From 122ad09fc5d5bdc976e419d3e9d9bd89cf383131 Mon Sep 17 00:00:00 2001 From: Stavros kois Date: Thu, 2 Feb 2023 19:24:06 +0200 Subject: [PATCH] rbac docs --- library/common/1.0.0/docs/rbac.md | 91 +++++++++++++++++++++ library/common/1.0.0/docs/serviceAccount.md | 9 +- 2 files changed, 96 insertions(+), 4 deletions(-) create mode 100644 library/common/1.0.0/docs/rbac.md diff --git a/library/common/1.0.0/docs/rbac.md b/library/common/1.0.0/docs/rbac.md new file mode 100644 index 0000000000..1d9c42fa82 --- /dev/null +++ b/library/common/1.0.0/docs/rbac.md @@ -0,0 +1,91 @@ +# RBAC + +| Key | Type | Required | Helm Template | Default | Description | +| :--------------------------------------- | :-------: | :------: | :-----------: | :-----: | :------------------------------------------------------------------------ | +| rbac | `dict` | ❌ | ❌ | `{}` | Define the rbac as dicts | +| rbac.[rbac-name] | `dict` | ✅ | ❌ | `{}` | Holds rbac definition | +| rbac.[rbac-name].enabled | `boolean` | ✅ | ❌ | `false` | Enables or Disables the rbac | +| rbac.[rbac-name].primary | `boolean` | ❌ | ❌ | `false` | Sets the rbac as primary | +| rbac.[rbac-name].clusterWide | `boolean` | ❌ | ❌ | `false` | Sets the rbac as cluster wide (ClusterRole, ClusterRoleBinding) | +| rbac.[rbac-name].labels | `dict` | ❌ | ✅ | `{}` | Additional labels for rbac | +| rbac.[rbac-name].annotations | `dict` | ❌ | ✅ | `{}` | Additional annotations for rbac | +| rbac.[rbac-name].allServiceAccounts | `boolean` | ❌ | ❌ | | Whether to assign all service accounts or not to the (Cluster)RoleBinding | +| rbac.[rbac-name].serviceAccounts | `list` | ❌ | ❌ | `[]` | Define the service account(s) to assign the (Cluster)RoleBinding | +| rbac.[rbac-name].rules | `list` | ✅ | ❌ | `[]` | Define the `rules` for the (Cluster)Role | +| rbac.[rbac-name].rules.apiGroups | `list` | ✅ | ❌ | `[]` | Define the `apiGroups` list for the `rules` for the (Cluster)Role | +| rbac.[rbac-name].rules.apiGroups.[entry] | `string` | ✅ | ✅ | | Entry of the `apiGroups` | +| rbac.[rbac-name].rules.resources | `list` | ✅ | ❌ | `[]` | Define the `resources` list for the `rules` for the (Cluster)Role | +| rbac.[rbac-name].rules.resources.[entry] | `string` | ✅ | ✅ | | Entry of the `resources` | +| rbac.[rbac-name].rules.verbs | `list` | ✅ | ❌ | `[]` | Define the `verbs` list for the `rules` for the (Cluster)Role | +| rbac.[rbac-name].rules.verbs.[entry] | `string` | ✅ | ✅ | | Entry of the `verbs` | +| rbac.[rbac-name].subjects | `list` | ❌ | ❌ | `[]` | Define `subjects` for (Cluster)RoleBinding | +| rbac.[rbac-name].subjects.kind | `string` | ✅ | ✅ | `""` | Define the `kind` of `subjects` entry | +| rbac.[rbac-name].subjects.name | `string` | ✅ | ✅ | `""` | Define the `name` of `subjects` entry | +| rbac.[rbac-name].subjects.apiGroup | `string` | ✅ | ✅ | `""` | Define the `apiGroup` of `subjects` entry | + +> When `allServiceAccounts` is `true`, it will assign the all the serviceAccount(s) to the (Cluster)RoleBinding (`serviceAccounts` is ignored in this case) +> When `serviceAccounts` is a list, each entry is a string, referencing the serviceAccount(s) name that will be assigned to the (Cluster)RoleBinding. +> When `serviceAccounts` is a empty, it will assign the primary serviceAccount to the primary rbac + +--- + +Appears in: + +- `.Values.rbac` + +--- + +Naming scheme: + +- Primary: `$FullName` (release-name-chart-name) +- Non-Primary: `$FullName-$RBACName` (release-name-chart-name-RBACName) + +--- + +Examples: + +```yaml +rbac: + rbac-name: + enabled: true + primary: true + clusterWide: true + labels: + key: value + keytpl: "{{ .Values.some.value }}" + annotations: + key: value + keytpl: "{{ .Values.some.value }}" + allServiceAccounts: true + rules: + - apiGroups: + - "" + resources: + - "{{ .Values.some.value }}" + verbs: + - get + - "{{ .Values.some.value }}" + - watch + subjects: + - kind: my-kind + name: "{{ .Values.some.value }}" + apiGroup: my-api-group + + other-rbac-name: + enabled: true + serviceAccounts: + - service-account-name + rules: + - apiGroups: + - "" + resources: + - pods + verbs: + - get + - list + - watch + subjects: + - kind: my-kind + name: my-name + apiGroup: my-api-group +``` diff --git a/library/common/1.0.0/docs/serviceAccount.md b/library/common/1.0.0/docs/serviceAccount.md index ef84900ca3..1add4202b1 100644 --- a/library/common/1.0.0/docs/serviceAccount.md +++ b/library/common/1.0.0/docs/serviceAccount.md @@ -3,11 +3,11 @@ | Key | Type | Required | Helm Template | Default | Description | | :--------------------------------------- | :-------: | :------: | :-----------: | :-----: | :------------------------------------------------------ | | serviceAccount | `dict` | ❌ | ❌ | `{}` | Define the serviceAccount as dicts | -| serviceAccount.[sa-name] | `dict` | ✅ | ❌ | `{}` | Holds secret definition | -| serviceAccount.[sa-name].enabled | `boolean` | ✅ | ❌ | `false` | Enables or Disables the secret | +| serviceAccount.[sa-name] | `dict` | ✅ | ❌ | `{}` | Holds service account definition | +| serviceAccount.[sa-name].enabled | `boolean` | ✅ | ❌ | `false` | Enables or Disables the service account | | serviceAccount.[sa-name].primary | `boolean` | ❌ | ❌ | `false` | Sets the service account as primary | -| serviceAccount.[sa-name].labels | `dict` | ❌ | ✅ | `{}` | Additional labels for secret | -| serviceAccount.[sa-name].annotations | `dict` | ❌ | ✅ | `{}` | Additional annotations for secret | +| serviceAccount.[sa-name].labels | `dict` | ❌ | ✅ | `{}` | Additional labels for service account | +| serviceAccount.[sa-name].annotations | `dict` | ❌ | ✅ | `{}` | Additional annotations for service account | | serviceAccount.[sa-name].targetSelectAll | `boolean` | ❌ | ❌ | | Whether to assign the serviceAccount to all pods or not | | serviceAccount.[sa-name].targetSelector | `list` | ❌ | ❌ | `[]` | Define the pod(s) to assign the serviceAccount | @@ -36,6 +36,7 @@ Examples: serviceAccount: sa-name: enabled: true + primary: true labels: key: value keytpl: "{{ .Values.some.value }}"