From 6de23d3303ade50609fc5239120f8819220a3bbb Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Fri, 26 Apr 2024 14:21:16 -0700 Subject: [PATCH] Don't create role/binding when bundle disabled (#336) When the bundle notifier is disabled, there is no need to create a role and role binding for it. Signed-off-by: Kevin Fox --- charts/spire/charts/spire-server/templates/roles.yaml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/charts/spire/charts/spire-server/templates/roles.yaml b/charts/spire/charts/spire-server/templates/roles.yaml index 3949967..fdf2ac5 100644 --- a/charts/spire/charts/spire-server/templates/roles.yaml +++ b/charts/spire/charts/spire-server/templates/roles.yaml @@ -1,6 +1,7 @@ {{- $subject := include "spire-server.subject" . }} {{- $namespace := include "spire-server.namespace" . }} {{- $bundleNamespace := include "spire-server.bundle-namespace" . }} +{{- if .Values.notifier.k8sbundle.enabled }} # Role to be able to push certificate bundles to a configmap kind: Role apiVersion: rbac.authorization.k8s.io/v1 @@ -14,6 +15,7 @@ rules: verbs: - get - patch +{{- end }} {{- if and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.rbac.create }} --- # Role to be able to manage cert requests with Cert-Manager @@ -46,6 +48,7 @@ roleRef: name: {{ include "spire-server.fullname" . }}-cm apiGroup: rbac.authorization.k8s.io {{- end }} +{{- if .Values.notifier.k8sbundle.enabled }} --- kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1 @@ -57,7 +60,7 @@ roleRef: kind: Role name: {{ include "spire-lib.bundle-configmap" . }} apiGroup: rbac.authorization.k8s.io - +{{- end }} {{- if and .Values.nodeAttestor.k8sPsat.enabled }} --- # ClusterRole to allow spire-server node attestor to query Token Review API