Merge pull request #585 from cdesiniotis/cleanup-multi-ns-rbac

Create one service account even if additional namespaces are configured

Author: klueska

deployments/helm/nvidia-dra-driver-gpu/templates/rbac.yaml

@@ -29,14 +29,12 @@ rules:
 - apiGroups: [""]
   resources: ["pods"]
   verbs: ["get", "list", "watch"]
-
-{{- range $namespace := splitList "," (include "nvidia-dra-driver-gpu.namespaces" .) }}
 ---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: {{ include "nvidia-dra-driver-gpu.serviceAccountName" $ }}
-  namespace: {{ $namespace }}
+  namespace: {{ include "nvidia-dra-driver-gpu.namespace" . }}
   labels:
     {{- include "nvidia-dra-driver-gpu.labels" $ | nindent 4 }}
   {{- with $.Values.serviceAccount.annotations }}
@@ -45,6 +43,21 @@ metadata:
   {{- end }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "nvidia-dra-driver-gpu.name" $ }}-clusterrole-binding-{{ include "nvidia-dra-driver-gpu.namespace" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "nvidia-dra-driver-gpu.serviceAccountName" $ }}
+    namespace: {{ include "nvidia-dra-driver-gpu.namespace" . }}
+roleRef:
+  kind: ClusterRole
+  name: {{ include "nvidia-dra-driver-gpu.name" $ }}-clusterrole
+  apiGroup: rbac.authorization.k8s.io
+
+{{- range $namespace := splitList "," (include "nvidia-dra-driver-gpu.namespaces" .) }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   name: {{ include "nvidia-dra-driver-gpu.name" $ }}-role
@@ -67,18 +80,5 @@ roleRef:
   kind: Role
   name: {{ include "nvidia-dra-driver-gpu.name" $ }}-role
   apiGroup: rbac.authorization.k8s.io
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ include "nvidia-dra-driver-gpu.name" $ }}-clusterrole-binding-{{ $namespace }}
-subjects:
-- kind: ServiceAccount
-  name: {{ include "nvidia-dra-driver-gpu.serviceAccountName" $ }}
-  namespace: {{ $namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ include "nvidia-dra-driver-gpu.name" $ }}-clusterrole
-  apiGroup: rbac.authorization.k8s.io
 {{- end }}
 {{- end }}