Fix RBAC permissions k8s-workload-registrar

Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>

charts/spire/charts/spire-agent/templates/_helpers.tpl

@@ -72,7 +72,3 @@ Create the name of the service account to use
 {{- printf "%s/%s" .image.registry .image.repository -}}
 {{- end -}}
 {{- end }}
-
-{{- define "spire-server-service" -}}
-{{ include "spire-agent.fullname" . | trimSuffix "-agent" }}-server
-{{- end }}

charts/spire/charts/spire-agent/templates/configmap.yaml

@@ -8,7 +8,7 @@ data:
     agent {
       data_dir = "/run/spire"
       log_level = {{ .Values.logLevel | quote }}
-      server_address = {{ (include "spire-server-service" .) | quote }}
+      server_address = "{{ .Release.Name }}-server"
       server_port = {{ .Values.server.port | quote }}
       socket_path = {{ .Values.socketPath | quote }}
       trust_bundle_path = "/run/spire/bundle/bundle.crt"

charts/spire/charts/spire-server/templates/k8s-workload-registrar-roles.yaml

@@ -39,6 +39,9 @@ rules:
   - apiGroups: [""]
     resources: ["events"]
     verbs: ["create"]
+  - apiGroups: ["coordination.k8s.io"]
+    resources: ["leases"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding