Skip to content
This repository has been archived by the owner on Nov 1, 2022. It is now read-only.

Limit scope of flux and flux operator in helm chart. #1928

Closed
wants to merge 1 commit into from
Closed

Limit scope of flux and flux operator in helm chart. #1928

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions chart/flux/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -197,6 +197,7 @@ The following tables lists the configurable parameters of the Weave Flux chart a
| `token` | `None` | Weave Cloud service token
| `extraEnvs` | `[]` | Extra environment variables for the Flux pod(s)
| `rbac.create` | `true` | If `true`, create and use RBAC resources
| `clusterScope` | `true` | If `false`, will only create rbac resources for the namespace where flux is deployed to and will set k8s-allow-namespace and allow-namespace arg in flux and helm operator to that namespace
| `serviceAccount.create` | `true` | If `true`, create a new service account
| `serviceAccount.name` | `flux` | Service account to be used
| `service.type` | `ClusterIP` | Service type to be used (exposing the Flux API outside of the cluster is not advised)
Expand Down
3 changes: 3 additions & 0 deletions chart/flux/templates/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -131,6 +131,9 @@ spec:
{{- if .Values.memcached.createClusterIP }}
- --memcached-service=
{{- end }}
{{- if not .Values.clusterScope }}
- --k8s-allow-namespace={{ .Release.Namespace }}
{{- end }}
- --git-url={{ .Values.git.url }}
- --git-branch={{ .Values.git.branch }}
- --git-path={{ .Values.git.path }}
Expand Down
5 changes: 4 additions & 1 deletion chart/flux/templates/helm-operator-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,9 +109,12 @@ spec:
- --charts-sync-interval={{ .Values.helmOperator.chartsSyncInterval }}
- --update-chart-deps={{ .Values.helmOperator.updateChartDeps }}
- --log-release-diffs={{ .Values.helmOperator.logReleaseDiffs }}
{{- if .Values.helmOperator.allowNamespace }}
{{- if and .Values.helmOperator.allowNamespace .Values.clusterScope }}
- --allow-namespace={{ .Values.helmOperator.allowNamespace }}
{{- end }}
{{- if not .Values.clusterScope }}
- --allow-namespace={{ .Release.Namespace }}
{{- end }}
- --tiller-namespace={{ .Values.helmOperator.tillerNamespace }}
{{- if .Values.helmOperator.tls.enable }}
- --tiller-tls-enable={{ .Values.helmOperator.tls.enable }}
Expand Down
58 changes: 54 additions & 4 deletions chart/flux/templates/rbac.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,18 @@
{{- $kind := "Role" -}}
{{- $bind := "RoleBinding" -}}
{{- if .Values.clusterScope -}}
{{ $kind = "ClusterRole" }}
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I had to change the assignments in lines 4 and 5 to := from =

Suggested change
{{ $kind = "ClusterRole" }}
{{ $kind := "ClusterRole" }}

Maybe my helm client is too old?

Client: &version.Version{SemVer:"v2.9.1", GitCommit:"20adb27c7c5868466912eebdf6664e7390ebe710", GitTreeState:"clean"}
Server: &version.Version{SemVer:"v2.13.0", GitCommit:"79d07943b03aea2b76c12644b4b54733bc5958d6", GitTreeState:"clean"}

Copy link

@dranner-bgt dranner-bgt Apr 26, 2019 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I also had to remove the nonResourceURLs from the Role (apparently they only work for ClusterRoles):

apiVersion: rbac.authorization.k8s.io/v1beta1
kind: {{ $kind }}
metadata:
  name: {{ template "flux.fullname" . }}
  {{- if not .Values.clusterScope }}
  namespace: {{ .Release.Namespace }}
  {{- end }}
  labels:
    app: {{ template "flux.name" . }}
    chart: {{ template "flux.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
rules:
  - apiGroups: ["*"]
    resources: ["*"]
    verbs: ["*"]

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for this effort. I'm using this PR as a base to deploy flux into a cluster with access to a limited list of namespaces. I think it might be best to create a new PR that contains my additional RBAC resources once this PR is merged.

{{ $bind = "ClusterRoleBinding" }}
{{- end -}}

{{- if .Values.rbac.create -}}
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
kind: {{ $kind }}
metadata:
name: {{ template "flux.fullname" . }}
{{- if not .Values.clusterScope }}
namespace: {{ .Release.Namespace }}
{{- end }}
labels:
app: {{ template "flux.name" . }}
chart: {{ template "flux.chart" . }}
Expand All @@ -21,7 +31,7 @@ rules:
- '*'
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
kind: {{ $bind }}
metadata:
name: {{ template "flux.fullname" . }}
labels:
Expand All @@ -31,10 +41,50 @@ metadata:
heritage: {{ .Release.Service }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
kind: {{ $kind }}
name: {{ template "flux.fullname" . }}
subjects:
- name: {{ template "flux.serviceAccountName" . }}
namespace: {{ .Release.Namespace | quote }}
kind: ServiceAccount
{{- end -}}
{{- if not .Values.clusterScope }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: {{ template "flux.fullname" . }}
labels:
app: {{ template "flux.name" . }}
chart: {{ template "flux.chart" . }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
rules:
# CRDs are defined at the cluster scope and Flux will complain if it cannot list or watch these
- apiGroups:
- apiextensions.k8s.io
resources:
- customresourcedefinitions
verbs:
- list
- watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: flux
namespace: flux-system
labels:
app: {{ template "flux.name" . }}
chart: {{ template "flux.chart" . }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: {{ template "flux.fullname" . }}
subjects:
- name: {{ template "flux.serviceAccountName" . }}
namespace: {{ .Release.Namespace | quote }}
kind: ServiceAccount
{{- end }}
{{- end }}
4 changes: 4 additions & 0 deletions chart/flux/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,6 +87,10 @@ serviceAccount:
# If not set and create is true, a name is generated using the fullname template
name:

# If `false`, will only create rbac resources for the namespace where flux is deployed to and
# will set k8s-allow-namespace and allow-namespace arg in flux and helm operator to that namespace
clusterScope: true

resources:
requests:
cpu: 50m
Expand Down