From 6452b6a2e984696a277918fbc7784cf9c22ea4e0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=D0=BE=CC=81man?= <3798179+ahalay@users.noreply.github.com> Date: Fri, 17 Sep 2021 23:14:31 +0300 Subject: [PATCH] feat(argo-cd): Ability to provide cluster role to repo-server (#919) * feat(argo-cd): Ability to provide cluster role to repo-server Signed-off-by: Roman Rudenko <3kmnazapad@gmail.com> * custom clusterRoleRules Signed-off-by: Roman Rudenko <3kmnazapad@gmail.com> * chore: beautify indentation Signed-off-by: Marco Kilchhofer * fix: noeol in clusterrolebinding.yaml Signed-off-by: Marco Kilchhofer Co-authored-by: Roman Rudenko Co-authored-by: Marco Kilchhofer --- charts/argo-cd/Chart.yaml | 4 ++-- charts/argo-cd/README.md | 5 ++++ .../clusterrole.yaml | 8 +++---- .../argocd-repo-server/clusterrole.yaml | 23 +++++++++++++++++++ .../clusterrolebinding.yaml | 16 +++++++++++++ charts/argo-cd/values.yaml | 11 +++++++++ 6 files changed, 61 insertions(+), 6 deletions(-) create mode 100644 charts/argo-cd/templates/argocd-repo-server/clusterrole.yaml create mode 100644 charts/argo-cd/templates/argocd-repo-server/clusterrolebinding.yaml diff --git a/charts/argo-cd/Chart.yaml b/charts/argo-cd/Chart.yaml index 9976c962..863d64d7 100644 --- a/charts/argo-cd/Chart.yaml +++ b/charts/argo-cd/Chart.yaml @@ -2,7 +2,7 @@ apiVersion: v2 appVersion: 2.1.2 description: A Helm chart for ArgoCD, a declarative, GitOps continuous delivery tool for Kubernetes. name: argo-cd -version: 3.20.0 +version: 3.21.0 home: https://github.com/argoproj/argo-helm icon: https://argoproj.github.io/argo-cd/assets/logo.png keywords: @@ -21,4 +21,4 @@ dependencies: condition: redis-ha.enabled annotations: artifacthub.io/changes: | - - "[Added]: Ability to scrape redis metrics" + - "[Added]: Ability to provide cluster role to repo-server" diff --git a/charts/argo-cd/README.md b/charts/argo-cd/README.md index d9834553..bb3e724d 100644 --- a/charts/argo-cd/README.md +++ b/charts/argo-cd/README.md @@ -187,6 +187,8 @@ NAME: my-release | controller.args.selfHealTimeout | define the controller `--self-heal-timeout-seconds` | `"5"` | | controller.args.statusProcessors | define the controller `--status-processors` | `"20"` | | controller.clusterAdminAccess.enabled | Enable RBAC for local cluster deployments. | `true` | +| controller.clusterRoleRules.enabled | Enable custom rules for the Application Controller's Cluster Role resource. | `false` | +| controller.clusterRoleRules.rules | List of custom rules for the Application Controller's Cluster Role resource. | `[]` | | controller.containerPort | Controller listening port. | `8082` | | controller.extraArgs | Additional arguments for the controller. A list of flags | `[]` | | controller.extraContainers | Additional containers for the controller. A list of containers. | `[]` | @@ -244,6 +246,9 @@ NAME: my-release | repoServer.autoscaling.maxReplicas | Maximum number of replicas for the repo server [HPA](https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/) | `5` | | repoServer.autoscaling.targetCPUUtilizationPercentage | Average CPU utilization percentage for the repo server [HPA](https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/) | `50` | | repoServer.autoscaling.targetMemoryUtilizationPercentage | Average memory utilization percentage for the repo server [HPA](https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/) | `50` | +| repoServer.clusterAdminAccess.enabled | Enable RBAC for local cluster deployments. | `false` | +| repoServer.clusterRoleRules.enabled | Enable custom rules for the Repo server's Cluster Role resource. | `false` | +| repoServer.clusterRoleRules.rules | List of custom rules for the Repo server's Cluster Role