Merge pull request #1356 from ishankhare07/fix-clusterrole-cross-vclu…

…ster-coredns create clusterrole and pod permissions when coredns plugin enabled
loft-sh · Nov 16, 2023 · 5ec0550 · 5ec0550
2 parents 1f8d1bc + 3542ff2
commit 5ec0550
Show file tree

Hide file tree

Showing 8 changed files with 28 additions and 4 deletions.
diff --git a/charts/eks/templates/_helpers.tpl b/charts/eks/templates/_helpers.tpl
@@ -58,7 +58,8 @@ Whether to create a cluster role or not
     .Values.sync.priorityclasses.enabled
     .Values.sync.volumesnapshots.enabled
     .Values.proxy.metricsServer.nodes.enabled
-    .Values.multiNamespaceMode.enabled -}}
+    .Values.multiNamespaceMode.enabled
+    .Values.coredns.plugin.enabled -}}
     {{- true -}}
 {{- end -}}
 {{- end -}}

diff --git a/charts/eks/templates/rbac/clusterrole.yaml b/charts/eks/templates/rbac/clusterrole.yaml
@@ -26,6 +26,11 @@ rules:
     resources: [ "pods", "nodes/metrics", "nodes/stats"]
     verbs: ["get", "watch", "list"]
   {{- end }}
+  {{- if .Values.coredns.plugin.enabled }}
+  - apiGroups: [""]
+    resources: [ "pods"]
+    verbs: ["get", "watch", "list"]
+  {{- end }}
   {{- if and (or .Values.sync.nodes.enabled .Values.rbac.clusterRole.create) (or (not .Values.isolation.enabled) (and .Values.isolation.nodeProxyPermission.enabled .Values.isolation.enabled)) }}
   - apiGroups: [""]
     resources: ["nodes/proxy"]

diff --git a/charts/k0s/templates/_helpers.tpl b/charts/k0s/templates/_helpers.tpl
@@ -58,7 +58,8 @@ Whether to create a cluster role or not
     .Values.sync.priorityclasses.enabled
     .Values.sync.volumesnapshots.enabled
     .Values.proxy.metricsServer.nodes.enabled
-    .Values.multiNamespaceMode.enabled -}}
+    .Values.multiNamespaceMode.enabled
+    .Values.coredns.plugin.enabled -}}
     {{- true -}}
 {{- end -}}
 {{- end -}}

diff --git a/charts/k0s/templates/rbac/clusterrole.yaml b/charts/k0s/templates/rbac/clusterrole.yaml
@@ -26,6 +26,11 @@ rules:
     resources: [ "pods", "nodes/metrics", "nodes/stats"]
     verbs: ["get", "watch", "list"]
   {{- end }}
+  {{- if .Values.coredns.plugin.enabled }}
+  - apiGroups: [""]
+    resources: [ "pods"]
+    verbs: ["get", "watch", "list"]
+  {{- end }}
   {{- if and (or .Values.sync.nodes.enabled .Values.rbac.clusterRole.create) (or (not .Values.isolation.enabled) (and .Values.isolation.nodeProxyPermission.enabled .Values.isolation.enabled)) }}
   - apiGroups: [""]
     resources: ["nodes/proxy"]

diff --git a/charts/k3s/templates/_helpers.tpl b/charts/k3s/templates/_helpers.tpl
@@ -58,7 +58,8 @@ Whether to create a cluster role or not
     .Values.sync.priorityclasses.enabled
     .Values.sync.volumesnapshots.enabled
     .Values.proxy.metricsServer.nodes.enabled
-    .Values.multiNamespaceMode.enabled -}}
+    .Values.multiNamespaceMode.enabled
+    .Values.coredns.plugin.enabled -}}
     {{- true -}}
 {{- end -}}
 {{- end -}}

diff --git a/charts/k3s/templates/rbac/clusterrole.yaml b/charts/k3s/templates/rbac/clusterrole.yaml
@@ -26,6 +26,11 @@ rules:
     resources: [ "pods", "nodes/metrics", "nodes/stats"]
     verbs: ["get", "watch", "list"]
   {{- end }}
+  {{- if .Values.coredns.plugin.enabled }}
+  - apiGroups: [""]
+    resources: [ "pods"]
+    verbs: ["get", "watch", "list"]
+  {{- end }}
   {{- if and (or .Values.sync.nodes.enabled .Values.rbac.clusterRole.create) (or (not .Values.isolation.enabled) (and .Values.isolation.nodeProxyPermission.enabled .Values.isolation.enabled)) }}
   - apiGroups: [""]
     resources: ["nodes/proxy"]

diff --git a/charts/k8s/templates/_helpers.tpl b/charts/k8s/templates/_helpers.tpl
@@ -58,7 +58,8 @@ Whether to create a cluster role or not
     .Values.sync.priorityclasses.enabled
     .Values.sync.volumesnapshots.enabled
     .Values.proxy.metricsServer.nodes.enabled
-    .Values.multiNamespaceMode.enabled -}}
+    .Values.multiNamespaceMode.enabled
+    .Values.coredns.plugin.enabled -}}
     {{- true -}}
 {{- end -}}
 {{- end -}}

diff --git a/charts/k8s/templates/rbac/clusterrole.yaml b/charts/k8s/templates/rbac/clusterrole.yaml
@@ -26,6 +26,11 @@ rules:
     resources: [ "pods", "nodes/metrics", "nodes/stats"]
     verbs: ["get", "watch", "list"]
   {{- end }}
+  {{- if .Values.coredns.plugin.enabled }}
+  - apiGroups: [""]
+    resources: [ "pods"]
+    verbs: ["get", "watch", "list"]
+  {{- end }}
   {{- if and (or .Values.sync.nodes.enabled .Values.rbac.clusterRole.create) (or (not .Values.isolation.enabled) (and .Values.isolation.nodeProxyPermission.enabled .Values.isolation.enabled)) }}
   - apiGroups: [""]
     resources: ["nodes/proxy"]