From c2da7c6e446498fd226a9f94ed86d3c96990cf5d Mon Sep 17 00:00:00 2001
From: raffis <raffael.sahli@doodle.com>
Date: Mon, 12 Jun 2023 11:37:47 +0200
Subject: [PATCH] fix(chart): allow sa to read metrics (#15)

---
 chart/k8sreq-duplicator-controller/Chart.yaml  |  2 +-
 .../templates/deployment.yaml                  |  2 +-
 .../templates/metrics-rbac.yaml                | 18 ++++++++++++++++++
 chart/k8sreq-duplicator-controller/values.yaml |  5 +++--
 4 files changed, 23 insertions(+), 4 deletions(-)

diff --git a/chart/k8sreq-duplicator-controller/Chart.yaml b/chart/k8sreq-duplicator-controller/Chart.yaml
index 821e09c..6caeef0 100644
--- a/chart/k8sreq-duplicator-controller/Chart.yaml
+++ b/chart/k8sreq-duplicator-controller/Chart.yaml
@@ -14,4 +14,4 @@ keywords:
 name: k8sreq-duplicator-controller
 sources:
 - https://github.com/DoodleScheduling/k8sreq-duplicator-controller
-version: 0.0.2
+version: 0.0.3
diff --git a/chart/k8sreq-duplicator-controller/templates/deployment.yaml b/chart/k8sreq-duplicator-controller/templates/deployment.yaml
index c18c855..04d750e 100644
--- a/chart/k8sreq-duplicator-controller/templates/deployment.yaml
+++ b/chart/k8sreq-duplicator-controller/templates/deployment.yaml
@@ -88,7 +88,7 @@ spec:
         - --upstream=http://127.0.0.1:{{ .Values.metricsPort }}
         - --logtostderr=true
         - --v=0
-        image: quay.io/brancz/kube-rbac-proxy:v0.14.0
+        image: {{ .Values.kubeRBACProxy.image }}
         imagePullPolicy: IfNotPresent
         name: kube-rbac-proxy
         ports:
diff --git a/chart/k8sreq-duplicator-controller/templates/metrics-rbac.yaml b/chart/k8sreq-duplicator-controller/templates/metrics-rbac.yaml
index 7fdc1ec..d659ace 100644
--- a/chart/k8sreq-duplicator-controller/templates/metrics-rbac.yaml
+++ b/chart/k8sreq-duplicator-controller/templates/metrics-rbac.yaml
@@ -16,6 +16,24 @@ rules:
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
+metadata:
+  name: {{ include "k8sreq-duplicator-controller.fullname" . }}-metrics
+  labels:
+    app.kubernetes.io/name: {{ include "k8sreq-duplicator-controller.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    helm.sh/chart: {{ include "k8sreq-duplicator-controller.chart" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "k8sreq-duplicator-controller.fullname" . }}-metrics-reader
+subjects:
+- kind: ServiceAccount
+  name: {{ template "k8sreq-duplicator-controller.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
 metadata:
   name: {{ include "k8sreq-duplicator-controller.fullname" . }}-proxy
   labels:
diff --git a/chart/k8sreq-duplicator-controller/values.yaml b/chart/k8sreq-duplicator-controller/values.yaml
index 042eaa2..ee83e59 100644
--- a/chart/k8sreq-duplicator-controller/values.yaml
+++ b/chart/k8sreq-duplicator-controller/values.yaml
@@ -88,7 +88,7 @@ securityContext:
     drop: ["all"]
   readOnlyRootFilesystem: true
 
-podSecurityContext:  
+podSecurityContext:
   runAsGroup: 10000
   runAsNonRoot: true
   runAsUser: 10000
@@ -132,6 +132,7 @@ prometheusRule:
 
 kubeRBACProxy:
   enabled: true
+  image: quay.io/brancz/kube-rbac-proxy:v0.14.2
   securityContext:
     allowPrivilegeEscalation: false
     capabilities:
@@ -145,5 +146,5 @@ kubeRBACProxy:
   # requests:
   #   cpu: 5m
   #   memory: 64Mi
-    
+
 tolerations: []