Use cluster-admin ClusterRoleBinding

Signed-off-by: Raul Sevilla <rsevilla@redhat.com>
cloud-bulldozer · May 27, 2022 · 2836610 · 2836610
1 parent 369ae44
commit 2836610
Show file tree

Hide file tree

Showing 44 changed files with 17 additions and 952 deletions.
diff --git a/charts/benchmark-operator/README.md b/charts/benchmark-operator/README.md
@@ -21,7 +21,6 @@ A Helm chart for Kubernetes
 | operator.replicaCount | int | `1` | how many replicas for the operator deployment |
 | operator.resources.limits.cpu | string | `"0.1"` |  |
 | operator.tolerations[0] | object | `{"effect":"NoSchedule","key":"role","value":"workload"}` | schedule on a workload node even if it's tainted |
-| rbac | object | `{"clusterRoles":{"kubevirt":false,"selfProvisioner":false}}` | map for custom cluster roles for certain benchmarks like kubevirt |
 
 ----------------------------------------------
 Autogenerated from chart metadata using [helm-docs v1.4.0](https://github.com/norwoodj/helm-docs/releases/v1.4.0)
diff --git a/...elf-provisioner-cluster-role-binding.yaml → ...perator/templates/clusterrolebinding.yaml b/...elf-provisioner-cluster-role-binding.yaml → ...perator/templates/clusterrolebinding.yaml
@@ -1,14 +1,14 @@
-{{ if .Values.rbac.clusterRoles.selfProvisioner }}
-apiVersion: rbac.authorization.k8s.io/v1
+---
 kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: {{ include "benchmark-operator.fullname" . }}
+  namespace: {{ .Release.Namespace }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: self-provisioner
+  name: cluster-admin
 subjects:
 - kind: ServiceAccount
   name: {{ include "benchmark-operator.fullname" . }}
   namespace: {{ .Release.Namespace }}
-{{ end }}
diff --git a/charts/benchmark-operator/templates/kubevirt-cluster-role.yaml b/charts/benchmark-operator/templates/kubevirt-cluster-role.yaml
diff --git a/charts/benchmark-operator/templates/psp.yaml b/charts/benchmark-operator/templates/psp.yaml
diff --git a/charts/benchmark-operator/templates/role-binding.yaml b/charts/benchmark-operator/templates/role-binding.yaml
diff --git a/charts/benchmark-operator/templates/role.yaml b/charts/benchmark-operator/templates/role.yaml
diff --git a/charts/benchmark-operator/values.yaml b/charts/benchmark-operator/values.yaml
@@ -5,13 +5,6 @@ nameOverride: ""
 
 # -- (string) overrides naming of all resources
 fullnameOverride: "benchmark-operator"
-
-# -- map for custom cluster roles for certain benchmarks like kubevirt
-rbac:
-  clusterRoles:
-    kubevirt: false
-    selfProvisioner: false
-
 operator:
 
   # -- how many replicas for the operator deployment

diff --git a/config/crd/bases/ripsaw.cloudbulldozer.io_benchmarks.yaml b/config/crd/bases/ripsaw.cloudbulldozer.io_benchmarks.yaml
@@ -135,9 +135,6 @@ spec:
                   privileged:
                     default: false
                     type: boolean
-                  serviceaccount:
-                    default: default
-                    type: string
                   stockpileSkipTags:
                     default: []
                     items:

diff --git a/config/manager/manager.yaml b/config/manager/manager.yaml
@@ -79,7 +79,7 @@ spec:
         volumeMounts:
           - mountPath: /redis-master-data
             name: data
-      serviceAccountName: operator
+      serviceAccountName: benchmark-operator
       terminationGracePeriodSeconds: 10
       volumes:
         - name: data

diff --git a/config/rbac/auth_proxy_client_clusterrole.yaml b/config/rbac/auth_proxy_client_clusterrole.yaml
diff --git a/config/rbac/auth_proxy_role.yaml b/config/rbac/auth_proxy_role.yaml
diff --git a/config/rbac/auth_proxy_role_binding.yaml b/config/rbac/auth_proxy_role_binding.yaml
diff --git a/config/rbac/auth_proxy_service.yaml b/config/rbac/auth_proxy_service.yaml
diff --git a/config/rbac/benchmark_editor_role.yaml b/config/rbac/benchmark_editor_role.yaml
diff --git a/config/rbac/benchmark_viewer_role.yaml b/config/rbac/benchmark_viewer_role.yaml