Removing ambassador rbac, letting ambassador chart deal with it

SeldonIO · Feb 12, 2019 · 39117b6 · 39117b6
1 parent e696eac
commit 39117b6
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 72 deletions.
diff --git a/helm-charts/seldon-core/templates/rbac.yaml b/helm-charts/seldon-core/templates/rbac.yaml
@@ -1,5 +1,5 @@
 {{- if .Values.rbac.enabled }}
-{{- if .Values.rbac.service_account.create }}  
+{{- if .Values.rbac.service_account.create }}
 ---
 apiVersion: v1
 kind: ServiceAccount
@@ -14,7 +14,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   name: seldon-local
-  namespace: {{ .Release.Namespace }}    
+  namespace: {{ .Release.Namespace }}
 rules:
 - apiGroups: ["*"]
   resources:
@@ -46,7 +46,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: seldon-wide
-  namespace: {{ .Release.Namespace }}    
+  namespace: {{ .Release.Namespace }}
 rules:
 - apiGroups: ["*"]
   resources:
@@ -78,7 +78,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: seldon-crd-{{ .Release.Namespace }}
-  namespace: {{ .Release.Namespace }}    
+  namespace: {{ .Release.Namespace }}
 rules:
 - apiGroups:
   - apiextensions.k8s.io
@@ -99,74 +99,6 @@ subjects:
   - kind: ServiceAccount
     name: {{ .Values.rbac.service_account.name }}
     namespace: {{ .Release.Namespace }}
-{{- end }}    
-{{- if .Values.ambassador.enabled }}
-{{- if .Values.single_namespace }}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: ambassador
-rules:
-- apiGroups: [""]
-  resources:
-  - services
-  verbs: ["get", "list", "watch"]
-- apiGroups: [""]
-  resources:
-  - configmaps
-  verbs: ["create", "update", "patch", "get", "list", "watch"]
-- apiGroups: [""]
-  resources:
-  - secrets
-  verbs: ["get", "list", "watch"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: ambassador
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: ambassador
-subjects:
-- kind: ServiceAccount
-  name: {{ .Values.rbac.service_account.name }}
-  namespace: {{ .Release.Namespace }}
-{{- end }}
-{{- if not .Values.single_namespace }}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: ambassador
-rules:
-- apiGroups: [""]
-  resources:
-  - services
-  verbs: ["get", "list", "watch"]
-- apiGroups: [""]
-  resources:
-  - configmaps
-  verbs: ["create", "update", "patch", "get", "list", "watch"]
-- apiGroups: [""]
-  resources:
-  - secrets
-  verbs: ["get", "list", "watch"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: ambassador
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: ambassador
-subjects:
-- kind: ServiceAccount
-  name: {{ .Values.rbac.service_account.name }}
-  namespace: {{ .Release.Namespace }}
 {{- end }}
-{{- end }}  
 {{- end }}
 {{- end }}
diff --git a/helm-charts/seldon-core/values.yaml b/helm-charts/seldon-core/values.yaml
@@ -24,6 +24,9 @@ ambassador:
     https:
       targetPort: 8443
     type: LoadBalancer
+  rbac:
+    create: true
+    namespaced: true
 apife:
   annotations: null
   enabled: true