Skip to content

Commit 2425871

Browse files
KlavsKlavsenKlavsKlavsen
committed
Add useExistingRole and useClusterrole options - allowing installation
in specific namespaces only when user has no access to entire cluster (like in typical OpenShift environments). Signed-off-by: Klavs Klavsen <klavs@enableit.dk>
1 parent b4fb3d4 commit 2425871

5 files changed

Lines changed: 85 additions & 36 deletions

File tree

‎charts/kube-state-metrics/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ keywords:
66
- monitoring
77
- prometheus
88
- kubernetes
9-
version: 2.9.8
9+
version: 2.10.0
1010
appVersion: 1.9.7
1111
home: https://github.com/kubernetes/kube-state-metrics/
1212
sources:

‎charts/kube-state-metrics/templates/clusterrolebinding.yaml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
{{- if .Values.rbac.create -}}
1+
{{- if and .Values.rbac.create .Values.rbac.useClusterRole -}}
22
apiVersion: rbac.authorization.k8s.io/v1
33
kind: ClusterRoleBinding
44
metadata:
@@ -11,7 +11,11 @@ metadata:
1111
roleRef:
1212
apiGroup: rbac.authorization.k8s.io
1313
kind: ClusterRole
14+
{{- if .Values.rbac.useExistingRole }}
15+
name: {{ .Values.rbac.useExistingRole }}
16+
{{- else }}
1417
name: {{ template "kube-state-metrics.fullname" . }}
18+
{{- end }}
1519
subjects:
1620
- kind: ServiceAccount
1721
name: {{ template "kube-state-metrics.fullname" . }}

charts/kube-state-metrics/templates/clusterrole.yaml renamed to charts/kube-state-metrics/templates/role.yaml

Lines changed: 46 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -1,180 +1,192 @@
1-
{{- if .Values.rbac.create -}}
1+
{{- if and (eq $.Values.rbac.create true) (not .Values.rbac.useExistingRole) -}}
2+
{{- if eq .Values.rbac.useClusterRole false }}
3+
{{- range (split "," $.Values.namespace) }}
4+
{{- end }}
5+
---
26
apiVersion: rbac.authorization.k8s.io/v1
7+
{{- if eq .Values.rbac.useClusterRole false }}
8+
kind: Role
9+
{{- else }}
310
kind: ClusterRole
11+
{{- end }}
412
metadata:
513
labels:
6-
app.kubernetes.io/name: {{ template "kube-state-metrics.name" . }}
7-
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
8-
app.kubernetes.io/managed-by: {{ .Release.Service }}
9-
app.kubernetes.io/instance: {{ .Release.Name }}
10-
name: {{ template "kube-state-metrics.fullname" . }}
14+
app.kubernetes.io/name: {{ template "kube-state-metrics.name" $ }}
15+
helm.sh/chart: {{ $.Chart.Name }}-{{ $.Chart.Version }}
16+
app.kubernetes.io/managed-by: {{ $.Release.Service }}
17+
app.kubernetes.io/instance: {{ $.Release.Name }}
18+
name: {{ template "kube-state-metrics.fullname" $ }}
19+
{{- if eq .Values.rbac.useClusterRole false }}
20+
namespace: {{ . }}
21+
{{- end }}
1122
rules:
12-
{{ if .Values.collectors.certificatesigningrequests }}
23+
{{ if $.Values.collectors.certificatesigningrequests }}
1324
- apiGroups: ["certificates.k8s.io"]
1425
resources:
1526
- certificatesigningrequests
1627
verbs: ["list", "watch"]
1728
{{ end -}}
18-
{{ if .Values.collectors.configmaps }}
29+
{{ if $.Values.collectors.configmaps }}
1930
- apiGroups: [""]
2031
resources:
2132
- configmaps
2233
verbs: ["list", "watch"]
2334
{{ end -}}
24-
{{ if .Values.collectors.cronjobs }}
35+
{{ if $.Values.collectors.cronjobs }}
2536
- apiGroups: ["batch"]
2637
resources:
2738
- cronjobs
2839
verbs: ["list", "watch"]
2940
{{ end -}}
30-
{{ if .Values.collectors.daemonsets }}
41+
{{ if $.Values.collectors.daemonsets }}
3142
- apiGroups: ["extensions", "apps"]
3243
resources:
3344
- daemonsets
3445
verbs: ["list", "watch"]
3546
{{ end -}}
36-
{{ if .Values.collectors.deployments }}
47+
{{ if $.Values.collectors.deployments }}
3748
- apiGroups: ["extensions", "apps"]
3849
resources:
3950
- deployments
4051
verbs: ["list", "watch"]
4152
{{ end -}}
42-
{{ if .Values.collectors.endpoints }}
53+
{{ if $.Values.collectors.endpoints }}
4354
- apiGroups: [""]
4455
resources:
4556
- endpoints
4657
verbs: ["list", "watch"]
4758
{{ end -}}
48-
{{ if .Values.collectors.horizontalpodautoscalers }}
59+
{{ if $.Values.collectors.horizontalpodautoscalers }}
4960
- apiGroups: ["autoscaling"]
5061
resources:
5162
- horizontalpodautoscalers
5263
verbs: ["list", "watch"]
5364
{{ end -}}
54-
{{ if .Values.collectors.ingresses }}
65+
{{ if $.Values.collectors.ingresses }}
5566
- apiGroups: ["extensions", "networking.k8s.io"]
5667
resources:
5768
- ingresses
5869
verbs: ["list", "watch"]
5970
{{ end -}}
60-
{{ if .Values.collectors.jobs }}
71+
{{ if $.Values.collectors.jobs }}
6172
- apiGroups: ["batch"]
6273
resources:
6374
- jobs
6475
verbs: ["list", "watch"]
6576
{{ end -}}
66-
{{ if .Values.collectors.limitranges }}
77+
{{ if $.Values.collectors.limitranges }}
6778
- apiGroups: [""]
6879
resources:
6980
- limitranges
7081
verbs: ["list", "watch"]
7182
{{ end -}}
72-
{{ if .Values.collectors.mutatingwebhookconfigurations }}
83+
{{ if $.Values.collectors.mutatingwebhookconfigurations }}
7384
- apiGroups: ["admissionregistration.k8s.io"]
7485
resources:
7586
- mutatingwebhookconfigurations
7687
verbs: ["list", "watch"]
7788
{{ end -}}
78-
{{ if .Values.collectors.namespaces }}
89+
{{ if $.Values.collectors.namespaces }}
7990
- apiGroups: [""]
8091
resources:
8192
- namespaces
8293
verbs: ["list", "watch"]
8394
{{ end -}}
84-
{{ if .Values.collectors.networkpolicies }}
95+
{{ if $.Values.collectors.networkpolicies }}
8596
- apiGroups: ["networking.k8s.io"]
8697
resources:
8798
- networkpolicies
8899
verbs: ["list", "watch"]
89100
{{ end -}}
90-
{{ if .Values.collectors.nodes }}
101+
{{ if $.Values.collectors.nodes }}
91102
- apiGroups: [""]
92103
resources:
93104
- nodes
94105
verbs: ["list", "watch"]
95106
{{ end -}}
96-
{{ if .Values.collectors.persistentvolumeclaims }}
107+
{{ if $.Values.collectors.persistentvolumeclaims }}
97108
- apiGroups: [""]
98109
resources:
99110
- persistentvolumeclaims
100111
verbs: ["list", "watch"]
101112
{{ end -}}
102-
{{ if .Values.collectors.persistentvolumes }}
113+
{{ if $.Values.collectors.persistentvolumes }}
103114
- apiGroups: [""]
104115
resources:
105116
- persistentvolumes
106117
verbs: ["list", "watch"]
107118
{{ end -}}
108-
{{ if .Values.collectors.poddisruptionbudgets }}
119+
{{ if $.Values.collectors.poddisruptionbudgets }}
109120
- apiGroups: ["policy"]
110121
resources:
111122
- poddisruptionbudgets
112123
verbs: ["list", "watch"]
113124
{{ end -}}
114-
{{ if .Values.collectors.pods }}
125+
{{ if $.Values.collectors.pods }}
115126
- apiGroups: [""]
116127
resources:
117128
- pods
118129
verbs: ["list", "watch"]
119130
{{ end -}}
120-
{{ if .Values.collectors.replicasets }}
131+
{{ if $.Values.collectors.replicasets }}
121132
- apiGroups: ["extensions", "apps"]
122133
resources:
123134
- replicasets
124135
verbs: ["list", "watch"]
125136
{{ end -}}
126-
{{ if .Values.collectors.replicationcontrollers }}
137+
{{ if $.Values.collectors.replicationcontrollers }}
127138
- apiGroups: [""]
128139
resources:
129140
- replicationcontrollers
130141
verbs: ["list", "watch"]
131142
{{ end -}}
132-
{{ if .Values.collectors.resourcequotas }}
143+
{{ if $.Values.collectors.resourcequotas }}
133144
- apiGroups: [""]
134145
resources:
135146
- resourcequotas
136147
verbs: ["list", "watch"]
137148
{{ end -}}
138-
{{ if .Values.collectors.secrets }}
149+
{{ if $.Values.collectors.secrets }}
139150
- apiGroups: [""]
140151
resources:
141152
- secrets
142153
verbs: ["list", "watch"]
143154
{{ end -}}
144-
{{ if .Values.collectors.services }}
155+
{{ if $.Values.collectors.services }}
145156
- apiGroups: [""]
146157
resources:
147158
- services
148159
verbs: ["list", "watch"]
149160
{{ end -}}
150-
{{ if .Values.collectors.statefulsets }}
161+
{{ if $.Values.collectors.statefulsets }}
151162
- apiGroups: ["apps"]
152163
resources:
153164
- statefulsets
154165
verbs: ["list", "watch"]
155166
{{ end -}}
156-
{{ if .Values.collectors.storageclasses }}
167+
{{ if $.Values.collectors.storageclasses }}
157168
- apiGroups: ["storage.k8s.io"]
158169
resources:
159170
- storageclasses
160171
verbs: ["list", "watch"]
161172
{{ end -}}
162-
{{ if .Values.collectors.validatingwebhookconfigurations }}
173+
{{ if $.Values.collectors.validatingwebhookconfigurations }}
163174
- apiGroups: ["admissionregistration.k8s.io"]
164175
resources:
165176
- validatingwebhookconfigurations
166177
verbs: ["list", "watch"]
167178
{{ end -}}
168-
{{ if .Values.collectors.volumeattachments }}
179+
{{ if $.Values.collectors.volumeattachments }}
169180
- apiGroups: ["storage.k8s.io"]
170181
resources:
171182
- volumeattachments
172183
verbs: ["list", "watch"]
173184
{{ end -}}
174-
{{ if .Values.collectors.verticalpodautoscalers }}
185+
{{ if $.Values.collectors.verticalpodautoscalers }}
175186
- apiGroups: ["autoscaling.k8s.io"]
176187
resources:
177188
- verticalpodautoscalers
178189
verbs: ["list", "watch"]
179190
{{ end -}}
180191
{{- end -}}
192+
{{- end -}}

