Merge pull request #50 from cheyang/helm-chart-fluid-1.0.0-alpha.22

Update helm-chart-fluid-1.0.0-alpha.22
fluid-cloudnative · Mar 2, 2024 · dbab962 · dbab962
2 parents 683ca5a + 72402be
commit dbab962
Show file tree

Hide file tree

Showing 12 changed files with 413 additions and 40 deletions.
diff --git a/charts/fluid/Chart.yaml b/charts/fluid/Chart.yaml
@@ -14,11 +14,11 @@ type: application
 
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: 1.0.0-alpha.21
+version: 1.0.0-alpha.22
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: 1.0.0-bbab38c
+appVersion: 1.0.0-50ee888
 home: https://github.com/fluid-cloudnative/fluid
 keywords:
   - category:data

diff --git a/charts/fluid/templates/controller/juicefsruntime_controller.yaml b/charts/fluid/templates/controller/juicefsruntime_controller.yaml
@@ -54,6 +54,16 @@ spec:
           - --leader-election-namespace={{ include "fluid.namespace" . }}
         command: ["juicefsruntime-controller", "start"]
         env:
+          {{- if .Values.image.imagePullSecrets }}
+          - name: IMAGE_PULL_SECRETS
+            {{- $secretList := list }}
+            {{- range .Values.image.imagePullSecrets }}
+              {{- range $name,$v := . }}
+                {{- $secretList = append $secretList $v }}
+              {{- end }}
+            {{- end }}
+            value: {{ join "," $secretList | quote }}
+          {{- end }}
           {{- if .Values.runtime.juicefs.fuse.ceimage }}
           - name: JUICEFS_CE_IMAGE_ENV
             value: {{ .Values.runtime.juicefs.fuse.ceimage | quote }}

diff --git a/charts/fluid/templates/role/alluxio/rbac.yaml b/charts/fluid/templates/role/alluxio/rbac.yaml
@@ -95,7 +95,13 @@ rules:
       - alluxioruntimes/status
       - datasets/status
     verbs:
-      - '*'
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
   - apiGroups:
       - apps
     resources:
@@ -104,13 +110,34 @@ rules:
       - daemonsets/status
       - statefulsets/status
     verbs:
-      - '*'
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: {{ include "fluid.namespace" . }}
+  name: alluxioruntime-controller-lease-role
+rules:
   - apiGroups:
       - coordination.k8s.io
     resources:
       - leases
+    resourceNames:
+      - alluxio.data.fluid.io
     verbs:
-      - '*'
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -125,6 +152,20 @@ subjects:
     name: alluxioruntime-controller
     namespace: {{ include "fluid.namespace" . }}
 ---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: alluxioruntime-rolebinding
+  namespace: {{ include "fluid.namespace" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: alluxioruntime-controller-lease-role
+subjects:
+  - kind: ServiceAccount
+    name: alluxioruntime-controller
+    namespace: {{ include "fluid.namespace" . }}
+---
 apiVersion: v1
 kind: ServiceAccount
 metadata:

diff --git a/charts/fluid/templates/role/dataset/rbac.yaml b/charts/fluid/templates/role/dataset/rbac.yaml
@@ -104,7 +104,13 @@ rules:
       - vineyardruntimes
       - vineyardruntimes/status
     verbs:
-      - '*'
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
   - apiGroups:
       - apps
     resources:
@@ -113,7 +119,13 @@ rules:
       - daemonsets/status
       - statefulsets/status
     verbs:
-      - '*'
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
   - apiGroups:
       - apps
     resources:
@@ -126,12 +138,27 @@ rules:
       - 'watch'
       - 'update'
       - 'patch'
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: {{ include "fluid.namespace" . }}
+  name: dataset-controller-lease-role
+rules:
   - apiGroups:
       - coordination.k8s.io
     resources:
       - leases
+    resourceNames:
+      - dataset.data.fluid.io
     verbs:
-      - '*'
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -146,6 +173,20 @@ subjects:
     name: dataset-controller
     namespace: {{ include "fluid.namespace" . }}
 ---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: dataset-rolebinding
+  namespace: {{ include "fluid.namespace" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: dataset-controller-lease-role
+subjects:
+  - kind: ServiceAccount
+    name: dataset-controller
+    namespace: {{ include "fluid.namespace" . }}
+---
 apiVersion: v1
 kind: ServiceAccount
 metadata:

