feat(argocd-image-updater): update as following upstream

Signed-off-by: yu-croco <yu.croco@gmail.com>
argoproj · Oct 24, 2024 · d4a08dd · d4a08dd
1 parent 9cf5e56
commit d4a08dd
Show file tree

Hide file tree

Showing 2 changed files with 43 additions and 11 deletions.
diff --git a/charts/argocd-image-updater/templates/rbac.yaml b/charts/argocd-image-updater/templates/rbac.yaml
@@ -17,6 +17,39 @@ rules:
       - get
       - list
       - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  labels:
+    {{- include "argocd-image-updater.labels" . | nindent 4 }}
+  name: {{ include "argocd-image-updater.fullname" . }}
+  namespace: {{ include "argocd-image-updater.namespace" . | quote }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ include "argocd-image-updater.fullname" . }}
+subjects:
+- kind: ServiceAccount
+  name: {{ include "argocd-image-updater.serviceAccountName" . }}
+  namespace: {{ include "argocd-image-updater.namespace" . | quote }}
+{{- end }}
+---
+{{- if and .Values.rbac.enabled .Values.createClusterRoles }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    {{- include "argocd-image-updater.labels" . | nindent 4 }}
+  name: {{ include "argocd-image-updater.fullname" . }}
+  namespace: {{ include "argocd-image-updater.namespace" . | quote }}
+rules:
+  - apiGroups:
+    - ""
+    resources:
+      - events
+    verbs:
+      - create
   - apiGroups:
       - argoproj.io
     resources:
@@ -26,26 +59,20 @@ rules:
       - list
       - update
       - patch
-  - apiGroups:
-      - ""
-    resources:
-      - events
-    verbs:
-      - create
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
+kind: ClusterRoleBinding
 metadata:
   labels:
     {{- include "argocd-image-updater.labels" . | nindent 4 }}
   name: {{ include "argocd-image-updater.fullname" . }}
   namespace: {{ include "argocd-image-updater.namespace" . | quote }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
-  kind: Role
+  kind: ClusterRole
   name: {{ include "argocd-image-updater.fullname" . }}
 subjects:
-- kind: ServiceAccount
-  name: {{ include "argocd-image-updater.serviceAccountName" . }}
-  namespace: {{ include "argocd-image-updater.namespace" . | quote }}
+  - kind: ServiceAccount
+    name: {{ include "argocd-image-updater.serviceAccountName" . }}
+    namespace: {{ include "argocd-image-updater.namespace" . | quote }}
 {{- end }}
diff --git a/charts/argocd-image-updater/values.yaml b/charts/argocd-image-updater/values.yaml
@@ -20,6 +20,11 @@ fullnameOverride: ""
 # -- Global namespace (argocd-image-updater.namespace in _helpers.tpl) override
 namespaceOverride: ""
 
+# -- Create cluster roles for cluster-wide installation.
+## Used when you manage applications in the same cluster where Argo CD Image Updater runs.
+## If you want to use, please set `.Values.rbac.enabled` as true as well.
+createClusterRoles: true
+
 # -- Extra arguments for argocd-image-updater not defined in `config.argocd`.
 # If a flag contains both key and value, they need to be split to a new entry
 extraArgs: []