Grant cluster wide crd access to deploy roles

thoughtbot · Oct 24, 2024 · 7166af6 · 7166af6
1 parent 8b85174
commit 7166af6
Showing 1 changed file with 33 additions and 2 deletions.
diff --git a/aws/deploy-role-bindings/main.tf b/aws/deploy-role-bindings/main.tf
@@ -1,9 +1,8 @@
-resource "kubernetes_role_binding" "cluster" {
+resource "kubernetes_cluster_role_binding" "cluster" {
   for_each = toset(var.cluster_roles)
 
   metadata {
     name      = var.name
-    namespace = var.namespace
   }
 
   role_ref {
@@ -19,6 +18,38 @@ resource "kubernetes_role_binding" "cluster" {
   }
 }
 
+resource "kubernetes_cluster_role" "cluster_crd" {
+  metadata {
+    name = "${var.name}-cluster-crd"
+  }
+
+  rule {
+    api_groups = ["apiextensions.k8s.io"]
+    resources  = ["customresourcedefinitions"]
+    verbs      = ["get", "list"]
+  }
+}
+
+resource "kubernetes_cluster_role_binding" "cluster_crd" {
+  metadata {
+    name      = "${var.name}-cluster-crd"
+  }
+
+  role_ref {
+    api_group = "rbac.authorization.k8s.io"
+    kind      = "ClusterRole"
+    name      = "${var.name}-cluster-crd"
+  }
+
+  subject {
+    kind      = "Group"
+    name      = var.group
+    api_group = "rbac.authorization.k8s.io"
+  }
+
+  depends_on = [ kubernetes_cluster_role.cluster_crd ]
+}
+
 resource "kubernetes_role_binding" "crd" {
   metadata {
     name      = kubernetes_role.deploy_crd.metadata[0].name