Add missing RBAC for external-dns

Signed-off-by: Yury Tsarev <yury.tsarev@absa.africa>
k8gb-io · Mar 1, 2021 · 549808c · 549808c
1 parent 5315096
commit 549808c
Show file tree

Hide file tree

Showing 2 changed files with 35 additions and 9 deletions.
diff --git a/chart/k8gb/templates/external-dns/rbac.yaml b/chart/k8gb/templates/external-dns/rbac.yaml
@@ -0,0 +1,35 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: external-dns
+rules:
+- apiGroups: ["externaldns.k8s.io"]
+  resources: ["dnsendpoints"]
+  verbs: ["get","watch","list"]
+- apiGroups: ["externaldns.k8s.io"]
+  resources: ["dnsendpoints/status"]
+  verbs: ["*"]
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  name: external-dns-viewer
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: external-dns
+subjects:
+- kind: ServiceAccount
+  name: external-dns
+  namespace: {{ .Release.Namespace }}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: external-dns
+  namespace: {{ .Release.Namespace }}
+{{ if .Values.route53.enabled }}
+  annotations:
+    eks.amazonaws.com/role-arn: {{ .Values.route53.irsaRole }}
+{{ end }}
diff --git a/chart/k8gb/templates/external-dns/service-account.yaml b/chart/k8gb/templates/external-dns/service-account.yaml