diff --git a/charts/kor/Chart.yaml b/charts/kor/Chart.yaml index f91c8eb8..6f0a38ac 100644 --- a/charts/kor/Chart.yaml +++ b/charts/kor/Chart.yaml @@ -2,7 +2,7 @@ apiVersion: v2 name: kor description: A Kubernetes Helm Chart to discover orphaned resources using kor type: application -version: 0.2.13 +version: 0.2.14 appVersion: "0.6.7" maintainers: - name: "yonahd" diff --git a/charts/kor/README.md b/charts/kor/README.md index 230607f5..203e9c4f 100644 --- a/charts/kor/README.md +++ b/charts/kor/README.md @@ -1,6 +1,6 @@ # kor -![Version: 0.2.13](https://img.shields.io/badge/Version-0.2.13-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.6.7](https://img.shields.io/badge/AppVersion-0.6.7-informational?style=flat-square) +![Version: 0.2.14](https://img.shields.io/badge/Version-0.2.14-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.6.7](https://img.shields.io/badge/AppVersion-0.6.7-informational?style=flat-square) A Kubernetes Helm Chart to discover orphaned resources using kor @@ -62,6 +62,8 @@ A Kubernetes Helm Chart to discover orphaned resources using kor | prometheusExporter.serviceMonitor.targetLabels | list | `[]` | Set of labels to transfer on the Kubernetes Service onto the target. | | prometheusExporter.serviceMonitor.telemetryPath | string | `"/metrics"` | | | prometheusExporter.serviceMonitor.timeout | string | `"10s"` | Set timeout for scrape | +| rbac.create | bool | `true` | Create Role and/or ClusterRole (true, false, "clusterrole" or "role") | +| rbac.rules | list | `[{"apiGroups":[""],"resources":["pods","configmaps","secrets","services","serviceaccounts","persistentvolumeclaims","endpoints","namespaces","persistentvolumes"]},{"apiGroups":["apps"],"resources":["deployments","statefulsets","replicasets","daemonsets"]},{"apiGroups":["networking.k8s.io"],"resources":["ingresses","networkpolicies"]},{"apiGroups":["rbac.authorization.k8s.io"],"resources":["roles","rolebindings","clusterroles","clusterrolebindings"]},{"apiGroups":["autoscaling"],"resources":["horizontalpodautoscalers"]},{"apiGroups":["policy"],"resources":["poddisruptionbudgets"]},{"apiGroups":["batch"],"resources":["jobs"]},{"apiGroups":["discovery.k8s.io"],"resources":["endpointslices"]},{"apiGroups":["storage.k8s.io"],"resources":["storageclasses","volumeattachments"]},{"apiGroups":["scheduling.k8s.io"],"resources":["priorityclasses"]},{"apiGroups":["apiextensions.k8s.io"],"resources":["customresourcedefinitions"]}]` | Verbs default to [get, list, watch] if not specified | | serviceAccount.annotations | object | `{}` | Annotations to add to the service account | | serviceAccount.create | bool | `true` | Specifies whether a service account should be created | | serviceAccount.name | string | `""` | If not set and create is true, a name is generated using the fullname template | diff --git a/charts/kor/templates/_helpers.tpl b/charts/kor/templates/_helpers.tpl index d33123b0..ff1e3c53 100644 --- a/charts/kor/templates/_helpers.tpl +++ b/charts/kor/templates/_helpers.tpl @@ -74,3 +74,41 @@ Create the name of the service account to use {{- default "default" .Values.serviceAccount.name }} {{- end }} {{- end }} + +{{/* +Check if Role should be created +*/}} +{{- define "kor.createRole" -}} +{{- $create := .Values.rbac.create -}} +{{- if or (eq (toString $create) "true") (eq $create "role") }}true{{- end }} +{{- end }} + +{{/* +Check if ClusterRole should be created +*/}} +{{- define "kor.createClusterRole" -}} +{{- $create := .Values.rbac.create -}} +{{- if or (eq (toString $create) "true") (eq $create "clusterrole") }}true{{- end }} +{{- end }} + +{{/* +Generate resource rules +*/}} +{{- define "kor.resourceRules" -}} +{{- range .Values.rbac.rules }} +- apiGroups: +{{- range .apiGroups }} + - {{ . | quote }} +{{- end }} + resources: + {{- toYaml .resources | nindent 4 }} + verbs: + {{- if .verbs }} + {{- toYaml .verbs | nindent 4 }} + {{- else }} + - get + - list + - watch + {{- end }} +{{- end }} +{{- end }} diff --git a/charts/kor/templates/role.yaml b/charts/kor/templates/role.yaml index 84dea7e5..662bddca 100644 --- a/charts/kor/templates/role.yaml +++ b/charts/kor/templates/role.yaml @@ -1,3 +1,4 @@ +{{- if include "kor.createRole" . }} --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role @@ -6,31 +7,9 @@ metadata: labels: {{- include "kor.labels" . | nindent 4 }} rules: - - apiGroups: ["*"] - resources: - - pods - - configmaps - - secrets - - services - - serviceaccounts - - deployments - - statefulsets - - roles - - rolebindings - - horizontalpodautoscalers - - persistentvolumeclaims - - ingresses - - poddisruptionbudgets - - endpoints - - endpointslices - - jobs - - replicasets - - daemonsets - - networkpolicies - verbs: - - get - - list - - watch +{{ include "kor.resourceRules" . | nindent 2 }} +{{- end }} +{{- if include "kor.createClusterRole" . }} --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole @@ -39,37 +18,5 @@ metadata: labels: {{- include "kor.labels" . | nindent 4 }} rules: - - apiGroups: ["*"] - resources: - - pods - - configmaps - - secrets - - services - - serviceaccounts - - deployments - - statefulsets - - roles - - rolebindings - - horizontalpodautoscalers - - persistentvolumeclaims - - ingresses - - poddisruptionbudgets - - endpoints - - endpointslices - - jobs - - replicasets - - daemonsets - - networkpolicies - {{/* cluster-scoped resources */}} - - namespaces - - clusterroles - - clusterrolebindings - - persistentvolumes - - customresourcedefinitions - - storageclasses - - volumeattachments - - priorityclasses - verbs: - - get - - list - - watch +{{ include "kor.resourceRules" . | nindent 2 }} +{{- end }} diff --git a/charts/kor/templates/rolebinding.yaml b/charts/kor/templates/rolebinding.yaml index 43a63f9e..a0cddcca 100644 --- a/charts/kor/templates/rolebinding.yaml +++ b/charts/kor/templates/rolebinding.yaml @@ -1,3 +1,4 @@ +{{- if include "kor.createRole" . }} --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding @@ -12,6 +13,8 @@ roleRef: kind: Role name: {{ include "kor.serviceAccountName" . }}-read-resources-role apiGroup: rbac.authorization.k8s.io +{{- end }} +{{- if include "kor.createClusterRole" . }} --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -27,3 +30,4 @@ roleRef: kind: ClusterRole name: {{ include "kor.serviceAccountName" . }}-read-resources-clusterrole apiGroup: rbac.authorization.k8s.io +{{- end }} diff --git a/charts/kor/values.yaml b/charts/kor/values.yaml index 55e1ab92..866a0a70 100644 --- a/charts/kor/values.yaml +++ b/charts/kor/values.yaml @@ -101,3 +101,42 @@ serviceAccount: # -- The name of the service account to use. # -- If not set and create is true, a name is generated using the fullname template name: "" + +rbac: + # -- Create Role and/or ClusterRole (true, false, "clusterrole" or "role") + create: true + # -- RBAC rules with proper API group to resource mappings + # -- Verbs default to [get, list, watch] if not specified + rules: + - apiGroups: [""] + resources: ["pods", "configmaps", "secrets", "services", "serviceaccounts", "persistentvolumeclaims", "endpoints", "namespaces", "persistentvolumes"] + + - apiGroups: ["apps"] + resources: ["deployments", "statefulsets", "replicasets", "daemonsets"] + + - apiGroups: ["networking.k8s.io"] + resources: ["ingresses", "networkpolicies"] + + - apiGroups: ["rbac.authorization.k8s.io"] + resources: ["roles", "rolebindings", "clusterroles", "clusterrolebindings"] + + - apiGroups: ["autoscaling"] + resources: ["horizontalpodautoscalers"] + + - apiGroups: ["policy"] + resources: ["poddisruptionbudgets"] + + - apiGroups: ["batch"] + resources: ["jobs"] + + - apiGroups: ["discovery.k8s.io"] + resources: ["endpointslices"] + + - apiGroups: ["storage.k8s.io"] + resources: ["storageclasses", "volumeattachments"] + + - apiGroups: ["scheduling.k8s.io"] + resources: ["priorityclasses"] + + - apiGroups: ["apiextensions.k8s.io"] + resources: ["customresourcedefinitions"]