Create rolebinding for .Release.Namespace implicitly (#643)

* Create rolebinding for .Release.Namespace implicitly Signed-off-by: Jirka Kremser <[email protected]> * Operator should be able to list and watch secrets in the release ns (certs) Signed-off-by: Jirka Kremser <[email protected]> --------- Signed-off-by: Jirka Kremser <[email protected]>
kedacore · Sep 25, 2024 · c77e0bb · c77e0bb
1 parent a563cad
commit c77e0bb
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 1 deletion.
diff --git a/keda/templates/manager/clusterrolebindings.yaml b/keda/templates/manager/clusterrolebindings.yaml
@@ -20,7 +20,8 @@ subjects:
   name: {{ (.Values.serviceAccount.operator).name | default .Values.serviceAccount.name }}
   namespace: {{ .Release.Namespace }}
 {{- else }}
-  {{- range ( split "," .Values.watchNamespace ) }}
+  {{- $namespaces := append (splitList "," .Values.watchNamespace) .Release.Namespace -}}
+  {{- range $namespaces }}
 ---
 # Role binding for namespace '{{ . }}'
 apiVersion: rbac.authorization.k8s.io/v1

diff --git a/keda/templates/manager/minimal-rbac.yaml b/keda/templates/manager/minimal-rbac.yaml
@@ -34,6 +34,10 @@ rules:
   verbs:
   - create
   - update
+{{- if .Values.permissions.operator.restrict.secret }}
+  - list
+  - watch
+{{- end }}
 {{- end }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1