Role and RoleBinding support

[JuniorJPDJ]

Details

Describe the solution you'd like:

Support for creating Role and assigning this role to ServiceAccount using RoleBinding

Additional Information:

This is handy with some pre-install/pre-upgrade jobs initializing secrets/configMaps

[onedr0p]

This could be solved by #314 maybe?

[JuniorJPDJ]

Not really, as I'm not talking about app-template, just about the common library. I'm anyway writing own chart using the library so I can add role myself using normal templates. Roles are pretty much common tho so I was thinking that adding those to the library for ease of use would be cool.

[bjw-s]

I'm definitely open to adding it, I'm just not sure (yet) what the cleanest way of exposing it through the values.yaml would be. Currently thinking of something like this:

roles:
  blah:
    clusterWide: false
    rules:
      - apiGroups:
        - ""
        resources:
          - pods
        verbs:
          - get

roleBindings:
  blah:
    clusterWide: false
    roleRef:
      kind: Role
      identifier: blah
      # name: optional role name instead of identifier
    subjects:
      - kind: User
        name: bjw-s

[JuniorJPDJ]

If you want to allow multiple roles and bindings, maybe you should also consider multiple serviceaccounts support

[bjw-s]

While maybe true, I don't think I could easily add that without breaking changes. I'll take a look at it

[LarryGF]

I have a Role/Rolebinding implementation in my fork, I could create a PR if you want. This would be the values.yaml structure:

# -- Configure the Roles and Role Bindings for the chart here.
rbac:
  {}
  # roles:
  #   role1:
  #     # -- Enables or disables the Role
  #     enabled: true
  #     # -- Set to Role,ClusterRole
  #     type: Role
  #     rules:
  #       - apiGroups: ["*"]
  #         resources: ["*"]
  #         verbs: ["get", "list", "watch"]
  # bindings:
  #   binding1:
  #     # -- Enables or disables the Role
  #     enabled: true
  #     # -- Set to RoleBinding,ClusterRoleBinding
  #     type: RoleBinding
  #     # -- Can be an identifier of rbac.roles or a custom name and kind
  #     roleRef:
  #       name: test-role
  #       kind: Role
  #       identifier: test
  #     # -- Needs to be explicitly declared for now 
  #     subjects:
  #       - kind: ServiceAccount
  #         name: test
  #         namespace: "{{ .Release.Namespace }}"

It would be nice to add multiple ServiceAccount support as well to make it easier to add it in the roles (I'm working on that in my fork, but can't find an elegant way of integrating it with the pods, I'll update if I can think of anything interesting)

[manisha-tanwar]

@LarryGF I also want to use roles/rolebinding but can't find it in your forked repo. Would you mind sharing it please.
Thanks!