resource. | `[]` | | repoServer.containerPort | Repo server port | `8081` | | repoServer.extraArgs | Additional arguments for the repo server. A list of flags. | `[]` | | repoServer.extraContainers | Additional containers for the repo server. A list of containers. | `[]` | diff --git a/charts/argo-cd/templates/argocd-application-controller/clusterrole.yaml b/charts/argo-cd/templates/argocd-application-controller/clusterrole.yaml index bd6ff8aa..0aa82961 100644 --- a/charts/argo-cd/templates/argocd-application-controller/clusterrole.yaml +++ b/charts/argo-cd/templates/argocd-application-controller/clusterrole.yaml @@ -6,9 +6,9 @@ metadata: labels: {{- include "argo-cd.labels" (dict "context" . "component" .Values.controller.name "name" .Values.controller.name) | nindent 4 }} rules: -{{- if .Values.controller.clusterRoleRules.enabled }} -{{- toYaml .Values.controller.clusterRoleRules.rules | nindent 2 }} -{{ else }} + {{- if .Values.controller.clusterRoleRules.enabled }} + {{- toYaml .Values.controller.clusterRoleRules.rules | nindent 0 }} + {{- else }} - apiGroups: - '*' resources: @@ -19,5 +19,5 @@ rules: - '*' verbs: - '*' -{{- end }} + {{- end }} {{- end }} diff --git a/charts/argo-cd/templates/argocd-repo-server/clusterrole.yaml b/charts/argo-cd/templates/argocd-repo-server/clusterrole.yaml new file mode 100644 index 00000000..4ea41da3 --- /dev/null +++ b/charts/argo-cd/templates/argocd-repo-server/clusterrole.yaml @@ -0,0 +1,23 @@ +{{- if and .Values.repoServer.serviceAccount.create .Values.repoServer.clusterAdminAccess.enabled }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ template "argo-cd.repoServer.fullname" . }} + labels: + {{- include "argo-cd.labels" (dict "context" . "component" .Values.repoServer.name "name" .Values.repoServer.name) | nindent 4 }} +rules: + {{- if .Values.repoServer.clusterRoleRules.enabled }} + {{- toYaml .Values.repoServer.clusterRoleRules.rules | nindent 0 }} + {{- else }} +- apiGroups: + - '*' + resources: + - '*' + verbs: + - '*' +- nonResourceURLs: + - '*' + verbs: + - '*' + {{- end }} +{{- end }} diff --git a/charts/argo-cd/templates/argocd-repo-server/clusterrolebinding.yaml b/charts/argo-cd/templates/argocd-repo-server/clusterrolebinding.yaml new file mode 100644 index 00000000..9757912e --- /dev/null +++ b/charts/argo-cd/templates/argocd-repo-server/clusterrolebinding.yaml @@ -0,0 +1,16 @@ +{{- if and .Values.repoServer.serviceAccount.create .Values.repoServer.clusterAdminAccess.enabled }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ template "argo-cd.repoServer.fullname" . }} + labels: + {{- include "argo-cd.labels" (dict "context" . "component" .Values.repoServer.name "name" .Values.repoServer.name) | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "argo-cd.repoServer.fullname" . }} +subjects: +- kind: ServiceAccount + name: {{ template "argo-cd.repoServerServiceAccountName" . }} + namespace: {{ .Release.Namespace }} +{{- end }} diff --git a/charts/argo-cd/values.yaml b/charts/argo-cd/values.yaml index 9f828c8e..17d95a80 100755 --- a/charts/argo-cd/values.yaml +++ b/charts/argo-cd/values.yaml @@ -1061,6 +1061,17 @@ repoServer: # namespace: monitoring # additionalLabels: {} + ## Enable Admin ClusterRole resources. + ## Enable if you would like to grant cluster rights to ArgoCD repo-server. + clusterAdminAccess: + enabled: false + ## Enable Custom Rules for the Repo server's Cluster Role resource + ## Enable this and set the rules: to whatever custom rules you want for the Cluster Role resource. + ## Defaults to off + clusterRoleRules: + enabled: false + rules: [] + ## Repo server service account ## If create is set to true, make sure to uncomment the name and update the rbac section below serviceAccount: