cert-manager: upgrade from 1.12.17 to 1.17.4
Change-Id: Iea0d6eac22a57f9f1fc522e6abdd9359fbbd1415
diff --git a/charts/cert-manager/templates/cainjector-rbac.yaml b/charts/cert-manager/templates/cainjector-rbac.yaml
index 2aa59ee..511073c 100644
--- a/charts/cert-manager/templates/cainjector-rbac.yaml
+++ b/charts/cert-manager/templates/cainjector-rbac.yaml
@@ -101,3 +101,56 @@
namespace: {{ include "cert-manager.namespace" . }}
{{- end }}
{{- end }}
+{{- $certmanagerNamespace := include "cert-manager.namespace" . }}
+{{- if (.Values.cainjector.config.metricsTLSConfig).dynamic }}
+{{- if $certmanagerNamespace | eq .Values.cainjector.config.metricsTLSConfig.dynamic.secretNamespace }}
+
+---
+
+# Metrics server dynamic TLS serving certificate rules
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+ name: {{ template "cainjector.fullname" . }}:dynamic-serving
+ namespace: {{ include "cert-manager.namespace" . }}
+ labels:
+ app: {{ include "cainjector.name" . }}
+ app.kubernetes.io/name: {{ include "cainjector.name" . }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/component: "cainjector"
+ {{- include "labels" . | nindent 4 }}
+rules:
+ - apiGroups: [""]
+ resources: ["secrets"]
+ resourceNames:
+ # Allow cainjector to read and update the metrics CA Secret when dynamic TLS is
+ # enabled for the metrics server and if the Secret is configured to be in the
+ # same namespace as cert-manager.
+ - {{ .Values.cainjector.config.metricsTLSConfig.dynamic.secretName | quote }}
+ verbs: ["get", "list", "watch", "update"]
+ # It's not possible to grant CREATE permission on a single resourceName.
+ - apiGroups: [""]
+ resources: ["secrets"]
+ verbs: ["create"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+ name: {{ include "cainjector.fullname" . }}:dynamic-serving
+ namespace: {{ include "cert-manager.namespace" . }}
+ labels:
+ app: {{ include "cainjector.name" . }}
+ app.kubernetes.io/name: {{ include "cainjector.name" . }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/component: "cainjector"
+ {{- include "labels" . | nindent 4 }}
+roleRef:
+ apiGroup: rbac.authorization.k8s.io
+ kind: Role
+ name: {{ template "cainjector.fullname" . }}:dynamic-serving
+subjects:
+ - kind: ServiceAccount
+ name: {{ template "cainjector.serviceAccountName" . }}
+ namespace: {{ include "cert-manager.namespace" . }}
+{{- end }}
+{{- end }}