Create rolebinding for .Release.Namespace implicitly (#643)

* Create rolebinding for .Release.Namespace implicitly Signed-off-by: Jirka Kremser <jiri.kremser@gmail.com> * Operator should be able to list and watch secrets in the release ns (certs) Signed-off-by: Jirka Kremser <jiri.kremser@gmail.com> --------- Signed-off-by: Jirka Kremser <jiri.kremser@gmail.com>
kedacore · Sep 2, 2024 · 3ab87fb · 3ab87fb
1 parent 2d8e903
commit 3ab87fb
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 1 deletion.
diff --git a/keda/templates/manager/clusterrolebindings.yaml b/keda/templates/manager/clusterrolebindings.yaml
@@ -20,7 +20,8 @@ subjects:
   name: {{ (.Values.serviceAccount.operator).name | default .Values.serviceAccount.name }}
   namespace: {{ .Release.Namespace }}
 {{- else }}
-  {{- range ( split "," .Values.watchNamespace ) }}
+  {{- $namespaces := append (splitList "," .Values.watchNamespace) .Release.Namespace -}}
+  {{- range $namespaces }}
 ---
 # Role binding for namespace '{{ . }}'
 apiVersion: rbac.authorization.k8s.io/v1

diff --git a/keda/templates/manager/minimal-rbac.yaml b/keda/templates/manager/minimal-rbac.yaml
@@ -34,6 +34,10 @@ rules:
   verbs:
   - create
   - update
+{{- if .Values.permissions.operator.restrict.secret }}
+  - list
+  - watch
+{{- end }}
 {{- end }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1