feat(helm): add to additionalClusterRoleRules to sidecar chart templates

kubernetes-sigs · Sep 22, 2023 · f20710f · f20710f
1 parent b88e7bb
commit f20710f
Show file tree

Hide file tree

Showing 5 changed files with 23 additions and 0 deletions.
diff --git a/charts/aws-ebs-csi-driver/templates/clusterrole-attacher.yaml b/charts/aws-ebs-csi-driver/templates/clusterrole-attacher.yaml
@@ -21,3 +21,6 @@ rules:
   - apiGroups: [ "storage.k8s.io" ]
     resources: [ "volumeattachments/status" ]
     verbs: [ "patch" ]
+  {{- with .Values.sidecars.attacher.additionalClusterRoleRules }}
+    {{- . | toYaml | nindent 2 }}
+  {{- end }}
diff --git a/charts/aws-ebs-csi-driver/templates/clusterrole-provisioner.yaml b/charts/aws-ebs-csi-driver/templates/clusterrole-provisioner.yaml
@@ -33,3 +33,6 @@ rules:
   - apiGroups: [ "storage.k8s.io" ]
     resources: [ "volumeattachments" ]
     verbs: [ "get", "list", "watch" ]
+  {{- with .Values.sidecars.provisioner.additionalClusterRoleRules }}
+    {{- . | toYaml | nindent 2 }}
+  {{- end }}
diff --git a/charts/aws-ebs-csi-driver/templates/clusterrole-resizer.yaml b/charts/aws-ebs-csi-driver/templates/clusterrole-resizer.yaml
@@ -29,3 +29,6 @@ rules:
   - apiGroups: [ "" ]
     resources: [ "pods" ]
     verbs: [ "get", "list", "watch" ]
+    {{- with .Values.sidecars.resizer.additionalClusterRoleRules }}
+      {{- . | toYaml | nindent 2 }}
+    {{- end }}
diff --git a/charts/aws-ebs-csi-driver/templates/clusterrole-snapshotter.yaml b/charts/aws-ebs-csi-driver/templates/clusterrole-snapshotter.yaml
@@ -25,3 +25,6 @@ rules:
   - apiGroups: [ "snapshot.storage.k8s.io" ]
     resources: [ "volumesnapshotcontents/status" ]
     verbs: [ "update" ]
+  {{- with .Values.sidecars.snapshotter.additionalClusterRoleRules }}
+    {{- . | toYaml | nindent 2 }}
+  {{- end }}
diff --git a/charts/aws-ebs-csi-driver/values.yaml b/charts/aws-ebs-csi-driver/values.yaml
@@ -23,6 +23,11 @@ sidecars:
     logLevel: 2
     # Additional parameters provided by external-provisioner.
     additionalArgs: []
+    # Grant additional permissions to external-provisioner
+    additionalClusterRoleRules:
+    - apiGroups: ["gateway.networking.k8s.io"]
+      resources: ["referencegrants"]
+      verbs: ["get", "list", "watch"]
     resources: {}
     # Tune leader lease election for csi-provisioner.
     # Leader election is on by default.
@@ -56,6 +61,8 @@ sidecars:
     logLevel: 2
     # Additional parameters provided by external-attacher.
     additionalArgs: []
+    # Grant additional permissions to external-attacher
+    additionalClusterRoleRules: []
     resources: {}
     securityContext:
       readOnlyRootFilesystem: true
@@ -71,6 +78,8 @@ sidecars:
     logLevel: 2
     # Additional parameters provided by csi-snapshotter.
     additionalArgs: []
+    # Grant additional permissions to csi-snapshotter
+    additionalClusterRoleRules: []
     resources: {}
     securityContext:
       readOnlyRootFilesystem: true
@@ -105,6 +114,8 @@ sidecars:
     logLevel: 2
     # Additional parameters provided by external-resizer.
     additionalArgs: []
+    # Grant additional permissions to external-resizer
+    additionalClusterRoleRules: []
     resources: {}
     securityContext:
       readOnlyRootFilesystem: true