feat: remove k8s cluster role (#27)

onecx · Aug 21, 2024 · e338a7c · e338a7c
1 parent accf425
commit e338a7c
Show file tree

Hide file tree

Showing 7 changed files with 13 additions and 128 deletions.
diff --git a/src/main/helm/crds/datas.onecx.tkit.org-v1.yml b/src/main/helm/crds/datas.onecx.tkit.org-v1.yml
diff --git a/src/main/helm/templates/operator-cluster-role-binding.yaml b/src/main/helm/templates/operator-cluster-role-binding.yaml
diff --git a/src/main/helm/templates/operator-cluster-role.yaml b/src/main/helm/templates/operator-cluster-role.yaml
diff --git a/src/main/helm/templates/product-cluster-role-binding.yaml b/src/main/helm/templates/product-cluster-role-binding.yaml
diff --git a/src/main/helm/templates/role-binding.yaml b/src/main/helm/templates/role-binding.yaml
@@ -0,0 +1,11 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ .Release.Name }}-{{ .Values.app.name }}-role-binding
+roleRef:
+  kind: Role
+  apiGroup: rbac.authorization.k8s.io
+  name: {{ .Release.Name }}-{{ .Values.app.name }}-role
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Release.Name }}-{{ .Values.app.name }}
diff --git a/.../helm/templates/product-cluster-role.yaml → src/main/helm/templates/role.yaml b/.../helm/templates/product-cluster-role.yaml → src/main/helm/templates/role.yaml
@@ -1,7 +1,7 @@
 apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
+kind: Role
 metadata:
-  name: {{ .Release.Name }}-{{ .Values.app.name }}-cluster-role
+  name: {{ .Release.Name }}-{{ .Values.app.name }}-role
 rules:
   - apiGroups:
       - "onecx.tkit.org"

diff --git a/src/main/helm/values.yaml b/src/main/helm/values.yaml
@@ -9,14 +9,10 @@ app:
           fieldPath: metadata.namespace
   serviceAccount:
     enabled: true
-
   operator:
     keycloak:
       client:
         enabled: true
         spec:
           kcConfig:
             defaultClientScopes: [ ocx-ws:write, ocx-pm-assignment:write, ocx-tn:write, ocx-th:write ]
-
-# Values: JOSDK_WATCH_CURRENT, JOSDK_ALL_NAMESPACES or comma separated list of namespaces
-watchNamespaces: "JOSDK_WATCH_CURRENT"