feature: add configurable rbac

.changes/unreleased/ENHANCEMENTS-491-20241002-142919.yaml

@@ -0,0 +1,5 @@
+kind: ENHANCEMENTS
+body: '`Helm Chart`: Add the ability to configure the creation of the RBAC role and role binding.'
+time: 2024-10-02T14:29:19.427979944Z
+custom:
+    PR: "491"

charts/hcp-terraform-operator/README.md

@@ -167,6 +167,7 @@ For a more detailed explanation, please refer to the [FAQ](../../docs/faq.md#gen
 | operator.tfeAddress | string | `""` | The API URL of a Terraform Enterprise instance. |
 | operator.watchedNamespaces | list | `[]` | List of namespaces the controllers should watch. |
 | priorityClassName | string | `""` | Deployment priorityClassName. More information in [Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/). |
+| rbac.create | bool | `true` | Specifies whether a Role-Based Access Control (RBAC) resources should be created |
 | replicaCount | int | `2` | The number of Operator replicas. |
 | securityContext | object | `{"runAsNonRoot":true}` | Deployment pod security context. More information in [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/). |
 | serviceAccount.annotations | object | `{}` | Additional annotations for the ServiceAccount. |

charts/hcp-terraform-operator/templates/clusterrole.yaml

@@ -1,6 +1,7 @@
 # Copyright (c) HashiCorp, Inc.
 # SPDX-License-Identifier: MPL-2.0
-
+---
+{{- if .Values.rbac.create -}}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
@@ -176,3 +177,4 @@ rules:
   - subjectaccessreviews
   verbs:
   - create
+{{- end -}}

charts/hcp-terraform-operator/templates/clusterrolebinding.yaml

@@ -1,6 +1,7 @@
 # Copyright (c) HashiCorp, Inc.
 # SPDX-License-Identifier: MPL-2.0
-
+---
+{{- if .Values.rbac.create -}}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
@@ -26,3 +27,4 @@ subjects:
 - kind: ServiceAccount
   name: {{ include "hcp-terraform-operator.serviceAccountName" . }}
   namespace: {{ .Release.Namespace }}
+{{- end -}}

charts/hcp-terraform-operator/templates/role.yaml

@@ -1,6 +1,7 @@
 # Copyright (c) HashiCorp, Inc.
 # SPDX-License-Identifier: MPL-2.0
-
+---
+{{- if .Values.rbac.create -}}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
@@ -38,3 +39,4 @@ rules:
   verbs:
   - create
   - patch
+{{- end -}}

charts/hcp-terraform-operator/templates/rolebinding.yaml

@@ -1,6 +1,7 @@
 # Copyright (c) HashiCorp, Inc.
 # SPDX-License-Identifier: MPL-2.0
-
+---
+{{- if .Values.rbac.create -}}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
@@ -14,3 +15,4 @@ subjects:
 - kind: ServiceAccount
   name: {{ include "hcp-terraform-operator.serviceAccountName" . }}
   namespace: {{ .Release.Namespace }}
+{{- end -}}

charts/hcp-terraform-operator/values.yaml

@@ -120,3 +120,7 @@ serviceAccount:
   # -- The name of the service account to use.
   # If not set and create is true, a name is generated using the fullname template.
   name: ""
+
+rbac:
+  # -- Specifies whether a Role-Based Access Control (RBAC) resources should be created
+  create: true