helm: add secrets and configmaps to rbac (#5466)

* helm: add secrets and configmaps to rbac * typo * docs
grafana · Oct 13, 2023 · 4f6d1e0 · 4f6d1e0
1 parent 4e35d2b
commit 4f6d1e0
Show file tree

Hide file tree

Showing 25 changed files with 218 additions and 0 deletions.
diff --git a/operations/helm/charts/grafana-agent/CHANGELOG.md b/operations/helm/charts/grafana-agent/CHANGELOG.md
@@ -10,6 +10,8 @@ internal API changes are not present.
 Unreleased
 ----------
 
+- Add `secrets` and `configmaps` to cluster role for `remote.kubernetes.*` components. (@captncraig)
+
 0.26.0 (2023-10-10)
 -------------------
 

diff --git a/operations/helm/charts/grafana-agent/templates/rbac.yaml b/operations/helm/charts/grafana-agent/templates/rbac.yaml
@@ -74,6 +74,15 @@ rules:
       - get
       - list
       - watch
+  # needed for remote.kubernetes.*
+  - apiGroups: [""]
+    resources:
+      - "configmaps"
+      - "secrets"
+    verbs:
+      - get
+      - list
+      - watch
 
 ---
 

diff --git a/operations/helm/tests/clustering/grafana-agent/templates/rbac.yaml b/operations/helm/tests/clustering/grafana-agent/templates/rbac.yaml
@@ -79,6 +79,15 @@ rules:
       - get
       - list
       - watch
+  # needed for remote.kubernetes.*
+  - apiGroups: [""]
+    resources:
+      - "configmaps"
+      - "secrets"
+    verbs:
+      - get
+      - list
+      - watch
 ---
 # Source: grafana-agent/templates/rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1

diff --git a/operations/helm/tests/controller-volumes-extra/grafana-agent/templates/rbac.yaml b/operations/helm/tests/controller-volumes-extra/grafana-agent/templates/rbac.yaml
@@ -79,6 +79,15 @@ rules:
       - get
       - list
       - watch
+  # needed for remote.kubernetes.*
+  - apiGroups: [""]
+    resources:
+      - "configmaps"
+      - "secrets"
+    verbs:
+      - get
+      - list
+      - watch
 ---
 # Source: grafana-agent/templates/rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1

diff --git a/operations/helm/tests/create-daemonset-hostnetwork/grafana-agent/templates/rbac.yaml b/operations/helm/tests/create-daemonset-hostnetwork/grafana-agent/templates/rbac.yaml
@@ -79,6 +79,15 @@ rules:
       - get
       - list
       - watch
+  # needed for remote.kubernetes.*
+  - apiGroups: [""]
+    resources:
+      - "configmaps"
+      - "secrets"
+    verbs:
+      - get
+      - list
+      - watch
 ---
 # Source: grafana-agent/templates/rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1

diff --git a/operations/helm/tests/create-daemonset/grafana-agent/templates/rbac.yaml b/operations/helm/tests/create-daemonset/grafana-agent/templates/rbac.yaml
@@ -79,6 +79,15 @@ rules:
       - get
       - list
       - watch
+  # needed for remote.kubernetes.*
+  - apiGroups: [""]
+    resources:
+      - "configmaps"
+      - "secrets"
+    verbs:
+      - get
+      - list
+      - watch
 ---
 # Source: grafana-agent/templates/rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1

diff --git a/operations/helm/tests/create-deployment-autoscaling/grafana-agent/templates/rbac.yaml b/operations/helm/tests/create-deployment-autoscaling/grafana-agent/templates/rbac.yaml
@@ -79,6 +79,15 @@ rules:
       - get
       - list
       - watch
+  # needed for remote.kubernetes.*
+  - apiGroups: [""]
+    resources:
+      - "configmaps"
+      - "secrets"
+    verbs:
+      - get
+      - list
+      - watch
 ---
 # Source: grafana-agent/templates/rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1

diff --git a/operations/helm/tests/create-deployment/grafana-agent/templates/rbac.yaml b/operations/helm/tests/create-deployment/grafana-agent/templates/rbac.yaml
@@ -79,6 +79,15 @@ rules:
       - get
       - list
       - watch
+  # needed for remote.kubernetes.*
+  - apiGroups: [""]
+    resources:
+      - "configmaps"
+      - "secrets"
+    verbs:
+      - get
+      - list
+      - watch
 ---
 # Source: grafana-agent/templates/rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1

