Merge pull request #96 from vzabawski/master

Add RBAC permissions to use API Priority and Fairness feature
syseleven · Feb 21, 2024 · c16f00f · c16f00f
2 parents 1762f14 + 507f546
commit c16f00f
Showing 1 changed file with 40 additions and 0 deletions.
diff --git a/helm/designate-certmanager-webhook/templates/rbac.yaml b/helm/designate-certmanager-webhook/templates/rbac.yaml
@@ -98,3 +98,43 @@ subjects:
     kind: ServiceAccount
     name: {{ include "designate-certmanager-webhook.fullname" . }}
     namespace: {{ .Release.Namespace }}
+---
+# Allow using API Priority and Fairness feature
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "designate-certmanager-webhook.fullname" . }}:flowcontrol-solver
+  labels:
+    app: {{ include "designate-certmanager-webhook.name" . }}
+    chart: {{ include "designate-certmanager-webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+rules:
+  - apiGroups:
+      - flowcontrol.apiserver.k8s.io
+    resources:
+      - 'flowschemas'
+      - 'prioritylevelconfigurations'
+    verbs:
+      - 'get'
+      - 'watch'
+      - 'list'
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "designate-certmanager-webhook.fullname" . }}:flowcontrol-solver
+  labels:
+    app: {{ include "designate-certmanager-webhook.name" . }}
+    chart: {{ include "designate-certmanager-webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "designate-certmanager-webhook.fullname" . }}:flowcontrol-solver
+subjects:
+  - apiGroup: ""
+    kind: ServiceAccount
+    name: {{ include "designate-certmanager-webhook.fullname" . }}
+    namespace: {{ .Release.Namespace }}