From 7a06415d83bd4c81b8477be6d1407f587a9c9b9b Mon Sep 17 00:00:00 2001
From: g-linville <53102776+g-linville@users.noreply.github.com>
Date: Tue, 25 May 2021 02:06:31 -0400
Subject: [PATCH] feat(argo-workflows): add value to avoid creating RBAC
 related to ClusterWorkflowTemplates (#657)

* Argo Workflows: avoid creating ClusterRoles and CRBs if singleNamespace is true

Signed-off-by: g-linville <53102776+g-linville@users.noreply.github.com>

* Argo Workflows: bumped chart version

Signed-off-by: g-linville <53102776+g-linville@users.noreply.github.com>

* Argo: remove clusterworkflowtemplates from WorkflowController role

Signed-off-by: g-linville <53102776+g-linville@users.noreply.github.com>

* feat(argo-workflows): add value to disable creation of RBAC relating to ClusterWorkflowTemplates

Signed-off-by: g-linville <53102776+g-linville@users.noreply.github.com>

* Bumped chart version

Signed-off-by: g-linville <53102776+g-linville@users.noreply.github.com>
---
 charts/argo-workflows/Chart.yaml                             | 2 +-
 .../controller/workflow-controller-cluster-roles.yaml        | 5 +++--
 .../templates/controller/workflow-controller-crb.yaml        | 3 +++
 .../templates/server/server-cluster-roles.yaml               | 3 +++
 charts/argo-workflows/templates/server/server-crb.yaml       | 3 +++
 charts/argo-workflows/values.yaml                            | 5 +++++
 6 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/charts/argo-workflows/Chart.yaml b/charts/argo-workflows/Chart.yaml
index 13b1ea78..2bdcf2aa 100644
--- a/charts/argo-workflows/Chart.yaml
+++ b/charts/argo-workflows/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: argo-workflows
 description: A Helm chart for Argo Workflows
 type: application
-version: 0.1.2
+version: 0.1.3
 appVersion: "v3.0.2"
 icon: https://raw.githubusercontent.com/argoproj/argo-workflows/master/docs/assets/argo.png
 home: https://github.com/argoproj/argo-helm
diff --git a/charts/argo-workflows/templates/controller/workflow-controller-cluster-roles.yaml b/charts/argo-workflows/templates/controller/workflow-controller-cluster-roles.yaml
index de5e88a3..756e1f0f 100644
--- a/charts/argo-workflows/templates/controller/workflow-controller-cluster-roles.yaml
+++ b/charts/argo-workflows/templates/controller/workflow-controller-cluster-roles.yaml
@@ -55,8 +55,6 @@ rules:
   resources:
   - workflowtemplates
   - workflowtemplates/finalizers
-  - clusterworkflowtemplates
-  - clusterworkflowtemplates/finalizers
   verbs:
   - get
   - list
@@ -131,6 +129,8 @@ rules:
   - update
   - patch
   - delete
+
+{{- if .Values.controller.clusterWorkflowTemplates.enabled }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -146,3 +146,4 @@ rules:
   - get
   - list
   - watch
+{{- end }}
diff --git a/charts/argo-workflows/templates/controller/workflow-controller-crb.yaml b/charts/argo-workflows/templates/controller/workflow-controller-crb.yaml
index 6879d282..1235e325 100644
--- a/charts/argo-workflows/templates/controller/workflow-controller-crb.yaml
+++ b/charts/argo-workflows/templates/controller/workflow-controller-crb.yaml
@@ -31,6 +31,8 @@ subjects:
   {{- end }}
 {{- end }}
 {{- end }}
+
+{{- if .Values.controller.clusterWorkflowTemplates.enabled }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -46,3 +48,4 @@ subjects:
   - kind: ServiceAccount
     name: {{ template "argo-workflows.controllerServiceAccountName" . }}
     namespace: {{ .Release.Namespace }}
+{{- end }}
diff --git a/charts/argo-workflows/templates/server/server-cluster-roles.yaml b/charts/argo-workflows/templates/server/server-cluster-roles.yaml
index 5901bbd1..6403bf96 100644
--- a/charts/argo-workflows/templates/server/server-cluster-roles.yaml
+++ b/charts/argo-workflows/templates/server/server-cluster-roles.yaml
@@ -111,6 +111,8 @@ rules:
     - update
     - patch
     - delete
+
+{{- if .Values.server.clusterWorkflowTemplates.enabled }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -134,3 +136,4 @@ rules:
   - delete
   {{- end }}
 {{- end }}
+{{- end }}
diff --git a/charts/argo-workflows/templates/server/server-crb.yaml b/charts/argo-workflows/templates/server/server-crb.yaml
index fd9450d5..16d55902 100644
--- a/charts/argo-workflows/templates/server/server-crb.yaml
+++ b/charts/argo-workflows/templates/server/server-crb.yaml
@@ -21,6 +21,8 @@ subjects:
 - kind: ServiceAccount
   name: {{ template "argo-workflows.serverServiceAccountName" . }}
   namespace: {{ .Release.Namespace }}
+
+{{- if .Values.server.clusterWorkflowTemplates.enabled }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -37,3 +39,4 @@ subjects:
   name: {{ template "argo-workflows.serverServiceAccountName" . }}
   namespace: {{ .Release.Namespace }}
 {{- end -}}
+{{- end -}}
diff --git a/charts/argo-workflows/values.yaml b/charts/argo-workflows/values.yaml
index 375c5eb1..d2899516 100644
--- a/charts/argo-workflows/values.yaml
+++ b/charts/argo-workflows/values.yaml
@@ -143,6 +143,9 @@ controller:
   priorityClassName: ""
   # https://argoproj.github.io/argo-workflows/links/
   links: []
+  clusterWorkflowTemplates:
+    # Create a ClusterRole and CRB for the controller to access ClusterWorkflowTemplates.
+    enabled: true
 
 # executor controls how the init and wait container should be customized
 executor:
@@ -262,6 +265,8 @@ server:
     https: false
 
   clusterWorkflowTemplates:
+    # Create a ClusterRole and CRB for the server to access ClusterWorkflowTemplates.
+    enabled: true
     # Give the server permissions to edit ClusterWorkflowTemplates.
     enableEditing: true
   sso: