Skip to content

Fix useRoleBindings to properly use Role instead of ClusterRole #1131

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
Closed

Fix useRoleBindings to properly use Role instead of ClusterRole #1131

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions charts/opensearch-operator/templates/opensearch-operator-manager-role-cr.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
apiVersion: rbac.authorization.k8s.io/v1
{{- if .Values.useRoleBindings }}
kind: Role
{{- else }}
kind: ClusterRole
{{- end }}
metadata:
creationTimestamp: null
name: {{ include "opensearch-operator.fullname" . }}-{{ .Release.Namespace }}-manager-role
Expand Down
2 changes: 1 addition & 1 deletion charts/opensearch-operator/templates/opensearch-operator-manager-rolebinding.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ metadata:
name: {{ include "opensearch-operator.fullname" . }}-{{ .Release.Namespace }}-manager-rolebinding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
kind: Role
name: {{ include "opensearch-operator.fullname" . }}-{{ .Release.Namespace }}-manager-role
subjects:
- kind: ServiceAccount
Expand Down
11 changes: 11 additions & 0 deletions charts/opensearch-operator/templates/opensearch-operator-metrics-reader-cr.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,14 @@
apiVersion: rbac.authorization.k8s.io/v1
{{- if .Values.useRoleBindings }}
kind: Role
metadata:
name: {{ include "opensearch-operator.fullname" . }}-{{ .Release.Namespace }}-metrics-reader
rules:
- nonResourceURLs:
- /metrics
verbs:
- get
Comment on lines +7 to +10
Copy link
Contributor

@josedev-union josedev-union Oct 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Namespaced rules cannot apply to non-resource URLs.

{{- else }}
kind: ClusterRole
metadata:
name: {{ include "opensearch-operator.fullname" . }}-{{ .Release.Namespace }}-metrics-reader
Expand All @@ -7,3 +17,4 @@ rules:
- /metrics
verbs:
- get
{{- end }}
4 changes: 4 additions & 0 deletions charts/opensearch-operator/templates/opensearch-operator-proxy-role-cr.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
apiVersion: rbac.authorization.k8s.io/v1
{{- if .Values.useRoleBindings }}
kind: Role
{{- else }}
kind: ClusterRole
{{- end }}
metadata:
name: {{ include "opensearch-operator.fullname" . }}-{{ .Release.Namespace }}-proxy-role
rules:
Expand Down
2 changes: 1 addition & 1 deletion charts/opensearch-operator/templates/opensearch-operator-proxy-rolebinding.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ metadata:
name: {{ include "opensearch-operator.fullname" . }}-{{ .Release.Namespace }}-proxy-rolebinding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
kind: Role
name: {{ include "opensearch-operator.fullname" . }}-{{ .Release.Namespace }}-proxy-role
subjects:
- kind: ServiceAccount
Expand Down