From 9ea2b1d6283a755209d344189ff770f3d884b464 Mon Sep 17 00:00:00 2001 From: B Marinov Date: Mon, 8 Dec 2025 10:38:27 +0100 Subject: [PATCH] helm: Conditionally skip CRD management RBAC rule Remove rule permitting changes to CRDs when garage.kubernetesSkipCrd is set to true. --- script/helm/garage/templates/clusterrole.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/script/helm/garage/templates/clusterrole.yaml b/script/helm/garage/templates/clusterrole.yaml index fa3e6405..3fb81af9 100644 --- a/script/helm/garage/templates/clusterrole.yaml +++ b/script/helm/garage/templates/clusterrole.yaml @@ -5,9 +5,11 @@ metadata: labels: {{- include "garage.labels" . | nindent 4 }} rules: +{{- if eq .Values.garage.kubernetesSkipCrd false }} - apiGroups: ["apiextensions.k8s.io"] resources: ["customresourcedefinitions"] verbs: ["get", "list", "watch", "create", "patch"] +{{ end }} - apiGroups: ["deuxfleurs.fr"] resources: ["garagenodes"] verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] @@ -25,4 +27,4 @@ subjects: roleRef: kind: ClusterRole name: manage-crds-{{ .Release.Namespace }}-{{ .Release.Name }} - apiGroup: rbac.authorization.k8s.io \ No newline at end of file + apiGroup: rbac.authorization.k8s.io