[stable/traefik]: reduce RBAC scope if one namespace is handled

[bonifaido]

What this PR does / why we need it:

If Kubernetes namespace selection is defined and the (one) selected
namespace is the release namespace Cluster scope is unnecessary.

Which issue this PR fixes

• reduces the RBAC scope of this application in certain situations

Special notes for your reviewer:

Can be tested with:

helm upgrade --install traefik ./stable/traefik --set "kubernetes.namespaces[0]=default" --set rbac.enabled=true

Checklist

• DCO signed
• Chart Version bumped
• Variables are documented in the README.md
• Title of the PR starts with chart name (e.g. [stable/chart])

[k8s-ci-robot]

Hi @bonifaido. Thanks for your PR.

I'm waiting for a helm member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[bonifaido]

/assign @timoreimann

[k8s-ci-robot]

@bonifaido: GitHub didn't allow me to assign the following users: timoreimann.

Note that only helm members, repo collaborators and people who have commented on this issue/PR can be assigned. Additionally, issues/PRs can only have 10 assignees at the same time.
For more information please see the contributor guide

In response to this:

/assign @timoreimann

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[bonifaido]

/assign @dtomcej

[dtomcej]

Not a huge fan of having {{ template "x" }}moretext.

Can you move the Role string into the mustache template and make this:

kind: {{ template "traefik.rbac.scope" . }}

?

[bonifaido]

It's a bit hard to change since we need {{...}}Role and {{...}}RoleBinding as well, maybe I should add the postfix as a template parameter?

[dtomcej]

That could work. Just because {{...}}Role is not very clear to reviewers what is going on.

[bonifaido]

I couldn't come up with something more readable than the one below since if I pass in the postfix I lose the outer scope, which is also needed inside the template:

{{ include "traefik.rbac.scope" . | printf "%sRoleBinding" }}

{{ include "traefik.rbac.scope" . | printf "%sRole" }}

[bonifaido]

I have added these changes to the PR.

[bonifaido]

@dtomcej did you have the chance to review the latest version?

[dtomcej]

Much cleaner!

[dtomcej]

Hey @bonifaido can you bump this so that we can 🚢 ?

It LGTM.

[bonifaido]

Of course, just updated it @dtomcej, thank you!

[dtomcej]

/ok-to-test

[dtomcej]

/lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bonifaido, dtomcej

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• stable/traefik/OWNERS [dtomcej]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment