Added support for adding additional rbac rules in helm

.github/workflows/test-chart.yml

@@ -53,7 +53,6 @@ jobs:
 
       - name: Prepare nodedrain
         run: |
-          go mod tidy
           make docker-build
           kind load docker-image ${IMG_REGISTRY}${IMG_NAME_CONTROLLER}:${IMG_TAG}
 
@@ -108,3 +107,7 @@ jobs:
 #      - name: Check Presence of ServiceMonitor
 #        run: |
 #          kubectl wait --namespace nodedrain-system --for=jsonpath='{.kind}'=ServiceMonitor servicemonitor/nodedrain-controller-manager-metrics-monitor
+
+      - name: Delete kind cluster
+        run: |          
+          kind delete cluster

dist/chart/templates/rbac/role_additional.yaml

@@ -0,0 +1,85 @@
+{{- if .Values.rbac.enable }}
+{{- if gt (.Values.rbac.additional.clusterRules | default list | len) 0 }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    {{- include "chart.labels" . | nindent 4 }}
+  name: nodedrain-manager-role-additional
+rules: {{ .Values.rbac.additional.clusterRules | toYaml | nindent 2}}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    {{- include "chart.labels" . | nindent 4 }}
+  name: nodedrain-manager-rolebinding-additional
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: nodedrain-manager-role-additional
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Values.controllerManager.serviceAccountName }}
+    namespace: {{ .Release.Namespace }}
+{{- end -}}
+{{- if gt (.Values.rbac.additional.rules | default list | len) 0 }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  labels:
+    {{- include "chart.labels" . | nindent 4 }}
+  name: nodedrain-manager-role-additional
+  namespace: {{ .Release.Namespace }}
+rules: {{ .Values.rbac.additional.rules | toYaml | nindent 2}}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  labels:
+    {{- include "chart.labels" . | nindent 4 }}
+  name: nodedrain-manager-rolebinding-additional
+  namespace: {{ .Release.Namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: nodedrain-manager-role-additional
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Values.controllerManager.serviceAccountName }}
+    namespace: {{ .Release.Namespace }}
+{{- end -}}
+{{- if gt (.Values.rbac.additional.namespaces | default list | len) 0 }}
+{{- range .Values.rbac.additional.namespaces }}
+{{- if and (gt (.name | default "" | len) 0) (gt (.rules | default list | len) 0) }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  labels:
+    {{- include "chart.labels" $ | nindent 4 }}
+  name: nodedrain-manager-role-additional
+  namespace: {{ .name }}
+rules: {{ .rules | toYaml | nindent 2}}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  labels:
+    {{- include "chart.labels" $ | nindent 4 }}
+  name: nodedrain-manager-rolebinding-additional
+  namespace: {{ .name }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: nodedrain-manager-role-additional
+subjects:
+  - kind: ServiceAccount
+    name: {{ $.Values.controllerManager.serviceAccountName }}
+    namespace: {{ $.Release.Namespace }}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}

dist/chart/values.yaml

@@ -51,6 +51,15 @@ plugins: []
 # [RBAC]: To enable RBAC (Permissions) configurations
 rbac:
   enable: true
+  additional:
+    clusterRules: []
+    # Additional rules for the release namespace
+    rules: []
+
+    #    namespaces:
+    #      - name: default # Namespace to apply rules to
+    #        rules: []
+    namespaces: []
 
 # [CRDs]: To enable the CRDs
 crd: