[stable/dex] Configured more specific roles and cluster roles (helm#1…

…0446)

* Configured more specific roles and cluster roles

Based on new ClusterRole at
https://github.com/dexidp/dex/blob/master/examples/k8s/dex.yaml
with a Role to allow the jobs to create and delete secrets

Signed-off-by: Peter Nordquist <[email protected]>

* Updated RBAC API to v1

Signed-off-by: Peter Nordquist <[email protected]>

* Updated deployment apiVersion to v1

Signed-off-by: Peter Nordquist <[email protected]>

* Bumped chart version, this is not a bug fix

Signed-off-by: Peter Nordquist <[email protected]>

* Revert "Updated deployment apiVersion to v1"

This reverts commit 77aec99.

Signed-off-by: Peter Nordquist <[email protected]>

stable/dex/Chart.yaml

@@ -1,5 +1,5 @@
 name: dex
-version: 0.7.0
+version: 0.8.0
 appVersion: 2.14.0
 description: CoreOS Dex
 keywords:

stable/dex/templates/clusterrole.yaml

@@ -0,0 +1,18 @@
+{{- if .Values.rbac.create }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app: {{ template "dex.name" . }}
+    chart: {{ template "dex.chart" . }}
+    heritage: "{{ .Release.Service }}"
+    release: "{{ .Release.Name }}"
+  name: {{ template "dex.fullname" . }}
+rules:
+- apiGroups: ["dex.coreos.com"] # API group created by dex
+  resources: ["*"]
+  verbs: ["*"]
+- apiGroups: ["apiextensions.k8s.io"]
+  resources: ["customresourcedefinitions"]
+  verbs: ["create"] # To manage its own resources, dex must be able to create customresourcedefinitions
+{{- end -}}

stable/dex/templates/clusterrolebinding.yaml

@@ -0,0 +1,19 @@
+{{- if .Values.rbac.create }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app: {{ template "dex.name" . }}
+    chart: {{ template "dex.chart" . }}
+    heritage: "{{ .Release.Service }}"
+    release: "{{ .Release.Name }}"
+  name: {{ template "dex.fullname" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "dex.fullname" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "dex.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end -}}

stable/dex/templates/role.yaml

@@ -0,0 +1,18 @@
+{{- if .Values.rbac.create }}
+{{- if or .Values.certs.grpc.create .Values.certs.web.create }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  labels:
+    app: {{ template "dex.name" . }}
+    chart: {{ template "dex.chart" . }}
+    heritage: "{{ .Release.Service }}"
+    release: "{{ .Release.Name }}"
+  name: {{ template "dex.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+rules:
+- apiGroups: [""]
+  resources: ["configmaps", "secrets"]
+  verbs: ["create", "delete"]
+{{- end -}}
+{{- end -}}

stable/dex/templates/rolebinding.yaml

@@ -1,19 +1,22 @@
 {{- if .Values.rbac.create }}
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: ClusterRoleBinding
+{{- if or .Values.certs.grpc.create .Values.certs.web.create }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
 metadata:
   labels:
     app: {{ template "dex.name" . }}
     chart: {{ template "dex.chart" . }}
     heritage: "{{ .Release.Service }}"
     release: "{{ .Release.Name }}"
   name: {{ template "dex.fullname" . }}
+  namespace: {{ .Release.Namespace }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: cluster-admin
+  kind: Role
+  name: {{ template "dex.fullname" . }}
 subjects:
   - kind: ServiceAccount
     name: {{ template "dex.serviceAccountName" . }}
     namespace: {{ .Release.Namespace }}
 {{- end -}}
+{{- end -}}