feat: remove k8s cluster role

onecx · Aug 22, 2024 · c252657 · c252657
1 parent 63cae67
commit c252657
Show file tree

Hide file tree

Showing 10 changed files with 65 additions and 220 deletions.
diff --git a/...dules/onecx-iam-kc-client-operator/pages/onecx-iam-kc-client-operator-docs.adoc b/...dules/onecx-iam-kc-client-operator/pages/onecx-iam-kc-client-operator-docs.adoc
@@ -65,9 +65,6 @@ app:
   name: kc-client-operator
   image:
     repository: "onecx/onecx-iam-kc-client-operator"
-  env:
-    # See watchNamespaces
-    "QUARKUS_OPERATOR_SDK_CONTROLLERS_KC_NAMESPACES": "JOSDK_WATCH_CURRENT"
   envCustom:
     - name: KUBERNETES_NAMESPACE
       valueFrom:
@@ -76,6 +73,14 @@ app:
   serviceAccount:
     enabled: true
 
+----
+
+ueFrom:
+        fieldRef:
+          fieldPath: metadata.namespace
+  serviceAccount:
+    enabled: true
+
 # Values: JOSDK_WATCH_CURRENT, JOSDK_ALL_NAMESPACES or comma separated list of namespaces
 watchNamespaces: "JOSDK_WATCH_CURRENT"
 

diff --git a/...onecx-iam-kc-client-operator/pages/onecx-iam-kc-client-operator-extensions.adoc b/...onecx-iam-kc-client-operator/pages/onecx-iam-kc-client-operator-extensions.adoc
@@ -11,93 +11,93 @@ h| Version
 | tkit-quarkus-log-cdi
 
 | https://1000kit.github.io/tkit-quarkus/current/tkit-quarkus/tkit-quarkus-log-cdi.html[Link]
-| https://github.com/1000kit/tkit-quarkus/blob/2.28.0/docs/modules/tkit-quarkus/pages/includes/tkit-quarkus-log-cdi.adoc[Link]
-| 2.28.0
+| https://github.com/1000kit/tkit-quarkus/blob/2.31.0/docs/modules/tkit-quarkus/pages/includes/tkit-quarkus-log-cdi.adoc[Link]
+| 2.31.0
 
 | tkit-quarkus-log-rs
 
 | https://1000kit.github.io/tkit-quarkus/current/tkit-quarkus/tkit-quarkus-log-rs.html[Link]
-| https://github.com/1000kit/tkit-quarkus/blob/2.28.0/docs/modules/tkit-quarkus/pages/includes/tkit-quarkus-log-rs.adoc[Link]
-| 2.28.0
+| https://github.com/1000kit/tkit-quarkus/blob/2.31.0/docs/modules/tkit-quarkus/pages/includes/tkit-quarkus-log-rs.adoc[Link]
+| 2.31.0
 
 | tkit-quarkus-log-json
 
 | https://1000kit.github.io/tkit-quarkus/current/tkit-quarkus/tkit-quarkus-log-json.html[Link]
-| https://github.com/1000kit/tkit-quarkus/blob/2.28.0/docs/modules/tkit-quarkus/pages/includes/tkit-quarkus-log-json.adoc[Link]
-| 2.28.0
+| https://github.com/1000kit/tkit-quarkus/blob/2.31.0/docs/modules/tkit-quarkus/pages/includes/tkit-quarkus-log-json.adoc[Link]
+| 2.31.0
 
 | quarkus-arc
 
 | https://quarkus.io/guides/cdi-reference[Link]
 | https://github.com/quarkusio/quarkusio.github.io/blob/develop/_generated-doc/latest/config/quarkus-arc.adoc[Link]
-| 3.12.2
+| 3.13.2
 
 | quarkus-micrometer-registry-prometheus
 
 | https://quarkus.io/guides/telemetry-micrometer[Link]
 | https://github.com/quarkusio/quarkusio.github.io/blob/develop/_generated-doc/latest/config/quarkus-micrometer-registry-prometheus.adoc[Link]
-| 3.12.2
+| 3.13.2
 
 | quarkus-opentelemetry
 
 | https://quarkus.io/guides/opentelemetry[Link]
 | https://github.com/quarkusio/quarkusio.github.io/blob/develop/_generated-doc/latest/config/quarkus-opentelemetry.adoc[Link]
-| 3.12.2
+| 3.13.2
 
 | quarkus-rest-client
 
 | https://quarkus.io/guides/rest-client[Link]
 | https://github.com/quarkusio/quarkusio.github.io/blob/develop/_generated-doc/latest/config/quarkus-rest-client.adoc[Link]
-| 3.12.2
+| 3.13.2
 
