feat: customizable RBAC templates

charts/kor/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: kor
 description: A Kubernetes Helm Chart to discover orphaned resources using kor
 type: application
-version: 0.2.13
+version: 0.2.14
 appVersion: "0.6.7"
 maintainers:
   - name: "yonahd"

charts/kor/README.md

@@ -1,6 +1,6 @@
 # kor
 
-![Version: 0.2.13](https://img.shields.io/badge/Version-0.2.13-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.6.7](https://img.shields.io/badge/AppVersion-0.6.7-informational?style=flat-square)
+![Version: 0.2.14](https://img.shields.io/badge/Version-0.2.14-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.6.7](https://img.shields.io/badge/AppVersion-0.6.7-informational?style=flat-square)
 
 A Kubernetes Helm Chart to discover orphaned resources using kor
 
@@ -62,6 +62,8 @@ A Kubernetes Helm Chart to discover orphaned resources using kor
 | prometheusExporter.serviceMonitor.targetLabels | list | `[]` | Set of labels to transfer on the Kubernetes Service onto the target. |
 | prometheusExporter.serviceMonitor.telemetryPath | string | `"/metrics"` |  |
 | prometheusExporter.serviceMonitor.timeout | string | `"10s"` | Set timeout for scrape |
+| rbac.create | bool | `true` | Create Role and/or ClusterRole (true, false, "clusterrole" or "role") |
+| rbac.rules | list | `[{"apiGroups":[""],"resources":["pods","configmaps","secrets","services","serviceaccounts","persistentvolumeclaims","endpoints","namespaces","persistentvolumes"]},{"apiGroups":["apps"],"resources":["deployments","statefulsets","replicasets","daemonsets"]},{"apiGroups":["networking.k8s.io"],"resources":["ingresses","networkpolicies"]},{"apiGroups":["rbac.authorization.k8s.io"],"resources":["roles","rolebindings","clusterroles","clusterrolebindings"]},{"apiGroups":["autoscaling"],"resources":["horizontalpodautoscalers"]},{"apiGroups":["policy"],"resources":["poddisruptionbudgets"]},{"apiGroups":["batch"],"resources":["jobs"]},{"apiGroups":["discovery.k8s.io"],"resources":["endpointslices"]},{"apiGroups":["storage.k8s.io"],"resources":["storageclasses","volumeattachments"]},{"apiGroups":["scheduling.k8s.io"],"resources":["priorityclasses"]},{"apiGroups":["apiextensions.k8s.io"],"resources":["customresourcedefinitions"]}]` | Verbs default to [get, list, watch] if not specified |
 | serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
 | serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
 | serviceAccount.name | string | `""` | If not set and create is true, a name is generated using the fullname template |

charts/kor/templates/_helpers.tpl

@@ -74,3 +74,41 @@ Create the name of the service account to use
 {{- default "default" .Values.serviceAccount.name }}
 {{- end }}
 {{- end }}
+
+{{/*
+Check if Role should be created
+*/}}
+{{- define "kor.createRole" -}}
+{{- $create := .Values.rbac.create -}}
+{{- if or (eq (toString $create) "true") (eq $create "role") }}true{{- end }}
+{{- end }}
+
+{{/*
+Check if ClusterRole should be created
+*/}}
+{{- define "kor.createClusterRole" -}}
+{{- $create := .Values.rbac.create -}}
+{{- if or (eq (toString $create) "true") (eq $create "clusterrole") }}true{{- end }}
+{{- end }}
+
+{{/*
+Generate resource rules
+*/}}
+{{- define "kor.resourceRules" -}}
+{{- range .Values.rbac.rules }}
+- apiGroups:
+{{- range .apiGroups }}
+    - {{ . | quote }}
+{{- end }}
+  resources:
+    {{- toYaml .resources | nindent 4 }}
+  verbs:
+  {{- if .verbs }}
+    {{- toYaml .verbs | nindent 4 }}
+  {{- else }}
+    - get
+    - list
+    - watch
+  {{- end }}
+{{- end }}
+{{- end }}

