diff --git a/.changes/unreleased/ENHANCEMENTS-491-20241002-142919.yaml b/.changes/unreleased/ENHANCEMENTS-491-20241002-142919.yaml new file mode 100644 index 00000000..1423f54a --- /dev/null +++ b/.changes/unreleased/ENHANCEMENTS-491-20241002-142919.yaml @@ -0,0 +1,5 @@ +kind: ENHANCEMENTS +body: '`Helm Chart`: Add the ability to configure the creation of the RBAC role and role binding.' +time: 2024-10-02T14:29:19.427979944Z +custom: + PR: "491" diff --git a/charts/hcp-terraform-operator/README.md b/charts/hcp-terraform-operator/README.md index 3fa5524f..d8aeddbd 100644 --- a/charts/hcp-terraform-operator/README.md +++ b/charts/hcp-terraform-operator/README.md @@ -167,6 +167,7 @@ For a more detailed explanation, please refer to the [FAQ](../../docs/faq.md#gen | operator.tfeAddress | string | `""` | The API URL of a Terraform Enterprise instance. | | operator.watchedNamespaces | list | `[]` | List of namespaces the controllers should watch. | | priorityClassName | string | `""` | Deployment priorityClassName. More information in [Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/). | +| rbac.create | bool | `true` | Specifies whether a Role-Based Access Control (RBAC) resources should be created | | replicaCount | int | `2` | The number of Operator replicas. | | securityContext | object | `{"runAsNonRoot":true}` | Deployment pod security context. More information in [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/). | | serviceAccount.annotations | object | `{}` | Additional annotations for the ServiceAccount. | diff --git a/charts/hcp-terraform-operator/templates/clusterrole.yaml b/charts/hcp-terraform-operator/templates/clusterrole.yaml index ab902057..586af308 100644 --- a/charts/hcp-terraform-operator/templates/clusterrole.yaml +++ b/charts/hcp-terraform-operator/templates/clusterrole.yaml @@ -1,6 +1,7 @@ # Copyright (c) HashiCorp, Inc. # SPDX-License-Identifier: MPL-2.0 - +--- +{{- if .Values.rbac.create -}} apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: @@ -176,3 +177,4 @@ rules: - subjectaccessreviews verbs: - create +{{- end -}} diff --git a/charts/hcp-terraform-operator/templates/clusterrolebinding.yaml b/charts/hcp-terraform-operator/templates/clusterrolebinding.yaml index 1b95c309..373dcc71 100644 --- a/charts/hcp-terraform-operator/templates/clusterrolebinding.yaml +++ b/charts/hcp-terraform-operator/templates/clusterrolebinding.yaml @@ -1,6 +1,7 @@ # Copyright (c) HashiCorp, Inc. # SPDX-License-Identifier: MPL-2.0 - +--- +{{- if .Values.rbac.create -}} apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: @@ -26,3 +27,4 @@ subjects: - kind: ServiceAccount name: {{ include "hcp-terraform-operator.serviceAccountName" . }} namespace: {{ .Release.Namespace }} +{{- end -}} diff --git a/charts/hcp-terraform-operator/templates/role.yaml b/charts/hcp-terraform-operator/templates/role.yaml index f36f3151..bf26eaac 100644 --- a/charts/hcp-terraform-operator/templates/role.yaml +++ b/charts/hcp-terraform-operator/templates/role.yaml @@ -1,6 +1,7 @@ # Copyright (c) HashiCorp, Inc. # SPDX-License-Identifier: MPL-2.0 - +--- +{{- if .Values.rbac.create -}} apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: @@ -38,3 +39,4 @@ rules: verbs: - create - patch +{{- end -}} diff --git a/charts/hcp-terraform-operator/templates/rolebinding.yaml b/charts/hcp-terraform-operator/templates/rolebinding.yaml index d5b34afe..121da817 100644 --- a/charts/hcp-terraform-operator/templates/rolebinding.yaml +++ b/charts/hcp-terraform-operator/templates/rolebinding.yaml @@ -1,6 +1,7 @@ # Copyright (c) HashiCorp, Inc. # SPDX-License-Identifier: MPL-2.0 - +--- +{{- if .Values.rbac.create -}} apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: @@ -14,3 +15,4 @@ subjects: - kind: ServiceAccount name: {{ include "hcp-terraform-operator.serviceAccountName" . }} namespace: {{ .Release.Namespace }} +{{- end -}} diff --git a/charts/hcp-terraform-operator/values.yaml b/charts/hcp-terraform-operator/values.yaml index 93cf6f90..9166dc14 100644 --- a/charts/hcp-terraform-operator/values.yaml +++ b/charts/hcp-terraform-operator/values.yaml @@ -120,3 +120,7 @@ serviceAccount: # -- The name of the service account to use. # If not set and create is true, a name is generated using the fullname template. name: "" + +rbac: + # -- Specifies whether a Role-Based Access Control (RBAC) resources should be created + create: true