 | quarkus-rest-client-jackson
 
 | https://quarkus.io/guides/rest-client[Link]
 | 
-| 3.12.2
+| 3.13.2
 
 | tkit-quarkus-security
 
 | https://1000kit.github.io/tkit-quarkus/current/tkit-quarkus/tkit-quarkus-security.html[Link]
-| https://github.com/1000kit/tkit-quarkus/blob/2.28.0/docs/modules/tkit-quarkus/pages/includes/tkit-quarkus-security.adoc[Link]
-| 2.28.0
+| https://github.com/1000kit/tkit-quarkus/blob/2.31.0/docs/modules/tkit-quarkus/pages/includes/tkit-quarkus-security.adoc[Link]
+| 2.31.0
 
 | onecx-core
 
 | https://onecx.github.io/docs/onecx-quarkus/current/onecx-quarkus/onecx-core.html[Link]
 | 
-| 0.24.0
+| 0.26.0
 
 | quarkus-smallrye-health
 
 | https://quarkus.io/guides/smallrye-health[Link]
 | https://github.com/quarkusio/quarkusio.github.io/blob/develop/_generated-doc/latest/config/quarkus-smallrye-health.adoc[Link]
-| 3.12.2
+| 3.13.2
 
 | quarkus-container-image-docker
 
 | https://quarkus.io/guides/container-image[Link]
 | https://github.com/quarkusio/quarkusio.github.io/blob/develop/_generated-doc/latest/config/quarkus-container-image-docker.adoc[Link]
-| 3.12.2
+| 3.13.2
 
 
 | quarkus-operator-sdk-bundle-generator
 
 | 
 | 
-| 6.7.1
+| 6.7.3
 
 | quarkus-operator-sdk
 
 | 
 | 
-| 6.7.1
+| 6.7.3
 
 | quarkus-keycloak-admin-rest-client
 
 | 
 | 
-| 3.12.2
+| 3.13.2
 
 
 |===
diff --git a/src/main/helm/crds/keycloakclients.onecx.tkit.org-v1.yml b/src/main/helm/crds/keycloakclients.onecx.tkit.org-v1.yml
diff --git a/src/main/helm/templates/kc-client-cluster-role-binding.yaml b/src/main/helm/templates/kc-client-cluster-role-binding.yaml
diff --git a/src/main/helm/templates/operator-cluster-role-binding.yaml b/src/main/helm/templates/operator-cluster-role-binding.yaml
diff --git a/src/main/helm/templates/operator-cluster-role.yaml b/src/main/helm/templates/operator-cluster-role.yaml
diff --git a/src/main/helm/templates/role-binding.yaml b/src/main/helm/templates/role-binding.yaml
@@ -0,0 +1,11 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ .Release.Name }}-{{ .Values.app.name }}-role-binding
+roleRef:
+  kind: Role
+  apiGroup: rbac.authorization.k8s.io
+  name: {{ .Release.Name }}-{{ .Values.app.name }}-role
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Release.Name }}-{{ .Values.app.name }}
diff --git a/...elm/templates/kc-client-cluster-role.yaml → src/main/helm/templates/role.yaml b/...elm/templates/kc-client-cluster-role.yaml → src/main/helm/templates/role.yaml
@@ -1,27 +1,27 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ .Release.Name }}-{{ .Values.app.name }}-cluster-role
-rules:
-  - apiGroups:
-      - "onecx.tkit.org"
-    resources:
-      - "keycloakclients"
-      - "keycloakclients/status"
-      - "keycloakclients/finalizers"
-    verbs:
-      - "get"
-      - "list"
-      - "watch"
-      - "patch"
-      - "update"
-      - "create"
-      - "delete"
-  - apiGroups:
-      - ""
-    resources:
-      - secrets
-    verbs:
-      - get
-      - list
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ .Release.Name }}-{{ .Values.app.name }}-role
+rules:
+  - apiGroups:
+      - "onecx.tkit.org"
+    resources:
+      - "keycloakclients"
+      - "keycloakclients/status"
+      - "keycloakclients/finalizers"
+    verbs:
+      - "get"
+      - "list"
+      - "watch"
+      - "patch"
+      - "update"
+      - "create"
+      - "delete"
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+    verbs:
+      - get
+      - list
       - watch
diff --git a/src/main/helm/values.yaml b/src/main/helm/values.yaml
@@ -2,16 +2,10 @@ app:
   name: kc-client-operator
   image:
     repository: "onecx/onecx-iam-kc-client-operator"
-  env:
-    # See watchNamespaces
-    "QUARKUS_OPERATOR_SDK_CONTROLLERS_KC_NAMESPACES": "JOSDK_WATCH_CURRENT"
   envCustom:
     - name: KUBERNETES_NAMESPACE
       valueFrom:
         fieldRef:
           fieldPath: metadata.namespace
   serviceAccount:
     enabled: true
-
-# Values: JOSDK_WATCH_CURRENT, JOSDK_ALL_NAMESPACES or comma separated list of namespaces
-watchNamespaces: "JOSDK_WATCH_CURRENT"