k8s-stack: allow setting extra rules for VMAgent SA

Author: AndrewChubatiuk

charts/victoria-metrics-k8s-stack/CHANGELOG.md

@@ -1,6 +1,7 @@
 ## Next release
 
 - allow override dashboards and datasources label names and values. See [#2576](https://github.com/VictoriaMetrics/helm-charts/issues/2576).
+- allow setting extra roles for VMAgent service account. See [#2586](https://github.com/VictoriaMetrics/helm-charts/issues/2586).
 
 ## 0.63.6
 

charts/victoria-metrics-k8s-stack/templates/victoria-metrics-operator/vmagent/rbac.yaml

@@ -0,0 +1,45 @@
+{{- $app := .Values.vmagent }}
+{{- $rbac := $app.rbac }}
+{{- if and $app.enabled (.not (empty $rbac.rules)) -}}
+{{- $ctx := dict "helm" . "appKey" "vmagent" }}
+{{- $fullname := include "vm.managed.fullname" $ctx }}
+{{- $ns := include "vm.namespace" $ctx }}
+{{- $namespaced := ne (len (index .Values "victoria-metrics-operator" "watchNamespaces")) 0 }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: {{ ternary "RoleBinding" "ClusterRoleBinding" $namespaced }}
+metadata:
+  name: {{ $fullname }}
+  {{- if $namespaced }}
+  namespace: {{ $ns }}
+  {{- end }}
+  {{- $_ := set $ctx "extraLabels" $rbac.extraLabels }}
+  labels: {{ include "vm.labels" $ctx | nindent 4 }}
+  {{- $_ := unset $ctx "extraLabels" }}
+  {{- with $rbac.annotations }}
+  annotations: {{ toYaml . | nindent 4 }}
+  {{- end }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: {{ ternary "Role" "ClusterRole" $namespaced }}
+  name: {{ $fullname }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ $fullname }}
+    namespace: {{ $ns }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: {{ ternary "Role" "ClusterRole" $namespaced }}
+metadata:
+  name: {{ $fullname }}
+  {{- if $namespaced }}
+  namespace: {{ include "vm.namespace" $ctx }}
+  {{- end }}
+  {{- $_ := set $ctx "extraLabels" $rbac.extraLabels }}
+  labels: {{ include "vm.labels" $ctx | nindent 4 }}
+  {{- $_ := unset $ctx "extraLabels" }}
+  {{- with $rbac.annotations }}
+  annotations: {{ toYaml . | nindent 4 }}
+  {{- end }}
+rules: {{ tpl (toYaml $rbac.rules) . | nindent 2 }}
+{{- end }}

charts/victoria-metrics-k8s-stack/values.yaml

@@ -921,6 +921,13 @@ vmagent:
   labels: {}
   # -- VMAgent annotations
   annotations: {}
+  rbac:
+    # -- Role/RoleBinding annotations
+    annotations: {}
+    # -- Role/RoleBinding labels
+    extraLabels: {}
+    # -- additional rules for a role
+    rules: []
   # -- Remote write configuration of VMAgent, allowed parameters defined in a [spec](https://docs.victoriametrics.com/operator/api/#vmagentremotewritespec)
   additionalRemoteWrites:
     []