‎charts/kube-state-metrics/templates/rolebinding.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
{{- if and (eq .Values.rbac.create true) (eq .Values.rbac.useClusterRole false) -}}
2+
{{- range (split "," $.Values.namespace) }}
3+
---
4+
apiVersion: rbac.authorization.k8s.io/v1beta1
5+
kind: RoleBinding
6+
metadata:
7+
labels:
8+
app.kubernetes.io/name: {{ template "kube-state-metrics.name" $ }}
9+
helm.sh/chart: {{ $.Chart.Name }}-{{ $.Chart.Version }}
10+
app.kubernetes.io/managed-by: {{ $.Release.Service }}
11+
app.kubernetes.io/instance: {{ $.Release.Name }}
12+
name: {{ template "kube-state-metrics.fullname" $ }}
13+
namespace: {{ . }}
14+
roleRef:
15+
apiGroup: rbac.authorization.k8s.io
16+
kind: Role
17+
{{- if (not $.Values.rbac.useExistingRole) }}
18+
name: {{ template "kube-state-metrics.fullname" $ }}
19+
{{- else }}
20+
name: {{ $.Values.rbac.useExistingRole }}
21+
{{- end }}
22+
subjects:
23+
- kind: ServiceAccount
24+
name: {{ template "kube-state-metrics.fullname" $ }}
25+
namespace: {{ template "kube-state-metrics.namespace" $ }}
26+
{{- end -}}
27+
{{- end -}}

‎charts/kube-state-metrics/values.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,12 @@ rbac:
3333
# If true, create & use RBAC resources
3434
create: true
3535

36+
# Set to a rolename to use existing role - skipping role creating - but still doing serviceaccount and rolebinding to it, rolename set here.
37+
# useExistingRole: your-existing-role
38+
39+
# If set to false - Run without Cluteradmin privs needed - ONLY works if namespace is also set (if useExistingRole is set this name is used as ClusterRole or Role to bind to)
40+
useClusterRole: true
41+
3642
serviceAccount:
3743
# Specifies whether a ServiceAccount should be created, require rbac true
3844
create: true

0 commit comments

Comments
 (0)