github/charts
4
0
Fork 0
mirror of https://github.com/truenas/charts.git synced 2024-04-21 15:21:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

rbac docs

Browse Source
This commit is contained in:
Stavros kois
2023-02-02 19:24:06 +02:00
parent 02749f044b
commit 122ad09fc5
2 changed files with 96 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
library/common/1.0.0/docs/rbac.md
+91
View File
@@ -0,0 +1,91 @@
# RBAC
| Key | Type | Required | Helm Template | Default | Description |
| :--------------------------------------- | :-------: | :------: | :-----------: | :-----: | :------------------------------------------------------------------------ |
| rbac | `dict` | ❌ | ❌ | `{}` | Define the rbac as dicts |
| rbac.[rbac-name] | `dict` | ✅ | ❌ | `{}` | Holds rbac definition |
| rbac.[rbac-name].enabled | `boolean` | ✅ | ❌ | `false` | Enables or Disables the rbac |
| rbac.[rbac-name].primary | `boolean` | ❌ | ❌ | `false` | Sets the rbac as primary |
| rbac.[rbac-name].clusterWide | `boolean` | ❌ | ❌ | `false` | Sets the rbac as cluster wide (ClusterRole, ClusterRoleBinding) |
| rbac.[rbac-name].labels | `dict` | ❌ | ✅ | `{}` | Additional labels for rbac |
| rbac.[rbac-name].annotations | `dict` | ❌ | ✅ | `{}` | Additional annotations for rbac |
| rbac.[rbac-name].allServiceAccounts | `boolean` | ❌ | ❌ | | Whether to assign all service accounts or not to the (Cluster)RoleBinding |
| rbac.[rbac-name].serviceAccounts | `list` | ❌ | ❌ | `[]` | Define the service account(s) to assign the (Cluster)RoleBinding |
| rbac.[rbac-name].rules | `list` | ✅ | ❌ | `[]` | Define the `rules` for the (Cluster)Role |
| rbac.[rbac-name].rules.apiGroups | `list` | ✅ | ❌ | `[]` | Define the `apiGroups` list for the `rules` for the (Cluster)Role |
| rbac.[rbac-name].rules.apiGroups.[entry] | `string` | ✅ | ✅ | | Entry of the `apiGroups` |
| rbac.[rbac-name].rules.resources | `list` | ✅ | ❌ | `[]` | Define the `resources` list for the `rules` for the (Cluster)Role |
| rbac.[rbac-name].rules.resources.[entry] | `string` | ✅ | ✅ | | Entry of the `resources` |
| rbac.[rbac-name].rules.verbs | `list` | ✅ | ❌ | `[]` | Define the `verbs` list for the `rules` for the (Cluster)Role |
| rbac.[rbac-name].rules.verbs.[entry] | `string` | ✅ | ✅ | | Entry of the `verbs` |
| rbac.[rbac-name].subjects | `list` | ❌ | ❌ | `[]` | Define `subjects` for (Cluster)RoleBinding |
| rbac.[rbac-name].subjects.kind | `string` | ✅ | ✅ | `""` | Define the `kind` of `subjects` entry |
| rbac.[rbac-name].subjects.name | `string` | ✅ | ✅ | `""` | Define the `name` of `subjects` entry |
| rbac.[rbac-name].subjects.apiGroup | `string` | ✅ | ✅ | `""` | Define the `apiGroup` of `subjects` entry |
> When `allServiceAccounts` is `true`, it will assign the all the serviceAccount(s) to the (Cluster)RoleBinding (`serviceAccounts` is ignored in this case)
> When `serviceAccounts` is a list, each entry is a string, referencing the serviceAccount(s) name that will be assigned to the (Cluster)RoleBinding.
> When `serviceAccounts` is a empty, it will assign the primary serviceAccount to the primary rbac
---
Appears in:
- `.Values.rbac`
---
Naming scheme:
- Primary: `$FullName` (release-name-chart-name)
- Non-Primary: `$FullName-$RBACName` (release-name-chart-name-RBACName)
---
Examples:
```yaml
rbac:
rbac-name:
enabled: true
primary: true
clusterWide: true
labels:
key: value
keytpl: "{{ .Values.some.value }}"
annotations:
key: value
keytpl: "{{ .Values.some.value }}"
allServiceAccounts: true
rules:
- apiGroups:
- ""
resources:
- "{{ .Values.some.value }}"
verbs:
- get
- "{{ .Values.some.value }}"
- watch
subjects:
- kind: my-kind
name: "{{ .Values.some.value }}"
apiGroup: my-api-group
other-rbac-name:
enabled: true
serviceAccounts:
- service-account-name
rules:
- apiGroups:
- ""
resources:
- pods
verbs:
- get
- list
- watch
subjects:
- kind: my-kind
name: my-name
apiGroup: my-api-group
```
library/common/1.0.0/docs/serviceAccount.md
+5 -4
View File
@@ -3,11 +3,11 @@
| Key | Type | Required | Helm Template | Default | Description |
| :--------------------------------------- | :-------: | :------: | :-----------: | :-----: | :------------------------------------------------------ |
| serviceAccount | `dict` | ❌ | ❌ | `{}` | Define the serviceAccount as dicts |
| serviceAccount.[sa-name] | `dict` | ✅ | ❌ | `{}` | Holds secret definition |
| serviceAccount.[sa-name].enabled | `boolean` | ✅ | ❌ | `false` | Enables or Disables the secret |
| serviceAccount.[sa-name] | `dict` | ✅ | ❌ | `{}` | Holds service account definition |
| serviceAccount.[sa-name].enabled | `boolean` | ✅ | ❌ | `false` | Enables or Disables the service account |
| serviceAccount.[sa-name].primary | `boolean` | ❌ | ❌ | `false` | Sets the service account as primary |
| serviceAccount.[sa-name].labels | `dict` | ❌ | ✅ | `{}` | Additional labels for secret |
| serviceAccount.[sa-name].annotations | `dict` | ❌ | ✅ | `{}` | Additional annotations for secret |
| serviceAccount.[sa-name].labels | `dict` | ❌ | ✅ | `{}` | Additional labels for service account |
| serviceAccount.[sa-name].annotations | `dict` | ❌ | ✅ | `{}` | Additional annotations for service account |
| serviceAccount.[sa-name].targetSelectAll | `boolean` | ❌ | ❌ | | Whether to assign the serviceAccount to all pods or not |
| serviceAccount.[sa-name].targetSelector | `list` | ❌ | ❌ | `[]` | Define the pod(s) to assign the serviceAccount |
@@ -36,6 +36,7 @@ Examples:
serviceAccount:
sa-name:
enabled: true
primary: true
labels:
key: value
keytpl: "{{ .Values.some.value }}"