panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Don't create role/binding when bundle disabled (#336)

Browse Source 
When the bundle notifier is disabled, there is no need to create
a role and role binding for it.

Signed-off-by: Kevin Fox <[email protected]>
This commit is contained in:
kfox1111
2024-04-26 14:21:16 -07:00
committed by GitHub
parent c132cc481e
commit 6de23d3303
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/templates/roles.yaml
+4 -1
View File
@@ -1,6 +1,7 @@
{{- $subject := include "spire-server.subject" . }} {{- $subject := include "spire-server.subject" . }}
{{- $namespace := include "spire-server.namespace" . }} {{- $namespace := include "spire-server.namespace" . }}
{{- $bundleNamespace := include "spire-server.bundle-namespace" . }} {{- $bundleNamespace := include "spire-server.bundle-namespace" . }}
{{- if .Values.notifier.k8sbundle.enabled }}
# Role to be able to push certificate bundles to a configmap # Role to be able to push certificate bundles to a configmap
kind: Role kind: Role
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
@@ -14,6 +15,7 @@ rules:
verbs: verbs:
- get - get
- patch - patch
{{- end }}
{{- if and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.rbac.create }} {{- if and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.rbac.create }}
--- ---
# Role to be able to manage cert requests with Cert-Manager # Role to be able to manage cert requests with Cert-Manager
@@ -46,6 +48,7 @@ roleRef:
name: {{ include "spire-server.fullname" . }}-cm name: {{ include "spire-server.fullname" . }}-cm
apiGroup: rbac.authorization.k8s.io apiGroup: rbac.authorization.k8s.io
{{- end }} {{- end }}
{{- if .Values.notifier.k8sbundle.enabled }}
--- ---
kind: RoleBinding kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
@@ -57,7 +60,7 @@ roleRef:
kind: Role kind: Role
name: {{ include "spire-lib.bundle-configmap" . }} name: {{ include "spire-lib.bundle-configmap" . }}
apiGroup: rbac.authorization.k8s.io apiGroup: rbac.authorization.k8s.io
{{- end }}
{{- if and .Values.nodeAttestor.k8sPsat.enabled }} {{- if and .Values.nodeAttestor.k8sPsat.enabled }}
--- ---
# ClusterRole to allow spire-server node attestor to query Token Review API # ClusterRole to allow spire-server node attestor to query Token Review API