Add the capability to use RoleBindings instead of ClusterRoleBindings

charts/opensearch-operator/templates/opensearch-operator-manager-rolebinding-crb.yaml

@@ -1,3 +1,4 @@
+{{- if not .Values.useRoleBindings }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
@@ -10,3 +11,4 @@ subjects:
 - kind: ServiceAccount
   name: {{ include "opensearch-operator.serviceAccountName" . }}
   namespace: {{ .Release.Namespace }}
+{{- end }}

charts/opensearch-operator/templates/opensearch-operator-manager-rolebinding.yaml

@@ -0,0 +1,14 @@
+{{- if .Values.useRoleBindings }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "opensearch-operator.fullname" . }}-{{ .Release.Namespace }}-manager
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "opensearch-operator.fullname" . }}-{{ .Release.Namespace }}-manager-role
+subjects:
+- kind: ServiceAccount
+  name: {{ include "opensearch-operator.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+{{- end }}

charts/opensearch-operator/templates/opensearch-operator-proxy-rolebinding-crb.yaml

@@ -1,3 +1,4 @@
+{{- if not .Values.useRoleBindings }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
@@ -10,3 +11,4 @@ subjects:
 - kind: ServiceAccount
   name: {{ include "opensearch-operator.serviceAccountName" . }}
   namespace: {{ .Release.Namespace }}
+{{- end }}

charts/opensearch-operator/templates/opensearch-operator-proxy-rolebinding.yaml

@@ -0,0 +1,14 @@
+{{- if .Values.useRoleBindings }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "opensearch-operator.fullname" . }}-{{ .Release.Namespace }}-proxy
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "opensearch-operator.fullname" . }}-{{ .Release.Namespace }}-proxy-role
+subjects:
+- kind: ServiceAccount
+  name: {{ include "opensearch-operator.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+{{- end }}

charts/opensearch-operator/values.yaml

@@ -108,3 +108,9 @@ kubeRbacProxy:
   image:
     repository: "gcr.io/kubebuilder/kube-rbac-proxy"
     tag: "v0.15.0"
+
+## If this is set to true, RoleBindings will be used instead of ClusterRoleBindings, inorder to restrict ClusterRoles
+## to the namespace where the operator and OpenSearch cluster are in. In that case, specify the namespace where they
+## are in in manager.watchNamespace field.
+## If false, ClusterRoleBindings will be used
+useRoleBindings: false