installer/charts/ace-installer/templates/precheck/rbac.yaml at a87aa6e3dabf499c7098ca81178a459a1a0b7577 · appscode-cloud/installer · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
{{- if .Values.precheck.enabled }}

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ include "ace-installer.fullname" . }}-precheck
  labels:
    {{- include "ace-installer.labels" . | nindent 4 }}
  annotations:
    "helm.sh/hook-weight": "0"
    "helm.sh/hook": pre-install,pre-upgrade,pre-rollback
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
rules:
  - apiGroups: [""]
    resources: ["configmaps", "namespaces", "secrets", "services", "serviceaccounts"]
    verbs: [ "get", "list", "watch" ]
  - apiGroups: ["apps"]
    resources: ["deployments"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["storage.k8s.io"]
    resources: ["storageclasses"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [ "kubedb.com" ]
    resources: [ "postgreses" ]
    verbs: ["get", "list", "watch"]
  - apiGroups: [ "helm.toolkit.fluxcd.io" ]
    resources: [ "helmreleases" ]
    verbs: [ "get", "list", "watch", "update", "patch" ]

---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: {{ include "ace-installer.fullname" . }}-precheck
  labels:
    {{- include "ace-installer.labels" . | nindent 4 }}
  annotations:
    "helm.sh/hook-weight": "0"
    "helm.sh/hook": pre-install,pre-upgrade,pre-rollback
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: {{ include "ace-installer.fullname" . }}-precheck
subjects:
  - kind: ServiceAccount
    name: {{ include "ace-installer.fullname" . }}-precheck
    namespace: {{ .Release.Namespace }}

{{- end }}