| 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126 |
- {{- if and .Values.certController.create .Values.certController.rbac.create (not .Values.webhook.certManager.enabled) -}}
- apiVersion: rbac.authorization.k8s.io/v1
- kind: ClusterRole
- metadata:
- name: {{ include "external-secrets.fullname" . }}-cert-controller
- labels:
- {{- include "external-secrets-cert-controller.labels" . | nindent 4 }}
- rules:
- - apiGroups:
- - "apiextensions.k8s.io"
- resources:
- - "customresourcedefinitions"
- verbs:
- - "get"
- - "list"
- - "watch"
- - apiGroups:
- - "apiextensions.k8s.io"
- resources:
- - "customresourcedefinitions"
- resourceNames:
- - "externalsecrets.external-secrets.io"
- - "secretstores.external-secrets.io"
- {{- if .Values.crds.createClusterSecretStore }}
- - "clustersecretstores.external-secrets.io"
- {{- end }}
- verbs:
- - "update"
- - "patch"
- - apiGroups:
- - "admissionregistration.k8s.io"
- resources:
- - "validatingwebhookconfigurations"
- verbs:
- - "list"
- - "watch"
- - "get"
- - apiGroups:
- - "admissionregistration.k8s.io"
- resources:
- - "validatingwebhookconfigurations"
- resourceNames:
- - "secretstore-validate"
- - "externalsecret-validate"
- verbs:
- - "update"
- - "patch"
- - apiGroups:
- - ""
- resources:
- - "endpoints"
- verbs:
- - "list"
- - "get"
- - "watch"
- - apiGroups:
- - "discovery.k8s.io"
- resources:
- - "endpointslices"
- verbs:
- - "list"
- - "get"
- - "watch"
- - apiGroups:
- - ""
- resources:
- - "events"
- verbs:
- - "create"
- - "patch"
- - apiGroups:
- - ""
- resources:
- - "secrets"
- verbs:
- - "get"
- - "list"
- - "watch"
- - apiGroups:
- - ""
- resources:
- - "secrets"
- resourceNames:
- - {{ printf "%s-webhook" (include "external-secrets.fullname" .) | quote }}
- verbs:
- - "update"
- - "patch"
- - apiGroups:
- - "coordination.k8s.io"
- resources:
- - "leases"
- verbs:
- - "get"
- - "create"
- - "update"
- - "patch"
- {{- if .Values.certController.metrics.listen.auth.enabled }}
- - apiGroups:
- - "authentication.k8s.io"
- resources:
- - "tokenreviews"
- verbs:
- - "create"
- - apiGroups:
- - "authorization.k8s.io"
- resources:
- - "subjectaccessreviews"
- verbs:
- - "create"
- {{- end }}
- ---
- apiVersion: rbac.authorization.k8s.io/v1
- kind: ClusterRoleBinding
- metadata:
- name: {{ include "external-secrets.fullname" . }}-cert-controller
- labels:
- {{- include "external-secrets-cert-controller.labels" . | nindent 4 }}
- roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: ClusterRole
- name: {{ include "external-secrets.fullname" . }}-cert-controller
- subjects:
- - name: {{ include "external-secrets-cert-controller.serviceAccountName" . }}
- namespace: {{ template "external-secrets.namespace" . }}
- kind: ServiceAccount
- {{- end }}
|
