| 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778 |
- {{- if and .Values.certController.create .Values.certController.rbac.create (not .Values.webhook.certManager.enabled) -}}
- apiVersion: rbac.authorization.k8s.io/v1
- kind: ClusterRole
- metadata:
- name: {{ include "external-secrets.fullname" . }}-cert-controller
- labels:
- {{- include "external-secrets-cert-controller.labels" . | nindent 4 }}
- rules:
- - apiGroups:
- - "apiextensions.k8s.io"
- resources:
- - "customresourcedefinitions"
- verbs:
- - "get"
- - "list"
- - "watch"
- - "update"
- - "patch"
- - apiGroups:
- - "admissionregistration.k8s.io"
- resources:
- - "validatingwebhookconfigurations"
- verbs:
- - "get"
- - "list"
- - "watch"
- - "update"
- - "patch"
- - apiGroups:
- - ""
- resources:
- - "endpoints"
- verbs:
- - "list"
- - "get"
- - "watch"
- - apiGroups:
- - ""
- resources:
- - "events"
- verbs:
- - "create"
- - "patch"
- - apiGroups:
- - ""
- resources:
- - "secrets"
- verbs:
- - "get"
- - "list"
- - "watch"
- - "update"
- - "patch"
- - apiGroups:
- - "coordination.k8s.io"
- resources:
- - "leases"
- verbs:
- - "get"
- - "create"
- - "update"
- - "patch"
- ---
- apiVersion: rbac.authorization.k8s.io/v1
- kind: ClusterRoleBinding
- metadata:
- name: {{ include "external-secrets.fullname" . }}-cert-controller
- labels:
- {{- include "external-secrets-cert-controller.labels" . | nindent 4 }}
- roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: {{ include "external-secrets.fullname" . }}-cert-controller
- subjects:
- - name: {{ include "external-secrets-cert-controller.serviceAccountName" . }}
- namespace: {{ .Release.Namespace | quote }}
- kind: ServiceAccount
- {{- end }}
|
