Skip to content
Snippets Groups Projects
Commit 08fa1a29 authored by Sören Henning's avatar Sören Henning
Browse files

Merge branch 'feature/388-enhance-strimzi-helm-chart' into 'master' 

Helm: Downgrade needed perimsions for Strimzi Installation

Closes #388

See merge request !284
parents 0933a028 07bb474f
No related branches found
No related tags found
1 merge request!284Helm: Downgrade needed perimsions for Strimzi Installation
Pipeline #8604 passed
Stage: build
    Stage: test
      Stage: check
        Stage: deploy
          Stage: smoketest
            Hide whitespace changes
            Inline Side-by-side
            helm/templates/strimzi/entity-role-binding.yaml 0 → 100644
            + 18
            − 0
            View file @ 08fa1a29
            {{- if not (index .Values "strimzi-kafka-operator" "createGlobalResources") -}}
            apiVersion: rbac.authorization.k8s.io/v1
            kind: RoleBinding
            metadata:
            labels:
            app: strimzi
            name: strimzi-cluster-operator-entity-operator-delegation-namespaced
            namespace: {{ .Release.Namespace }}
            roleRef:
            apiGroup: rbac.authorization.k8s.io
            kind: Role
            name: strimzi-entity-operator-namespaced
            subjects:
            - kind: ServiceAccount
            name: strimzi-cluster-operator
            namespace: {{ .Release.Namespace }}
            {{- end }}
            helm/templates/strimzi/entity-role.yaml 0 → 100644
            + 46
            − 0
            View file @ 08fa1a29
            {{- if not (index .Values "strimzi-kafka-operator" "createGlobalResources") -}}
            apiVersion: rbac.authorization.k8s.io/v1
            kind: Role
            metadata:
            name: strimzi-entity-operator-namespaced
            labels:
            app: {{ template "theodolite.name" . }}-strimzi
            rules:
            - apiGroups:
            - "kafka.strimzi.io"
            resources:
            # The entity operator runs the KafkaTopic assembly operator, which needs to access and manage KafkaTopic resources
            - kafkatopics
            - kafkatopics/status
            # The entity operator runs the KafkaUser assembly operator, which needs to access and manage KafkaUser resources
            - kafkausers
            - kafkausers/status
            verbs:
            - get
            - list
            - watch
            - create
            - patch
            - update
            - delete
            - apiGroups:
            - ""
            resources:
            - events
            verbs:
            # The entity operator needs to be able to create events
            - create
            - apiGroups:
            - ""
            resources:
            # The entity operator user-operator needs to access and manage secrets to store generated credentials
            - secrets
            verbs:
            - get
            - list
            - watch
            - create
            - delete
            - patch
            - update
            {{- end }}
            helm/templates/strimzi/operator-role-binding.yaml 0 → 100644
            + 18
            − 0
            View file @ 08fa1a29
            {{- if not (index .Values "strimzi-kafka-operator" "createGlobalResources") -}}
            apiVersion: rbac.authorization.k8s.io/v1
            kind: RoleBinding
            metadata:
            labels:
            app: strimzi
            name: strimzi-cluster-operator-namespaced
            namespace: {{ .Release.Namespace }}
            roleRef:
            apiGroup: rbac.authorization.k8s.io
            kind: Role
            name: strimzi-cluster-operator-namespaced
            subjects:
            - kind: ServiceAccount
            name: strimzi-cluster-operator
            namespace: {{ .Release.Namespace }}
            {{- end }}
            helm/templates/strimzi/operator-role.yaml 0 → 100644
            + 213
            − 0
            View file @ 08fa1a29
            {{- if not (index .Values "strimzi-kafka-operator" "createGlobalResources") -}}
            apiVersion: rbac.authorization.k8s.io/v1
            kind: Role
            metadata:
            name: strimzi-cluster-operator-namespaced
            labels:
            app: strimzi-cluster-operator-namespaced
            rules:
            - apiGroups:
            - "rbac.authorization.k8s.io"
            resources:
            # The cluster operator needs to access and manage rolebindings to grant Strimzi components cluster permissions
            - rolebindings
            verbs:
            - get
            - list
            - watch
            - create
            - delete
            - patch
            - update
            - apiGroups:
            - "rbac.authorization.k8s.io"
            resources:
            # The cluster operator needs to access and manage roles to grant the entity operator permissions
            - roles
            verbs:
            - get
            - list
            - watch
            - create
            - delete
            - patch
            - update
            - apiGroups:
            - ""
            resources:
            # The cluster operator needs to access and delete pods, this is to allow it to monitor pod health and coordinate rolling updates
            - pods
            # The cluster operator needs to access and manage service accounts to grant Strimzi components cluster permissions
            - serviceaccounts
            # The cluster operator needs to access and manage config maps for Strimzi components configuration
            - configmaps
            # The cluster operator needs to access and manage services and endpoints to expose Strimzi components to network traffic
            - services
            - endpoints
            # The cluster operator needs to access and manage secrets to handle credentials
            - secrets
            # The cluster operator needs to access and manage persistent volume claims to bind them to Strimzi components for persistent data
            - persistentvolumeclaims
            verbs:
            - get
            - list
            - watch
            - create
            - delete
