Adding RBAC for Betydb Helm components

Chart.yaml

@@ -25,6 +25,8 @@ maintainers:
     email: [email protected]
   - name: Aju Tamang
     email: [email protected]
+  - name: Sagar Utekar
+    email: [email protected]
 
 # location of source code
 sources:

README.md

@@ -11,6 +11,7 @@ Bety is a Web-interface to the Biofuel Ecophysiological Traits and Yields Databa
 
 ```
 helm repo add ncsa https://opensource.ncsa.illinois.edu/charts/
+helm dependency build
 ```
 
 To install the chart with the release name my-release:

templates/deployment.yaml

@@ -36,6 +36,8 @@ spec:
             name: {{ include "betydb.fullname" . }}-logos
       {{- end }}
       {{- end }}
+      serviceAccountName: {{ include "betydb.fullname" . }}
+      automountServiceAccountToken: false
       initContainers:
         - name: check-postgresql
           image: "{{ $.Values.image.checks }}"

templates/hooks/add-user.yaml

@@ -32,6 +32,8 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      serviceAccountName: {{ include "betydb.fullname" . }}-hooks
+      automountServiceAccountToken: false
       initContainers:
       #{{- if or .Values.dburl .Values.dbtag }}
       #   - name: check-job

templates/hooks/load-db.yaml

@@ -33,6 +33,8 @@ spec:
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           env:
             {{- include "betydb.postgresqlEnv" . | nindent 12 }}
+      serviceAccountName: {{ include "betydb.fullname" . }}-hooks
+      automountServiceAccountToken: false
       containers:
         - name: bety-init
           {{- if .Values.dburl }}

templates/hooks/role.yaml

@@ -0,0 +1,16 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "betydb.fullname" . }}-hooks
+  labels:
+    {{- include "betydb.labels" . | nindent 4 }}
+rules:
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs:
+  - list
+  - watch
+  - get
+- apiGroups: ["batch"]
+  resources: ["jobs"]
+  verbs: ["get", "list", "watch"]

templates/hooks/rolebinding.yaml

@@ -0,0 +1,13 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "betydb.fullname" . }}-hooks
+  labels:
+    {{- include "betydb.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ include "betydb.fullname" . }}-hooks
+subjects:
+- kind: ServiceAccount
+  name: {{ include "betydb.fullname" . }}-hooks

templates/hooks/serviceAccount.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "betydb.fullname" . }}-hooks

templates/role.yaml

@@ -0,0 +1,21 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "betydb.fullname" . }}
+  labels:
+    {{- include "betydb.labels" . | nindent 4 }}
+rules:
+- apiGroups: [""]
+  resources: ["pods", "endpoints", "Services", "configmaps"]
+  verbs:
+  - list
+  - watch
+  - get
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - ingresses
+  verbs:
+  - list
+  - watch
+  - get

templates/rolebinding.yaml

@@ -0,0 +1,13 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "betydb.fullname" . }}
+  labels:
+    {{- include "betydb.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ include "betydb.fullname" . }}
+subjects:
+- kind: ServiceAccount
+  name: {{ include "betydb.fullname" . }}

templates/serviceAccount.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "betydb.fullname" . }}