First Commit

templates/external-endpoint-rbac.yaml

@@ -0,0 +1,37 @@
+{{- if .Values.externalAccess.enabled }}
+{{- $fullname := include "redis-cluster.fullname" . }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ $fullname }}-endpoint-reader
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "redis-cluster.labels" . | nindent 4 }}
+rules:
+  - apiGroups: [""]
+    resources: ["services"]
+    verbs: ["get"]
+    resourceNames:
+      - {{ $fullname }}-external
+    {{- range $shard := until (int .Values.cluster.shards) }}
+    {{- range $member := until (int (add (int $.Values.cluster.replicasPerShard) 1)) }}
+      - {{ printf "%s-s%d-n%d-x" $fullname $shard $member | trunc 63 | trimSuffix "-" }}
+    {{- end }}
+    {{- end }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ $fullname }}-endpoint-reader
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "redis-cluster.labels" . | nindent 4 }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "redis-cluster.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ $fullname }}-endpoint-reader
+{{- end }}