diff --git a/elasticsearch/templates/clusterrole.yaml b/elasticsearch/templates/clusterrole.yaml deleted file mode 100644 index 2a24bf454..000000000 --- a/elasticsearch/templates/clusterrole.yaml +++ /dev/null @@ -1,41 +0,0 @@ -{{/* -Copyright 2017 The Openstack-Helm Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/}} - -{{- if .Values.manifests.clusterrole }} -{{- $envAll := . }} ---- -apiVersion: rbac.authorization.k8s.io/v1beta1 -kind: ClusterRole -metadata: - name: elasticsearch-runner -rules: - - nonResourceURLs: - - / - verbs: - - get - - apiGroups: - - "" - resources: - - endpoints - verbs: - - get - - apiGroups: - - apps - resources: - - statefulsets/status - verbs: - - get -{{- end -}} diff --git a/elasticsearch/templates/clusterrolebinding-client.yaml b/elasticsearch/templates/clusterrolebinding-client.yaml deleted file mode 100644 index 5ead5090e..000000000 --- a/elasticsearch/templates/clusterrolebinding-client.yaml +++ /dev/null @@ -1,33 +0,0 @@ -{{/* -Copyright 2017 The Openstack-Helm Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/}} - -{{- if .Values.manifests.clusterrolebinding_client }} -{{- $envAll := . }} -{{- $serviceAccountName := "elasticsearch-client"}} ---- -apiVersion: rbac.authorization.k8s.io/v1beta1 -kind: ClusterRoleBinding -metadata: - name: run-elasticsearch-client -subjects: - - kind: ServiceAccount - name: {{ $serviceAccountName }} - namespace: {{ .Release.Namespace }} -roleRef: - kind: ClusterRole - name: elasticsearch-runner - apiGroup: rbac.authorization.k8s.io -{{- end }} diff --git a/elasticsearch/templates/clusterrolebinding-data.yaml b/elasticsearch/templates/clusterrolebinding-data.yaml deleted file mode 100644 index eebf62bff..000000000 --- a/elasticsearch/templates/clusterrolebinding-data.yaml +++ /dev/null @@ -1,33 +0,0 @@ -{{/* -Copyright 2017 The Openstack-Helm Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/}} - -{{- if .Values.manifests.clusterrolebinding_data }} -{{- $envAll := . }} -{{- $serviceAccountName := "elasticsearch-data"}} ---- -apiVersion: rbac.authorization.k8s.io/v1beta1 -kind: ClusterRoleBinding -metadata: - name: run-elasticsearch-data -subjects: - - kind: ServiceAccount - name: {{ $serviceAccountName }} - namespace: {{ .Release.Namespace }} -roleRef: - kind: ClusterRole - name: elasticsearch-runner - apiGroup: rbac.authorization.k8s.io -{{- end }} diff --git a/elasticsearch/templates/deployment-client.yaml b/elasticsearch/templates/deployment-client.yaml index 2c1f1116b..0b8c26a91 100644 --- a/elasticsearch/templates/deployment-client.yaml +++ b/elasticsearch/templates/deployment-client.yaml @@ -27,6 +27,41 @@ limitations under the License. {{- $serviceAccountName := "elasticsearch-client"}} {{ tuple $envAll $envAll.Values.pod_dependency $serviceAccountName | include "helm-toolkit.snippets.kubernetes_pod_rbac_serviceaccount" }} --- +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRoleBinding +metadata: + name: run-elasticsearch-client +subjects: + - kind: ServiceAccount + name: {{ $serviceAccountName }} + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ $serviceAccountName }} + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRole +metadata: + name: {{ $serviceAccountName }} +rules: + - nonResourceURLs: + - / + verbs: + - get + - apiGroups: + - "" + resources: + - endpoints + verbs: + - get + - apiGroups: + - apps + resources: + - statefulsets/status + verbs: + - get +--- apiVersion: extensions/v1beta1 kind: Deployment metadata: diff --git a/elasticsearch/templates/statefulset-data.yaml b/elasticsearch/templates/statefulset-data.yaml index b2d019661..445a47584 100644 --- a/elasticsearch/templates/statefulset-data.yaml +++ b/elasticsearch/templates/statefulset-data.yaml @@ -27,6 +27,41 @@ limitations under the License. {{- $serviceAccountName := "elasticsearch-data"}} {{ tuple $envAll $envAll.Values.pod_dependency $serviceAccountName | include "helm-toolkit.snippets.kubernetes_pod_rbac_serviceaccount" }} --- +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRoleBinding +metadata: + name: run-elasticsearch-data +subjects: + - kind: ServiceAccount + name: {{ $serviceAccountName }} + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ $serviceAccountName }} + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRole +metadata: + name: {{ $serviceAccountName }} +rules: + - nonResourceURLs: + - / + verbs: + - get + - apiGroups: + - "" + resources: + - endpoints + verbs: + - get + - apiGroups: + - apps + resources: + - statefulsets/status + verbs: + - get +--- apiVersion: apps/v1beta1 kind: StatefulSet metadata: diff --git a/elasticsearch/values.yaml b/elasticsearch/values.yaml index 6e1dea5ef..3d12ef48b 100644 --- a/elasticsearch/values.yaml +++ b/elasticsearch/values.yaml @@ -316,9 +316,6 @@ storage: manifests: - clusterrole: true - clusterrolebinding_client: true - clusterrolebinding_data: true configmap_bin: true configmap_etc: true cron_curator: true