fix: 🐛 update rbac for both traefik.io and containo.us apigroups (#836)

traefik · Apr 25, 2023 · 0efbcb5 · 0efbcb5
1 parent 3ddbeb4
commit 0efbcb5
Show file tree

Hide file tree

Showing 3 changed files with 52 additions and 0 deletions.
diff --git a/traefik/templates/rbac/clusterrole.yaml b/traefik/templates/rbac/clusterrole.yaml
@@ -44,6 +44,7 @@ rules:
 {{- end -}}
 {{- if .Values.providers.kubernetesCRD.enabled }}
   - apiGroups:
+      - traefik.io
       - traefik.containo.us
     resources:
       - ingressroutes

diff --git a/traefik/templates/rbac/role.yaml b/traefik/templates/rbac/role.yaml
@@ -37,6 +37,7 @@ rules:
 {{- end -}}
 {{- if .Values.providers.kubernetesCRD.enabled }}
   - apiGroups:
+      - traefik.io
       - traefik.containo.us
     resources:
       - ingressroutes

diff --git a/traefik/tests/rbac-config_test.yaml b/traefik/tests/rbac-config_test.yaml
@@ -227,3 +227,53 @@ tests:
           path: subjects[0].namespace
           value: "traefik-ns-override"
         template: rbac/rolebinding.yaml
+  - it: cluster rbac should be on both traefik.io and containo.us API group
+    set:
+    asserts:
+      - template: rbac/clusterrole.yaml
+        contains:
+          path: rules
+          content:
+            apiGroups:
+              - traefik.io
+              - traefik.containo.us
+            resources:
+              - ingressroutes
+              - ingressroutetcps
+              - ingressrouteudps
+              - middlewares
+              - middlewaretcps
+              - tlsoptions
+              - tlsstores
+              - traefikservices
+              - serverstransports
+            verbs:
+              - get
+              - list
+              - watch
+  - it: namespaced rbac should be on both traefik.io and containo.us API group
+    set:
+      rbac:
+        namespaced: true
+    asserts:
+      - template: rbac/role.yaml
+        contains:
+          path: rules
+          content:
+            apiGroups:
+              - traefik.io
+              - traefik.containo.us
+            resources:
+              - ingressroutes
+              - ingressroutetcps
+              - ingressrouteudps
+              - middlewares
+              - middlewaretcps
+              - tlsoptions
+              - tlsstores
+              - traefikservices
+              - serverstransports
+            verbs:
+              - get
+              - list
+              - watch