updated rbac template

loft-sh · Sep 4, 2024 · 0349cf3 · 0349cf3
1 parent cb75463
commit 0349cf3
Show file tree

Hide file tree

Showing 3 changed files with 7 additions and 1 deletion.
diff --git a/chart/templates/_rbac.tpl b/chart/templates/_rbac.tpl
@@ -37,6 +37,7 @@
     .Values.sync.toHost.customResourceDefinitions
     .Values.sync.fromHost.customResourceDefinitions
     .Values.integrations.kubeVirt.enabled
+    .Values.integrations.externalSecrets.enabled
     (and .Values.integrations.metricsServer.enabled .Values.integrations.metricsServer.nodes)
     .Values.experimental.multiNamespaceMode.enabled -}}
 {{- true -}}

diff --git a/chart/templates/clusterrole.yaml b/chart/templates/clusterrole.yaml
@@ -117,7 +117,7 @@ rules:
     resources: ["validatingwebhookconfigurations", "mutatingwebhookconfigurations"]
     verbs: ["get", "list", "watch"]
   {{- end }}
-  {{- if or .Values.integrations.kubeVirt.enabled .Values.sync.toHost.customResourceDefinitions .Values.sync.fromHost.customResourceDefinitions }}
+  {{- if or .Values.integrations.kubeVirt.enabled .Values.integrations.externalSecrets.enabled .Values.sync.toHost.customResourceDefinitions .Values.sync.fromHost.customResourceDefinitions }}
   - apiGroups: ["apiextensions.k8s.io"]
     resources: ["customresourcedefinitions"]
     verbs: ["get", "list", "watch"]

diff --git a/chart/templates/role.yaml b/chart/templates/role.yaml
@@ -94,6 +94,11 @@ rules:
     resources: ["virtualmachines", "virtualmachines/status", "virtualmachineinstances", "virtualmachineinstances/status", "virtualmachineinstancemigrations", "virtualmachineinstancemigrations/status"]
     verbs: ["create", "delete", "patch", "update", "get", "list", "watch"]
   {{- end }}
+  {{- if  (and .Values.integrations.externalSecrets.Enabled .Values.integrations.externalSecrets.sync.externalSecrets.enabled) }}
+  - apiGroups: ["external-secrets.io"]
+    resources: ["externalsecrets"]
+    verbs: ["create", "delete", "patch", "update", "get", "list", "watch"]
+  {{- end }}
   {{- include "vcluster.customResourceDefinitions.roleExtraRules" . | indent 2 }}
   {{- include "vcluster.plugin.roleExtraRules" . | indent 2 }}
   {{- include "vcluster.generic.roleExtraRules" . | indent 2 }}