Merge pull request #234 from JingmingGuo/jm-multicluster-rbac

Add kubernetes plugin multicluster required RBAC

Author: hagaibarel

charts/coredns/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v2
 name: coredns
-version: 1.43.3
+version: 1.44.3
 appVersion: 1.12.3
 home: https://coredns.io
 icon: https://coredns.io/images/CoreDNS_Colour_Horizontal.png
@@ -21,3 +21,5 @@ annotations:
   artifacthub.io/changes: |
     - kind: changed
       description: Use tpl function for affinity values
+    - kind: added
+      description: Add kubernetes plugin multicluster required RBAC

charts/coredns/README.md

@@ -108,7 +108,7 @@ The command removes all the Kubernetes components associated with the chart and
 ## Configuration
 
 | Parameter                                      | Description                                                                                                                               | Default                                                      |
-| :--------------------------------------------- | :---------------------------------------------------------------------------------------------------------------------------------------- | :----------------------------------------------------------- |
+| :--------------------------------------------- |:------------------------------------------------------------------------------------------------------------------------------------------| :----------------------------------------------------------- |
 | `image.repository`                             | The image repository to pull from                                                                                                         | coredns/coredns                                              |
 | `image.tag`                                    | The image tag to pull from (derived from Chart.yaml)                                                                                      | ``                                                      |
 | `image.pullPolicy`                             | Image pull policy                                                                                                                         | IfNotPresent                                                 |
@@ -140,6 +140,7 @@ The command removes all the Kubernetes components associated with the chart and
 | `serviceAccount.name`                          | If not set & create is true, use template fullname                                                                                        |                                                              |
 | `rbac.create`                                  | If true, create & use RBAC resources                                                                                                      | true                                                         |
 | `rbac.pspEnable`                               | Specifies whether a PodSecurityPolicy should be created.                                                                                  | `false`                                                      |
+| `rbac.multiclusterEnable`                      | Specifies whether the kubernetes plugin multicluster RBAC should be created.                                                              | `false`                                                      |
 | `isClusterService`                             | Specifies whether chart should be deployed as cluster-service or normal k8s app.                                                          | true                                                         |
 | `priorityClassName`                            | Name of Priority Class to assign pods                                                                                                     | `""`                                                         |
 | `securityContext`                              | securityContext definition for pods                                                                                                       | capabilities.add.NET_BIND_SERVICE                            |
@@ -164,7 +165,7 @@ The command removes all the Kubernetes components associated with the chart and
 | `extraVolumes`                                 | Optional array of volumes to create                                                                                                       | []                                                           |
 | `extraVolumeMounts`                            | Optional array of volumes to mount inside the CoreDNS container                                                                           | []                                                           |
 | `extraSecrets`                                 | Optional array of secrets to mount inside the CoreDNS container                                                                           | []                                                           |
-| `env`                                          | Optional array of environment variables for CoreDNS container                                                                           | []                                                           |
+| `env`                                          | Optional array of environment variables for CoreDNS container                                                                             | []                                                           |
 | `customLabels`                                 | Optional labels for Deployment(s), Pod, Service, ServiceMonitor objects                                                                   | {}                                                           |
 | `customAnnotations`                            | Optional annotations for Deployment(s), Pod, Service, ServiceMonitor objects                                                              |
 | `rollingUpdate.maxUnavailable`                 | Maximum number of unavailable replicas during rolling update                                                                              | `1`                                                          |

charts/coredns/templates/clusterrole.yaml

@@ -33,4 +33,14 @@ rules:
   resourceNames:
   - {{ template "coredns.fullname" . }}
 {{- end }}
+{{- if .Values.rbac.multiclusterEnable }}
+- apiGroups:
+  - multicluster.x-k8s.io
+  resources:
+  - serviceexports
+  - serviceimports
+  verbs:
+  - list
+  - watch
+{{- end }}
 {{- end }}