feat(operator): render a namespaced Role when watchNamespace is set

charts/ferrvault-operator/README.md

@@ -49,7 +49,7 @@ kubectl delete crd ferrvaultsecrets.ferrvault.com ferrvaultconnections.ferrvault
 | `replicaCount` | `1` | Raise when using leader election for HA. |
 | `leaderElection.enabled` | `true` | |
 | `leaderElection.id` | `ferrvault-operator.ferrvault.com` | Change to run multiple isolated instances in one cluster. |
-| `watchNamespace` | `""` (cluster-wide) | Single namespace scope when set. |
+| `watchNamespace` | `""` (cluster-wide) | Single namespace scope when set. RBAC is then a namespaced `Role` and `RoleBinding` in that namespace instead of a `ClusterRole`. |
 | `defaultRefreshInterval` | `1h` | Fallback for `FerrVaultSecret.spec.refreshInterval`. |
 | `stallThreshold` | `15m` | Liveness fails when no reconcile completes for this long while FerrVault resources exist. Keep it above the 10m connection probe interval. |
 | `reconcileTimeout` | `2m` | A single reconcile is cancelled after this long, so one call that never returns cannot hold the work queue. The operator refuses to start below about 31s, the longest one FerrVault API call can take with its three 10s attempts and backoff. |

charts/ferrvault-operator/templates/_helpers.tpl

@@ -71,3 +71,30 @@ with the chart version released together.
 {{- define "ferrvault-operator.imageTag" -}}
 {{- default .Chart.AppVersion .Values.image.tag }}
 {{- end }}
+
+{{- define "ferrvault-operator.rules" -}}
+- apiGroups: ["ferrvault.com"]
+  resources: [ferrvaultsecrets, ferrvaultconnections]
+  verbs: [get, list, watch, create, update, patch, delete]
+- apiGroups: ["ferrvault.com"]
+  resources: [ferrvaultsecrets/status, ferrvaultconnections/status]
+  verbs: [get, update, patch]
+- apiGroups: ["ferrvault.com"]
+  resources: [ferrvaultsecrets/finalizers, ferrvaultconnections/finalizers]
+  verbs: [update]
+- apiGroups: [apps]
+  resources: [deployments, statefulsets, daemonsets]
+  verbs: [get, patch]
+- apiGroups: [""]
+  resources: [secrets]
+  verbs: [get, list, watch, create, update, patch]
+- apiGroups: [""]
+  resources: [events]
+  verbs: [create, patch]
+{{- end }}
+
+{{- define "ferrvault-operator.leaseRules" -}}
+- apiGroups: ["coordination.k8s.io"]
+  resources: [leases]
+  verbs: [get, list, watch, create, update, patch, delete]
+{{- end }}

charts/ferrvault-operator/templates/clusterrole.yaml

@@ -1,41 +1,13 @@
-{{- if .Values.rbac.create -}}
+{{- if and .Values.rbac.create (not .Values.watchNamespace) -}}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: {{ include "ferrvault-operator.fullname" . }}
   labels:
     {{- include "ferrvault-operator.labels" . | nindent 4 }}
 rules:
-  # Full CR access for the operator's own types.
-  - apiGroups: ["ferrvault.com"]
-    resources: [ferrvaultsecrets, ferrvaultconnections]
-    verbs: [get, list, watch, create, update, patch, delete]
-  - apiGroups: ["ferrvault.com"]
-    resources: [ferrvaultsecrets/status, ferrvaultconnections/status]
-    verbs: [get, update, patch]
-  - apiGroups: ["ferrvault.com"]
-    resources: [ferrvaultsecrets/finalizers, ferrvaultconnections/finalizers]
-    verbs: [update]
-
-  - apiGroups: [apps]
-    resources: [deployments, statefulsets, daemonsets]
-    verbs: [get, patch]
-
-  # Manages the target Secret and reads the referenced token Secret.
-  - apiGroups: [""]
-    resources: [secrets]
-    verbs: [get, list, watch, create, update, patch]
-
-  # Emits Events that show up on `kubectl describe ferrvaultsecret …`.
-  - apiGroups: [""]
-    resources: [events]
-    verbs: [create, patch]
-
+  {{- include "ferrvault-operator.rules" . | nindent 2 }}
   {{- if .Values.leaderElection.enabled }}
-  # Leader election lease. Scoped to the release namespace; the operator does
-  # not need cluster-wide lease access when it owns one specific lease name.
-  - apiGroups: ["coordination.k8s.io"]
-    resources: [leases]
-    verbs: [get, list, watch, create, update, patch, delete]
+  {{- include "ferrvault-operator.leaseRules" . | nindent 2 }}
   {{- end }}
 {{- end }}

charts/ferrvault-operator/templates/clusterrolebinding.yaml

@@ -1,4 +1,4 @@
-{{- if .Values.rbac.create -}}
+{{- if and .Values.rbac.create (not .Values.watchNamespace) -}}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:

charts/ferrvault-operator/templates/role.yaml

@@ -0,0 +1,61 @@
+{{- if and .Values.rbac.create .Values.watchNamespace -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "ferrvault-operator.fullname" . }}
+  namespace: {{ .Values.watchNamespace }}
+  labels:
+    {{- include "ferrvault-operator.labels" . | nindent 4 }}
+rules:
+  {{- include "ferrvault-operator.rules" . | nindent 2 }}
+  {{- if and .Values.leaderElection.enabled (eq .Values.watchNamespace .Release.Namespace) }}
+  {{- include "ferrvault-operator.leaseRules" . | nindent 2 }}
+  {{- end }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "ferrvault-operator.fullname" . }}
+  namespace: {{ .Values.watchNamespace }}
+  labels:
+    {{- include "ferrvault-operator.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ include "ferrvault-operator.fullname" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "ferrvault-operator.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- if and .Values.leaderElection.enabled (ne .Values.watchNamespace .Release.Namespace) }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "ferrvault-operator.fullname" . }}-leader-election
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "ferrvault-operator.labels" . | nindent 4 }}
+rules:
+  {{- include "ferrvault-operator.leaseRules" . | nindent 2 }}
+  - apiGroups: [""]
+    resources: [events]
+    verbs: [create, patch]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "ferrvault-operator.fullname" . }}-leader-election
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "ferrvault-operator.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ include "ferrvault-operator.fullname" . }}-leader-election
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "ferrvault-operator.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end }}
+{{- end }}

charts/ferrvault-operator/values.yaml

@@ -23,7 +23,7 @@ leaderElection:
 
 # --- Scope ---
 # Empty string = cluster-wide (operator watches every namespace). Set to a
-# namespace name to restrict the informer cache to a single namespace.
+# namespace name to restrict the informer cache and the RBAC to a single namespace.
 watchNamespace: ""
 
 # --- Runtime flags ---