diff --git a/charts/fluid/templates/role/efc/rbac.yaml b/charts/fluid/templates/role/efc/rbac.yaml
@@ -94,7 +94,13 @@ rules:
       - efcruntimes/status
       - datasets/status
     verbs:
-      - '*'
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
   - apiGroups:
       - apps
     resources:
@@ -103,13 +109,34 @@ rules:
       - daemonsets/status
       - statefulsets/status
     verbs:
-      - '*'
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: {{ include "fluid.namespace" . }}
+  name: efcruntime-controller-lease-role
+rules:
   - apiGroups:
       - coordination.k8s.io
     resources:
       - leases
+    resourceNames:
+      - efc.data.fluid.io
     verbs:
-      - "*"
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -124,6 +151,20 @@ subjects:
     name: efcruntime-controller
     namespace: {{ include "fluid.namespace" . }}
 ---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: efcruntime-rolebinding
+  namespace: {{ include "fluid.namespace" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: efcruntime-controller-lease-role
+subjects:
+  - kind: ServiceAccount
+    name: efcruntime-controller
+    namespace: {{ include "fluid.namespace" . }}
+---
 apiVersion: v1
 kind: ServiceAccount
 metadata:

diff --git a/charts/fluid/templates/role/fluidapp/rbac.yaml b/charts/fluid/templates/role/fluidapp/rbac.yaml
@@ -38,13 +38,34 @@ rules:
     resources:
       - configmaps
     verbs:
-      - "*"
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: {{ include "fluid.namespace" . }}
+  name: fluidapp-controller-lease-role
+rules:
   - apiGroups:
       - coordination.k8s.io
     resources:
       - leases
+    resourceNames:
+      - fluidapp.data.fluid.io
     verbs:
-      - "*"
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -59,6 +80,20 @@ subjects:
     name: fluidapp-controller
     namespace: {{ include "fluid.namespace" . }}
 ---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: fluidapp-rolebinding
+  namespace: {{ include "fluid.namespace" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: fluidapp-controller-lease-role
+subjects:
+  - kind: ServiceAccount
+    name: fluidapp-controller
+    namespace: {{ include "fluid.namespace" . }}
+---
 apiVersion: v1
 kind: ServiceAccount
 metadata:

diff --git a/charts/fluid/templates/role/goosefs/rbac.yaml b/charts/fluid/templates/role/goosefs/rbac.yaml
@@ -105,7 +105,13 @@ rules:
       - goosefsruntimes/status
       - datasets/status
     verbs:
-      - '*'
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
   - apiGroups:
       - apps
     resources:
@@ -114,13 +120,34 @@ rules:
       - daemonsets/status
       - statefulsets/status
     verbs:
-      - '*'
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: {{ include "fluid.namespace" . }}
+  name: goosefsruntime-controller-lease-role
+rules:
   - apiGroups:
       - coordination.k8s.io
     resources:
       - leases
+    resourceNames:
+      - goosefs.data.fluid.io
     verbs:
-      - '*'
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -135,6 +162,20 @@ subjects:
     name: goosefsruntime-controller
     namespace: {{ include "fluid.namespace" . }}
 ---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: goosefsruntime-rolebinding
+  namespace: {{ include "fluid.namespace" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: goosefsruntime-controller-lease-role
+subjects:
+  - kind: ServiceAccount
+    name: goosefsruntime-controller
+    namespace: {{ include "fluid.namespace" . }}
+---
 apiVersion: v1
 kind: ServiceAccount
 metadata: