cert-manager: upgrade from 1.12.17 to 1.17.4
Change-Id: Iea0d6eac22a57f9f1fc522e6abdd9359fbbd1415
diff --git a/charts/cert-manager/templates/rbac.yaml b/charts/cert-manager/templates/rbac.yaml
index 830e372..baae425 100644
--- a/charts/cert-manager/templates/rbac.yaml
+++ b/charts/cert-manager/templates/rbac.yaml
@@ -39,13 +39,56 @@
kind: Role
name: {{ template "cert-manager.fullname" . }}:leaderelection
subjects:
- - apiGroup: ""
- kind: ServiceAccount
+ - kind: ServiceAccount
name: {{ template "cert-manager.serviceAccountName" . }}
namespace: {{ include "cert-manager.namespace" . }}
---
+{{- if .Values.serviceAccount.create }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+ name: {{ template "cert-manager.serviceAccountName" . }}-tokenrequest
+ namespace: {{ include "cert-manager.namespace" . }}
+ labels:
+ app: {{ include "cert-manager.name" . }}
+ app.kubernetes.io/name: {{ include "cert-manager.name" . }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/component: "controller"
+ {{- include "labels" . | nindent 4 }}
+rules:
+ - apiGroups: [""]
+ resources: ["serviceaccounts/token"]
+ resourceNames: ["{{ template "cert-manager.serviceAccountName" . }}"]
+ verbs: ["create"]
+
+---
+
+# grant cert-manager permission to create tokens for the serviceaccount
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+ name: {{ include "cert-manager.fullname" . }}-{{ template "cert-manager.serviceAccountName" . }}-tokenrequest
+ namespace: {{ include "cert-manager.namespace" . }}
+ labels:
+ app: {{ include "cert-manager.name" . }}
+ app.kubernetes.io/name: {{ include "cert-manager.name" . }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/component: "controller"
+ {{- include "labels" . | nindent 4 }}
+roleRef:
+ apiGroup: rbac.authorization.k8s.io
+ kind: Role
+ name: {{ template "cert-manager.serviceAccountName" . }}-tokenrequest
+subjects:
+ - kind: ServiceAccount
+ name: {{ template "cert-manager.serviceAccountName" . }}
+ namespace: {{ include "cert-manager.namespace" . }}
+{{- end }}
+
+---
+
# Issuer controller role
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
@@ -398,6 +441,26 @@
namespace: {{ include "cert-manager.namespace" . }}
kind: ServiceAccount
+{{- if .Values.global.rbac.aggregateClusterRoles }}
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+ name: {{ template "cert-manager.fullname" . }}-cluster-view
+ labels:
+ app: {{ include "cert-manager.name" . }}
+ app.kubernetes.io/name: {{ include "cert-manager.name" . }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/component: "controller"
+ {{- include "labels" . | nindent 4 }}
+ rbac.authorization.k8s.io/aggregate-to-cluster-reader: "true"
+rules:
+ - apiGroups: ["cert-manager.io"]
+ resources: ["clusterissuers"]
+ verbs: ["get", "list", "watch"]
+
+{{- end }}
---
apiVersion: rbac.authorization.k8s.io/v1
@@ -414,6 +477,7 @@
rbac.authorization.k8s.io/aggregate-to-view: "true"
rbac.authorization.k8s.io/aggregate-to-edit: "true"
rbac.authorization.k8s.io/aggregate-to-admin: "true"
+ rbac.authorization.k8s.io/aggregate-to-cluster-reader: "true"
{{- end }}
rules:
- apiGroups: ["cert-manager.io"]
@@ -453,6 +517,8 @@
---
+{{- if not .Values.disableAutoApproval -}}
+
# Permission to approve CertificateRequests referencing cert-manager.io Issuers and ClusterIssuers
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
@@ -468,7 +534,12 @@
- apiGroups: ["cert-manager.io"]
resources: ["signers"]
verbs: ["approve"]
- resourceNames: ["issuers.cert-manager.io/*", "clusterissuers.cert-manager.io/*"]
+ {{- with .Values.approveSignerNames }}
+ resourceNames:
+ {{- range . }}
+ - {{ . | quote }}
+ {{- end }}
+ {{- end }}
---
@@ -493,8 +564,10 @@
---
+{{- end -}}
+
# Permission to:
-# - Update and sign CertificatSigningeRequests referencing cert-manager.io Issuers and ClusterIssuers
+# - Update and sign CertificateSigningRequests referencing cert-manager.io Issuers and ClusterIssuers
# - Perform SubjectAccessReviews to test whether users are able to reference Namespaced Issuers
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole