Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(rbac): seperate rbac creation from service account creation #5

Open
miguelito-at-progyny opened this issue Sep 9, 2024 · 0 comments

Comments

@miguelito-at-progyny
Copy link

In the helm chart templates/role.yaml and templates/rolebinding.yaml, the creation of RBAC is tied to the serviceAccount.create flag.

It is pretty common for managed K8S deployments to create the service account and namespace prior to invoking the helm chart as the helm installation role might not have the permissions needed to create the service account on the cluster.

The general approach is to have a separate "rbac.create" flag which defaults to true as it is far more likely a consumer will setup and create their own service account as opposed to change the needed permissions required by the helm chart.

I see in templates/serviceaccount.yaml you can provide permissions related annotations via serviceAccount.annotations, but this doesn't address the problem mentioned where the helm installer might not have privileges to create a service account.

Note: I looked for another repository without the released version of the chart and could not find one, and assume it is internally managed so created the issue here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant