Helm: granting Rollouts Role permissions not always possible on restricted clusters when Rollouts is present

[sfynx]

We encountered an issue when installing Reloader into a single namespace on a cluster where we only have access to said namespace (in this case a multi-tenant OpenShift cluster). It looks like the Rollout permissions are always included in the Role when the argoproj.io/v1alpha1 API version is present in the cluster regardless of the reloader.isArgoRollouts toggle, due to the or operation:

Reloader/deployments/kubernetes/chart/reloader/templates/role.yaml

Line 47 in 2e47f17

{{- if or (.Capabilities.APIVersions.Has "argoproj.io/v1alpha1") (.Values.reloader.isArgoRollouts) }}

If the cluster administrator does not allow a tenant to access the Argo Rollout resources, then this Role cannot be installed because you cannot grant permissions you do not hold yourself, so it fails with an error like this:

roles.rbac.authorization.k8s.io "reloader-role" is forbidden: user "system:serviceaccount:xxxxx:yyyyy" (groups=["system:serviceaccounts" "system:serviceaccounts:xxxxx" "system:authenticated"]) is attempting to grant RBAC permissions not currently held: {APIGroups:[""], Resources:["rollouts"], Verbs:["update" "patch"]} {APIGroups:["argoproj.io"], Resources:["rollouts"], Verbs:["update" "patch"]}

Perhaps it would be more prudent to use and here, so you need to explicitly set reloader.isArgoRollouts to true before it gets enabled and attempts to grant these permissions?

[faizanahmad055]

@sfynx would you please like to open a PR for this.

[faizanahmad055]

Closing the issue, as it has been fixed.