Merge pull request 'Allow creation of roles instead of cluster roles' (#1478) from hmerat/garage:disable-cluster-roles into main-v2

Reviewed-on: https://git.deuxfleurs.fr/Deuxfleurs/garage/pulls/1478

script/helm/garage/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: garage
 description: S3-compatible object store for small self-hosted geo-distributed deployments
 type: application
-version: 0.10.0
+version: 0.10.1
 appVersion: "v2.4.0"
 home: https://garagehq.deuxfleurs.fr/
 icon: https://garagehq.deuxfleurs.fr/images/garage-logo.svg

script/helm/garage/templates/clusterrole.yaml

@@ -1,3 +1,4 @@
+{{- if eq .Values.garage.noClusterRole false }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
@@ -28,3 +29,4 @@ roleRef:
   kind: ClusterRole
   name: manage-crds-{{ .Release.Namespace }}-{{ .Release.Name }}
   apiGroup: rbac.authorization.k8s.io
+{{ end }}

script/helm/garage/templates/role.yaml

@@ -0,0 +1,27 @@
+{{- if eq .Values.garage.noClusterRole true }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: manage-crds-{{ .Release.Namespace }}-{{ .Release.Name }}
+  labels:
+    {{- include "garage.labels" . | nindent 4 }}
+rules:
+- apiGroups: ["deuxfleurs.fr"]
+  resources: ["garagenodes"]
+  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: allow-crds-for-{{ .Release.Namespace }}-{{ .Release.Name }}
+  labels:
+    {{- include "garage.labels" . | nindent 4 }}
+subjects:
+- kind: ServiceAccount
+  name: {{ include "garage.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: Role
+  name: manage-crds-{{ .Release.Namespace }}-{{ .Release.Name }}
+  apiGroup: rbac.authorization.k8s.io
+{{ end }}

script/helm/garage/values.yaml

@@ -46,6 +46,8 @@ garage:
   # -- Set to true if you want to use k8s discovery but install the CRDs manually outside
   # of the helm chart, for example if you operate at namespace level without cluster resources
   kubernetesSkipCrd: false
+  # -- Set to true if you want to use roles instead of cluster roles
+  noClusterRole: false
   s3:
     api:
       bindAddr: "[::]:3900"