DevFW-CICD/argocd-helm
14
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(argo-rollouts): Added flags to toggle provider-specific RBAC (#1777)

Browse source 
* Toggle for provider-specific RBAC + Added missing RBAC rules

Signed-off-by: Richard Johansson <richard.jimmy.johansson@gmail.com>

* Updated docs with new Helm values

Signed-off-by: Richard Johansson <richard.jimmy.johansson@gmail.com>

* Added a general flag providerRBAC.enabled to toggle all of the providers

Signed-off-by: Richard Johansson <richard.jimmy.johansson@gmail.com>

* Aligned with main

Signed-off-by: Richard Johansson <richard.jimmy.johansson@gmail.com>

* Corrected inline comments

Signed-off-by: Richard Johansson <richard.jimmy.johansson@gmail.com>

* Fixed incorrect inline comments

Signed-off-by: Richard Johansson <richard.jimmy.johansson@gmail.com>

Signed-off-by: Richard Johansson <richard.jimmy.johansson@gmail.com>
This commit is contained in:
Richard Johansson 2023-01-20 17:41:52 +01:00 committed by GitHub
parent 9905dcca8e
commit 4dd31571b3
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
5 changed files with 68 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
charts/argo-rollouts/Chart.yaml
View file

@ -2,7 +2,7 @@ apiVersion: v2
appVersion: v1.4.0 appVersion: v1.4.0
description: A Helm chart for Argo Rollouts description: A Helm chart for Argo Rollouts
name: argo-rollouts name: argo-rollouts
version: 2.22.0 version: 2.22.1
home: https://github.com/argoproj/argo-helm home: https://github.com/argoproj/argo-helm
icon: https://argoproj.github.io/argo-rollouts/assets/logo.png icon: https://argoproj.github.io/argo-rollouts/assets/logo.png
keywords: keywords:
@ -15,4 +15,4 @@ maintainers:
url: https://argoproj.github.io/ url: https://argoproj.github.io/
annotations: annotations:
artifacthub.io/changes: | artifacthub.io/changes: |
- "[Changed]: Upgrade ArgoRollouts to v1.4.0" - "[Added]: Flags to toggle provider-specific RBAC rules in Role and ClusterRole"

8
charts/argo-rollouts/README.md
View file

@ -55,6 +55,14 @@ If dashboard is installed by `--set dashboard.enabled=true`, checkout the argo-r
| notifications.secret.items | object | `{}` | Generic key:value pairs to be inserted into the notifications secret | | notifications.secret.items | object | `{}` | Generic key:value pairs to be inserted into the notifications secret |
| notifications.templates | object | `{}` | Notification templates | | notifications.templates | object | `{}` | Notification templates |
| notifications.triggers | object | `{}` | The trigger defines the condition when the notification should be sent | | notifications.triggers | object | `{}` | The trigger defines the condition when the notification should be sent |
| providerRBAC.enabled | bool | `true` | Toggles addition of provider-specific RBAC rules to the controller Role and ClusterRole |
| providerRBAC.providers.ambassador | bool | `true` | Adds RBAC rules for the Ambassador provider |
| providerRBAC.providers.apisix | bool | `true` | Adds RBAC rules for the Apisix provider |
| providerRBAC.providers.awsAppMesh | bool | `true` | Adds RBAC rules for the AWS App Mesh provider |
| providerRBAC.providers.awsLoadBalancerController | bool | `true` | Adds RBAC rules for the AWS Load Balancer Controller provider |
| providerRBAC.providers.istio | bool | `true` | Adds RBAC rules for the Istio provider |
| providerRBAC.providers.smi | bool | `true` | Adds RBAC rules for the SMI provider |
| providerRBAC.providers.traefik | bool | `true` | Adds RBAC rules for the Traefik provider |
### Controller ### Controller

20
charts/argo-rollouts/templates/controller/clusterrole.yaml
View file

@ -149,6 +149,8 @@ rules:
- update - update
- patch - patch
- delete - delete
{{- if .Values.providerRBAC.enabled }}
{{- if .Values.providerRBAC.providers.istio }}
# virtualservice/destinationrule access needed for using the Istio provider # virtualservice/destinationrule access needed for using the Istio provider
- apiGroups: - apiGroups:
- networking.istio.io - networking.istio.io
@ -161,6 +163,8 @@ rules:
- update - update
- patch - patch
- list - list
{{- end }}
{{- if .Values.providerRBAC.providers.smi }}
# trafficsplit access needed for using the SMI provider # trafficsplit access needed for using the SMI provider
- apiGroups: - apiGroups:
- split.smi-spec.io - split.smi-spec.io
@ -172,6 +176,8 @@ rules:
- get - get
- update - update
- patch - patch
{{- end }}
{{- if .Values.providerRBAC.providers.ambassador }}
# ambassador access needed for Ambassador provider # ambassador access needed for Ambassador provider
- apiGroups: - apiGroups:
- getambassador.io - getambassador.io
@ -186,7 +192,9 @@ rules:
- update - update
- list - list
- delete - delete
# Endpoints and TargetGroupBindings needed for ALB target group verification {{- end }}
{{- if .Values.providerRBAC.providers.awsLoadBalancerController }}
# Endpoints and TargetGroupBindings needed for ALB target group verification when using AWS Load Balancer Controller
- apiGroups: - apiGroups:
- "" - ""
resources: resources:
@ -200,6 +208,8 @@ rules:
verbs: verbs:
- list - list
- get - get
{{- end }}
{{- if .Values.providerRBAC.providers.awsAppMesh }}
# AppMesh virtualservices/virtualrouter CRD read-only access needed for using the App Mesh provider # AppMesh virtualservices/virtualrouter CRD read-only access needed for using the App Mesh provider
- apiGroups: - apiGroups:
- appmesh.k8s.aws - appmesh.k8s.aws
@ -221,6 +231,9 @@ rules:
- list - list
- update - update
- patch - patch
{{- end }}
{{- if .Values.providerRBAC.providers.traefik }}
# Traefik access needed when using the Traefik provider
- apiGroups: - apiGroups:
- traefik.containo.us - traefik.containo.us
resources: resources:
@ -229,6 +242,9 @@ rules:
- watch - watch
- get - get
- update - update
{{- end }}
{{- if .Values.providerRBAC.providers.apisix }}
# Access needed when using the Apisix provider
- apiGroups: - apiGroups:
- apisix.apache.org - apisix.apache.org
resources: resources:
@ -238,3 +254,5 @@ rules:
- get - get
- update - update
{{- end }} {{- end }}
{{- end }}
{{- end }}

20
charts/argo-rollouts/templates/controller/role.yaml
View file

@ -149,6 +149,8 @@ rules:
- update - update
- patch - patch
- delete - delete
{{- if .Values.providerRBAC.enabled }}
{{- if .Values.providerRBAC.providers.istio }}
# virtualservice/destinationrule access needed for using the Istio provider # virtualservice/destinationrule access needed for using the Istio provider
- apiGroups: - apiGroups:
- networking.istio.io - networking.istio.io
@ -161,6 +163,8 @@ rules:
- update - update
- patch - patch
- list - list
{{- end }}
{{- if .Values.providerRBAC.providers.smi }}
# trafficsplit access needed for using the SMI provider # trafficsplit access needed for using the SMI provider
- apiGroups: - apiGroups:
- split.smi-spec.io - split.smi-spec.io
@ -172,6 +176,8 @@ rules:
- get - get
- update - update
- patch - patch
{{- end }}
{{- if .Values.providerRBAC.providers.ambassador }}
# ambassador access needed for Ambassador provider # ambassador access needed for Ambassador provider
- apiGroups: - apiGroups:
- getambassador.io - getambassador.io
@ -186,7 +192,9 @@ rules:
- update - update
- list - list
- delete - delete
# Endpoints and TargetGroupBindings needed for ALB target group verification {{- end }}
{{- if .Values.providerRBAC.providers.awsLoadBalancerController }}
# Endpoints and TargetGroupBindings needed for ALB target group verification when using AWS Load Balancer Controller
- apiGroups: - apiGroups:
- "" - ""
resources: resources:
@ -200,6 +208,8 @@ rules:
verbs: verbs:
- list - list
- get - get
{{- end }}
{{- if .Values.providerRBAC.providers.awsAppMesh }}
# AppMesh virtualservices/virtualrouter CRD read-only access needed for using the App Mesh provider # AppMesh virtualservices/virtualrouter CRD read-only access needed for using the App Mesh provider
- apiGroups: - apiGroups:
- appmesh.k8s.aws - appmesh.k8s.aws
@ -221,6 +231,9 @@ rules:
- list - list
- update - update
- patch - patch
{{- end }}
{{- if .Values.providerRBAC.providers.traefik }}
# Traefik access needed when using the Traefik provider
- apiGroups: - apiGroups:
- traefik.containo.us - traefik.containo.us
resources: resources:
@ -229,6 +242,9 @@ rules:
- watch - watch
- get - get
- update - update
{{- end }}
{{- if .Values.providerRBAC.providers.apisix }}
# Access needed when using the Apisix provider
- apiGroups: - apiGroups:
- apisix.apache.org - apisix.apache.org
resources: resources:
@ -238,3 +254,5 @@ rules:
- get - get
- update - update
{{- end }} {{- end }}
{{- end }}
{{- end }}

20
charts/argo-rollouts/values.yaml
View file

@ -190,6 +190,26 @@ podLabels: {}
imagePullSecrets: [] imagePullSecrets: []
# - name: argo-pull-secret # - name: argo-pull-secret
providerRBAC:
# -- Toggles addition of provider-specific RBAC rules to the controller Role and ClusterRole
enabled: true
# providerRBAC.enabled must be true in order to toggle the individual providers
providers:
# -- Adds RBAC rules for the Istio provider
istio: true
# -- Adds RBAC rules for the SMI provider
smi: true
# -- Adds RBAC rules for the Ambassador provider
ambassador: true
# -- Adds RBAC rules for the AWS Load Balancer Controller provider
awsLoadBalancerController: true
# -- Adds RBAC rules for the AWS App Mesh provider
awsAppMesh: true
# -- Adds RBAC rules for the Traefik provider
traefik: true
# -- Adds RBAC rules for the Apisix provider
apisix: true
dashboard: dashboard:
# -- Deploy dashboard server # -- Deploy dashboard server
enabled: false enabled: false