Limit scope of flux and flux operator in helm chart.

[arturo-c]

Allows you to set clusterScope to false in helm chart so that rbac resources and arguments to both flux and helm operator are scoped only to the namespace where flux is deployed.

Partly addresses #1886 and #1085

[arturo-c]

Similar to implementation in https://github.com/zeeZ/locked-down-flux

[stefanprodan]

Thanks @arturo-c please see my comments.

[arturo-c]

thanks @stefanprodan and @2opremio for the really quick review!, updated branch with the changes requested

[arturo-c]

also maybe @zeeZ can take a look, since thats where I found the rbac example for flux -> #1830

[stefanprodan]

@arturo-c have you tested this with a namespace definition or some other cluster object? Will Flux stop function or it would keep applying the yamls that are allowed by RBAC?

[arturo-c]

@stefanprodan have not tested by having resources out of the namespace for each operator, will try and do that today and report back

[dranner-bgt]

I had to change the assignments in lines 4 and 5 to := from =

Suggested change

	{{ $kind = "ClusterRole" }}
	{{ $kind := "ClusterRole" }}

Maybe my helm client is too old?

Client: &version.Version{SemVer:"v2.9.1", GitCommit:"20adb27c7c5868466912eebdf6664e7390ebe710", GitTreeState:"clean"}
Server: &version.Version{SemVer:"v2.13.0", GitCommit:"79d07943b03aea2b76c12644b4b54733bc5958d6", GitTreeState:"clean"}

[dranner-bgt]

I also had to remove the nonResourceURLs from the Role (apparently they only work for ClusterRoles):

apiVersion: rbac.authorization.k8s.io/v1beta1
kind: {{ $kind }}
metadata:
  name: {{ template "flux.fullname" . }}
  {{- if not .Values.clusterScope }}
  namespace: {{ .Release.Namespace }}
  {{- end }}
  labels:
    app: {{ template "flux.name" . }}
    chart: {{ template "flux.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
rules:
  - apiGroups: ["*"]
    resources: ["*"]
    verbs: ["*"]

[dranner-bgt]

Thank you for this effort. I'm using this PR as a base to deploy flux into a cluster with access to a limited list of namespaces. I think it might be best to create a new PR that contains my additional RBAC resources once this PR is merged.

[2opremio]

@arturo-c any updates? Are you planning to continue working on this PR?

[arturo-c]

@2opremio sorry, haven't had time to work on this, not sure if best path forward is to close this pr for now?

[stefanprodan]

Closing this in favour of #2206