charts/kor/templates/role.yaml

@@ -1,3 +1,4 @@
+{{- if include "kor.createRole" . }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
@@ -6,31 +7,9 @@ metadata:
   labels:
     {{- include "kor.labels" . | nindent 4 }}
 rules:
-  - apiGroups: ["*"]
-    resources:
-      - pods
-      - configmaps
-      - secrets
-      - services
-      - serviceaccounts
-      - deployments
-      - statefulsets
-      - roles
-      - rolebindings
-      - horizontalpodautoscalers
-      - persistentvolumeclaims
-      - ingresses
-      - poddisruptionbudgets
-      - endpoints
-      - endpointslices
-      - jobs
-      - replicasets
-      - daemonsets
-      - networkpolicies
-    verbs:
-      - get
-      - list
-      - watch
+{{ include "kor.resourceRules" . | nindent 2 }}
+{{- end }}
+{{- if include "kor.createClusterRole" . }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
@@ -39,37 +18,5 @@ metadata:
   labels:
     {{- include "kor.labels" . | nindent 4 }}
 rules:
-  - apiGroups: ["*"]
-    resources:
-      - pods
-      - configmaps
-      - secrets
-      - services
-      - serviceaccounts
-      - deployments
-      - statefulsets
-      - roles
-      - rolebindings
-      - horizontalpodautoscalers
-      - persistentvolumeclaims
-      - ingresses
-      - poddisruptionbudgets
-      - endpoints
-      - endpointslices
-      - jobs
-      - replicasets
-      - daemonsets
-      - networkpolicies
-      {{/* cluster-scoped resources */}}
-      - namespaces
-      - clusterroles
-      - clusterrolebindings
-      - persistentvolumes
-      - customresourcedefinitions
-      - storageclasses
-      - volumeattachments
-      - priorityclasses
-    verbs:
-      - get
-      - list
-      - watch
+{{ include "kor.resourceRules" . | nindent 2 }}
+{{- end }}

charts/kor/templates/rolebinding.yaml

@@ -1,3 +1,4 @@
+{{- if include "kor.createRole" . }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -12,6 +13,8 @@ roleRef:
   kind: Role
   name: {{ include "kor.serviceAccountName" . }}-read-resources-role
   apiGroup: rbac.authorization.k8s.io
+{{- end }}
+{{- if include "kor.createClusterRole" . }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -27,3 +30,4 @@ roleRef:
   kind: ClusterRole
   name: {{ include "kor.serviceAccountName" . }}-read-resources-clusterrole
   apiGroup: rbac.authorization.k8s.io
+{{- end }}

charts/kor/values.yaml

@@ -101,3 +101,42 @@ serviceAccount:
   # -- The name of the service account to use.
   # -- If not set and create is true, a name is generated using the fullname template
   name: ""
+
+rbac:
+  # -- Create Role and/or ClusterRole (true, false, "clusterrole" or "role")
+  create: true
+  # -- RBAC rules with proper API group to resource mappings
+  # -- Verbs default to [get, list, watch] if not specified
+  rules:
+    - apiGroups: [""]
+      resources: ["pods", "configmaps", "secrets", "services", "serviceaccounts", "persistentvolumeclaims", "endpoints", "namespaces", "persistentvolumes"]
+
+    - apiGroups: ["apps"]
+      resources: ["deployments", "statefulsets", "replicasets", "daemonsets"]
+
+    - apiGroups: ["networking.k8s.io"]
+      resources: ["ingresses", "networkpolicies"]
+
+    - apiGroups: ["rbac.authorization.k8s.io"]
+      resources: ["roles", "rolebindings", "clusterroles", "clusterrolebindings"]
+
+    - apiGroups: ["autoscaling"]
+      resources: ["horizontalpodautoscalers"]
+
+    - apiGroups: ["policy"]
+      resources: ["poddisruptionbudgets"]
+
+    - apiGroups: ["batch"]
+      resources: ["jobs"]
+
+    - apiGroups: ["discovery.k8s.io"]
+      resources: ["endpointslices"]
+
+    - apiGroups: ["storage.k8s.io"]
+      resources: ["storageclasses", "volumeattachments"]
+
+    - apiGroups: ["scheduling.k8s.io"]
+      resources: ["priorityclasses"]
+
+    - apiGroups: ["apiextensions.k8s.io"]
+      resources: ["customresourcedefinitions"]