diff --git a/operations/helm/tests/create-statefulset-autoscaling/grafana-agent/templates/rbac.yaml b/operations/helm/tests/create-statefulset-autoscaling/grafana-agent/templates/rbac.yaml
@@ -79,6 +79,15 @@ rules:
       - get
       - list
       - watch
+  # needed for remote.kubernetes.*
+  - apiGroups: [""]
+    resources:
+      - "configmaps"
+      - "secrets"
+    verbs:
+      - get
+      - list
+      - watch
 ---
 # Source: grafana-agent/templates/rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1

diff --git a/operations/helm/tests/create-statefulset/grafana-agent/templates/rbac.yaml b/operations/helm/tests/create-statefulset/grafana-agent/templates/rbac.yaml
@@ -79,6 +79,15 @@ rules:
       - get
       - list
       - watch
+  # needed for remote.kubernetes.*
+  - apiGroups: [""]
+    resources:
+      - "configmaps"
+      - "secrets"
+    verbs:
+      - get
+      - list
+      - watch
 ---
 # Source: grafana-agent/templates/rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1

diff --git a/operations/helm/tests/custom-config/grafana-agent/templates/rbac.yaml b/operations/helm/tests/custom-config/grafana-agent/templates/rbac.yaml
@@ -79,6 +79,15 @@ rules:
       - get
       - list
       - watch
+  # needed for remote.kubernetes.*
+  - apiGroups: [""]
+    resources:
+      - "configmaps"
+      - "secrets"
+    verbs:
+      - get
+      - list
+      - watch
 ---
 # Source: grafana-agent/templates/rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1

diff --git a/operations/helm/tests/default-values/grafana-agent/templates/rbac.yaml b/operations/helm/tests/default-values/grafana-agent/templates/rbac.yaml
@@ -79,6 +79,15 @@ rules:
       - get
       - list
       - watch
+  # needed for remote.kubernetes.*
+  - apiGroups: [""]
+    resources:
+      - "configmaps"
+      - "secrets"
+    verbs:
+      - get
+      - list
+      - watch
 ---
 # Source: grafana-agent/templates/rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1

diff --git a/operations/helm/tests/enable-servicemonitor/grafana-agent/templates/rbac.yaml b/operations/helm/tests/enable-servicemonitor/grafana-agent/templates/rbac.yaml
@@ -79,6 +79,15 @@ rules:
       - get
       - list
       - watch
+  # needed for remote.kubernetes.*
+  - apiGroups: [""]
+    resources:
+      - "configmaps"
+      - "secrets"
+    verbs:
+      - get
+      - list
+      - watch
 ---
 # Source: grafana-agent/templates/rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1

diff --git a/operations/helm/tests/envFrom/grafana-agent/templates/rbac.yaml b/operations/helm/tests/envFrom/grafana-agent/templates/rbac.yaml
@@ -79,6 +79,15 @@ rules:
       - get
       - list
       - watch
+  # needed for remote.kubernetes.*
+  - apiGroups: [""]
+    resources:
+      - "configmaps"
+      - "secrets"
+    verbs:
+      - get
+      - list
+      - watch
 ---
 # Source: grafana-agent/templates/rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1

diff --git a/operations/helm/tests/existing-config/grafana-agent/templates/rbac.yaml b/operations/helm/tests/existing-config/grafana-agent/templates/rbac.yaml
@@ -79,6 +79,15 @@ rules:
       - get
       - list
       - watch
+  # needed for remote.kubernetes.*
+  - apiGroups: [""]
+    resources:
+      - "configmaps"
+      - "secrets"
+    verbs:
+      - get
+      - list
+      - watch
 ---
 # Source: grafana-agent/templates/rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1

diff --git a/operations/helm/tests/extra-env/grafana-agent/templates/rbac.yaml b/operations/helm/tests/extra-env/grafana-agent/templates/rbac.yaml
@@ -79,6 +79,15 @@ rules:
       - get
       - list
       - watch
+  # needed for remote.kubernetes.*
+  - apiGroups: [""]
+    resources:
+      - "configmaps"
+      - "secrets"
+    verbs:
+      - get
+      - list
+      - watch
 ---
 # Source: grafana-agent/templates/rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1

diff --git a/operations/helm/tests/extra-ports/grafana-agent/templates/rbac.yaml b/operations/helm/tests/extra-ports/grafana-agent/templates/rbac.yaml
@@ -79,6 +79,15 @@ rules:
       - get
       - list
       - watch
+  # needed for remote.kubernetes.*
+  - apiGroups: [""]
+    resources:
+      - "configmaps"
+      - "secrets"
+    verbs:
+      - get
+      - list
+      - watch
 ---
 # Source: grafana-agent/templates/rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1

