helm: add knob to control cluster level rbac rendering (nginxinc#5229)

ssrahul96 · Jun 20, 2024 · ccd1814 · ccd1814
1 parent abdd84a
commit ccd1814
Show file tree

Hide file tree

Showing 6 changed files with 7 additions and 1 deletion.
diff --git a/charts/nginx-ingress/README.md b/charts/nginx-ingress/README.md
@@ -473,6 +473,7 @@ The following tables lists the configurable parameters of the NGINX Ingress Cont
 |`controller.telemetryReporting.enable` | Enable telemetry reporting. | true |
 |`controller.enableWeightChangesDynamicReload` | Enable weight changes without reloading the NGINX configuration. May require increasing `map_hash_bucket_size`, `map_hash_max_size`, `variable_hash_bucket_size`, and `variable_hash_max_size` in the [ConfigMap](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/) if there are many two-way splits. Requires `controller.nginxplus` | false |
 |`rbac.create` | Configures RBAC. | true |
+|`rbac.clusterrole.create` | Configures creation of ClusterRole. Creation can be disabled when more fine-grained control over RBAC is required. For example when controller.watchNamespace is used. | true |
 |`prometheus.create` | Expose NGINX or NGINX Plus metrics in the Prometheus format. | true |
 |`prometheus.port` | Configures the port to scrape the metrics. | 9113 |
 |`prometheus.scheme` | Configures the HTTP scheme to use for connections to the Prometheus endpoint. | http |

diff --git a/charts/nginx-ingress/templates/clusterrole.yaml b/charts/nginx-ingress/templates/clusterrole.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.rbac.create }}
+{{- if and .Values.rbac.create .Values.rbac.clusterrole.create }}
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:

diff --git a/...-ingress/templates/clusterrolebiding.yaml → ...ingress/templates/clusterrolebinding.yaml b/...-ingress/templates/clusterrolebiding.yaml → ...ingress/templates/clusterrolebinding.yaml
diff --git a/...ress/templates/controller-rolebiding.yaml → ...ess/templates/controller-rolebinding.yaml b/...ress/templates/controller-rolebiding.yaml → ...ess/templates/controller-rolebinding.yaml
diff --git a/charts/nginx-ingress/values.yaml b/charts/nginx-ingress/values.yaml
@@ -501,6 +501,10 @@ rbac:
   ## Configures RBAC.
   create: true
 
+  clusterrole:
+    ## Create ClusterRole
+    create: true
+
 prometheus:
   ## Expose NGINX or NGINX Plus metrics in the Prometheus format.
   create: true

diff --git a/docs/content/installation/installing-nic/installation-with-helm.md b/docs/content/installation/installing-nic/installation-with-helm.md
@@ -430,6 +430,7 @@ The following tables lists the configurable parameters of the NGINX Ingress Cont
 | **controller.telemetryReporting.enable** | Enable telemetry reporting. | true |
 | **controller.enableWeightChangesDynamicReload** | Enable weight changes without reloading the NGINX configuration. May require increasing `map_hash_bucket_size`, `map_hash_max_size`, `variable_hash_bucket_size`, and `variable_hash_max_size` in the [ConfigMap](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/) if there are many two-way splits. Requires `controller.nginxplus` | false |
 | **rbac.create** | Configures RBAC. | true |
+| **rbac.clusterrole.create** | Configures creation of ClusterRole. Creation can be disabled when more fine-grained control over RBAC is required. For example when controller.watchNamespace is used. | true |
 | **prometheus.create** | Expose NGINX or NGINX Plus metrics in the Prometheus format. | true |
 | **prometheus.port** | Configures the port to scrape the metrics. | 9113 |
 | **prometheus.scheme** | Configures the HTTP scheme to use for connections to the Prometheus endpoint. | http |