            - patch
            - update
            - apiGroups:
            - "kafka.strimzi.io"
            resources:
            # The cluster operator runs the KafkaAssemblyOperator, which needs to access and manage Kafka resources
            - kafkas
            - kafkas/status
            # The cluster operator runs the KafkaConnectAssemblyOperator, which needs to access and manage KafkaConnect resources
            - kafkaconnects
            - kafkaconnects/status
            # The cluster operator runs the KafkaConnectorAssemblyOperator, which needs to access and manage KafkaConnector resources
            - kafkaconnectors
            - kafkaconnectors/status
            # The cluster operator runs the KafkaMirrorMakerAssemblyOperator, which needs to access and manage KafkaMirrorMaker resources
            - kafkamirrormakers
            - kafkamirrormakers/status
            # The cluster operator runs the KafkaBridgeAssemblyOperator, which needs to access and manage BridgeMaker resources
            - kafkabridges
            - kafkabridges/status
            # The cluster operator runs the KafkaMirrorMaker2AssemblyOperator, which needs to access and manage KafkaMirrorMaker2 resources
            - kafkamirrormaker2s
            - kafkamirrormaker2s/status
            # The cluster operator runs the KafkaRebalanceAssemblyOperator, which needs to access and manage KafkaRebalance resources
            - kafkarebalances
            - kafkarebalances/status
            verbs:
            - get
            - list
            - watch
            - create
            - delete
            - patch
            - update
            - apiGroups:
            - "core.strimzi.io"
            resources:
            # The cluster operator uses StrimziPodSets to manage the Kafka and ZooKeeper pods
            - strimzipodsets
            - strimzipodsets/status
            verbs:
            - get
            - list
            - watch
            - create
            - delete
            - patch
            - update
            - apiGroups:
            # The cluster operator needs the extensions api as the operator supports Kubernetes version 1.11+
            # apps/v1 was introduced in Kubernetes 1.14
            - "extensions"
            resources:
            # The cluster operator needs to access and manage deployments to run deployment based Strimzi components
            - deployments
            - deployments/scale
            # The cluster operator needs to access replica sets to manage Strimzi components and to determine error states
            - replicasets
            # The cluster operator needs to access and manage replication controllers to manage replicasets
            - replicationcontrollers
            # The cluster operator needs to access and manage network policies to lock down communication between Strimzi components
            - networkpolicies
            # The cluster operator needs to access and manage ingresses which allow external access to the services in a cluster
            - ingresses
            verbs:
            - get
            - list
            - watch
            - create
            - delete
            - patch
            - update
            - apiGroups:
            - "apps"
            resources:
            # The cluster operator needs to access and manage deployments to run deployment based Strimzi components
            - deployments
            - deployments/scale
            - deployments/status
            # The cluster operator needs to access and manage stateful sets to run stateful sets based Strimzi components
            - statefulsets
            # The cluster operator needs to access replica-sets to manage Strimzi components and to determine error states
            - replicasets
            verbs:
            - get
            - list
            - watch
            - create
            - delete
            - patch
            - update
            - apiGroups:
            - ""
            resources:
            # The cluster operator needs to be able to create events and delegate permissions to do so
            - events
            verbs:
            - create
            - apiGroups:
            # Kafka Connect Build on OpenShift requirement
            - build.openshift.io
            resources:
            - buildconfigs
            - buildconfigs/instantiate
            - builds
            verbs:
            - get
            - list
            - watch
            - create
            - delete
            - patch
            - update
            - apiGroups:
            - networking.k8s.io
            resources:
            # The cluster operator needs to access and manage network policies to lock down communication between Strimzi components
            - networkpolicies
            # The cluster operator needs to access and manage ingresses which allow external access to the services in a cluster
            - ingresses
            verbs:
            - get
            - list
            - watch
            - create
            - delete
            - patch
            - update
            - apiGroups:
            - route.openshift.io
            resources:
            # The cluster operator needs to access and manage routes to expose Strimzi components for external access
            - routes
            - routes/custom-host
            verbs:
            - get
            - list
            - watch
            - create
            - delete
            - patch
            - update
            - apiGroups:
            - policy
            resources:
            # The cluster operator needs to access and manage pod disruption budgets this limits the number of concurrent disruptions
            # that a Strimzi component experiences, allowing for higher availability
            - poddisruptionbudgets
            verbs:
            - get
            - list
            - watch
            - create
            - delete
            - patch
            - update
            {{- end }}
            0% or .
            You are about to add 0 people to the discussion. Proceed with caution.
            Finish editing this message first!
            Please register or to comment