add RoleBinding for subtenants

aenix-io · Dec 9, 2024 · 64e79cc · 64e79cc
1 parent e79479d
commit 64e79cc
Showing 1 changed file with 14 additions and 4 deletions.
diff --git a/packages/apps/tenant/templates/tenant.yaml b/packages/apps/tenant/templates/tenant.yaml
@@ -410,15 +410,25 @@ roleRef:
   name: {{ include "tenant.name" . }}-super-admin
   apiGroup: rbac.authorization.k8s.io
 ---
-kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
 metadata:
   name: {{ include "tenant.name" . }}-super-admin
   namespace: {{ include "tenant.name" . }}
 subjects:
-  - kind: Group
-    name: {{ include "tenant.name" . }}-super-admin
-    apiGroup: rbac.authorization.k8s.io
+{{- if hasPrefix "tenant-" .Release.Namespace }}
+{{- $parts := splitList "-" .Release.Namespace }}
+{{- range $i, $v := $parts }}
+{{- if ne $i 0 }}
+- kind: Group
+  name: {{ include "tenant.name" . }}-super-admin
+  apiGroup: rbac.authorization.k8s.io
+{{- end }}
+{{- end }}
+{{- end }}
+- kind: ServiceAccount
+  name: {{ include "tenant.name" . }}
+  namespace: {{ include "tenant.name" . }}
 roleRef:
   kind: Role
   name: {{ include "tenant.name" . }}-super-admin