboard server |
+| dashboard.readonly | bool | `false` | Set cluster role to readonly |
 | dashboard.replicas | int | `1` | The number of dashboard pods to run |
 | dashboard.resources | object | `{}` | Resource limits and requests for the dashboard pods. |
 | dashboard.service.annotations | object | `{}` | Service annotations |
@@ -168,4 +169,4 @@ Autogenerated from chart metadata using [helm-docs](https://github.com/norwoodj/
 [Tolerations]: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
 [priorityClassName]: https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/
 [Pod Disruption Budget]: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/#pod-disruption-budgets
-[values.yaml]: https://github.com/argoproj/argo-helm/blob/argo-rollouts-2.15.0/charts/argo-rollouts/values.yaml
+[values.yaml]: https://github.com/argoproj/argo-helm/blob/argo-rollouts-2.16.0/charts/argo-rollouts/values.yaml

charts/argo-rollouts/templates/dashboard/clusterrole.yaml

@@ -17,8 +17,10 @@ rules:
       - get
       - list
       - watch
+      {{- if not .Values.dashboard.readonly }}
       - update
       - patch
+      {{- end }}
   - apiGroups:
       - argoproj.io
     resources:
@@ -27,7 +29,9 @@ rules:
       - experiments
       - experiments/finalizers
     verbs:
+      {{- if not .Values.dashboard.readonly }}
       - create
+      {{- end }}
       - get
       - list
       - watch

charts/argo-rollouts/values.yaml

@@ -151,6 +151,8 @@ imagePullSecrets: []
 dashboard:
   # -- Deploy dashboard server
   enabled: false
+  # -- Set cluster role to readonly
+  readonly: false
   # -- Value of label `app.kubernetes.io/component`
   component: rollouts-dashboard
   # -- [Node selector]