diff --git a/operations/helm/tests/faro-ingress/grafana-agent/templates/rbac.yaml b/operations/helm/tests/faro-ingress/grafana-agent/templates/rbac.yaml
@@ -79,6 +79,15 @@ rules:
       - get
       - list
       - watch
+  # needed for remote.kubernetes.*
+  - apiGroups: [""]
+    resources:
+      - "configmaps"
+      - "secrets"
+    verbs:
+      - get
+      - list
+      - watch
 ---
 # Source: grafana-agent/templates/rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1

diff --git a/operations/helm/tests/global-image-pullsecrets/grafana-agent/templates/rbac.yaml b/operations/helm/tests/global-image-pullsecrets/grafana-agent/templates/rbac.yaml
@@ -79,6 +79,15 @@ rules:
       - get
       - list
       - watch
+  # needed for remote.kubernetes.*
+  - apiGroups: [""]
+    resources:
+      - "configmaps"
+      - "secrets"
+    verbs:
+      - get
+      - list
+      - watch
 ---
 # Source: grafana-agent/templates/rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1

diff --git a/operations/helm/tests/global-image-registry/grafana-agent/templates/rbac.yaml b/operations/helm/tests/global-image-registry/grafana-agent/templates/rbac.yaml
@@ -79,6 +79,15 @@ rules:
       - get
       - list
       - watch
+  # needed for remote.kubernetes.*
+  - apiGroups: [""]
+    resources:
+      - "configmaps"
+      - "secrets"
+    verbs:
+      - get
+      - list
+      - watch
 ---
 # Source: grafana-agent/templates/rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1

diff --git a/operations/helm/tests/initcontainers/grafana-agent/templates/rbac.yaml b/operations/helm/tests/initcontainers/grafana-agent/templates/rbac.yaml
@@ -79,6 +79,15 @@ rules:
       - get
       - list
       - watch
+  # needed for remote.kubernetes.*
+  - apiGroups: [""]
+    resources:
+      - "configmaps"
+      - "secrets"
+    verbs:
+      - get
+      - list
+      - watch
 ---
 # Source: grafana-agent/templates/rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1

diff --git a/operations/helm/tests/local-image-pullsecrets/grafana-agent/templates/rbac.yaml b/operations/helm/tests/local-image-pullsecrets/grafana-agent/templates/rbac.yaml
@@ -79,6 +79,15 @@ rules:
       - get
       - list
       - watch
+  # needed for remote.kubernetes.*
+  - apiGroups: [""]
+    resources:
+      - "configmaps"
+      - "secrets"
+    verbs:
+      - get
+      - list
+      - watch
 ---
 # Source: grafana-agent/templates/rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1

diff --git a/operations/helm/tests/local-image-registry/grafana-agent/templates/rbac.yaml b/operations/helm/tests/local-image-registry/grafana-agent/templates/rbac.yaml
@@ -79,6 +79,15 @@ rules:
       - get
       - list
       - watch
+  # needed for remote.kubernetes.*
+  - apiGroups: [""]
+    resources:
+      - "configmaps"
+      - "secrets"
+    verbs:
+      - get
+      - list
+      - watch
 ---
 # Source: grafana-agent/templates/rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1

diff --git a/operations/helm/tests/nodeselectors-and-tolerations/grafana-agent/templates/rbac.yaml b/operations/helm/tests/nodeselectors-and-tolerations/grafana-agent/templates/rbac.yaml
@@ -79,6 +79,15 @@ rules:
       - get
       - list
       - watch
+  # needed for remote.kubernetes.*
+  - apiGroups: [""]
+    resources:
+      - "configmaps"
+      - "secrets"
+    verbs:
+      - get
+      - list
+      - watch
 ---
 # Source: grafana-agent/templates/rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1

diff --git a/operations/helm/tests/static-mode/grafana-agent/templates/rbac.yaml b/operations/helm/tests/static-mode/grafana-agent/templates/rbac.yaml
@@ -79,6 +79,15 @@ rules:
       - get
       - list
       - watch
+  # needed for remote.kubernetes.*
+  - apiGroups: [""]
+    resources:
+      - "configmaps"
+      - "secrets"
+    verbs:
+      - get
+      - list
+      - watch
 ---
 # Source: grafana-agent/templates/rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1
-Original file line number
+Diff line change
@@ Expand Up / @@ -10,6 +10,8 @@ internal API changes are not present. @@
     Unreleased
     ----------
+    - Add `secrets` and `configmaps` to cluster role for `remote.kubernetes.*` components. (@captncraig)
 .26.0 (2023-10-10)
     -------------------
@@ Expand Down @@