Fix KEDA crashes when using cert-manager certificates and restricted …

…secret access (#518) * Fix KEDA crashes when using cert-manager certificates and restricted secret access Allow KEDA operator to get, list and watch secrets in its own namespace when restricted mode and certmanager are enabled. Signed-off-by: Guillaume Jacquet <[email protected]> * revert version bump Signed-off-by: Guillaume Jacquet <[email protected]> * extra conditions Signed-off-by: Guillaume Jacquet <[email protected]> * fix ) Signed-off-by: Guillaume Jacquet <[email protected]> * extra conditions Signed-off-by: Guillaume Jacquet <[email protected]> * fix role creation logic Signed-off-by: Guillaume Jacquet <[email protected]> * Update keda/templates/manager/role.yaml Co-authored-by: Jorge Turrado Ferrero <[email protected]> Signed-off-by: Guillaume Jacquet <[email protected]> * Update keda/templates/manager/rolebinding.yaml Co-authored-by: Jorge Turrado Ferrero <[email protected]> Signed-off-by: Guillaume Jacquet <[email protected]> * fixes Signed-off-by: Guillaume Jacquet <[email protected]> --------- Signed-off-by: Guillaume Jacquet <[email protected]> Co-authored-by: Jorge Turrado Ferrero <[email protected]>
kedacore · Sep 25, 2023 · 991a617 · 991a617
1 parent 7a4ba4a
commit 991a617
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 4 deletions.
diff --git a/keda/templates/manager/role.yaml b/keda/templates/manager/role.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.certificates.autoGenerated ( not .Values.certificates.certManager.enabled ) }}
+{{- if or (and .Values.certificates.autoGenerated (not .Values.certificates.certManager.enabled)) (.Values.permissions.operator.restrict.secret) }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
@@ -17,11 +17,13 @@ rules:
   resources:
   - secrets
   verbs:
+  {{- if and .Values.certificates.autoGenerated (not .Values.certificates.certManager.enabled) }}
   - create
   - delete
-  - get
-  - list
   - patch
   - update
+  {{- end }}
   - watch
+  - get
+  - list
 {{- end -}}
diff --git a/keda/templates/manager/rolebinding.yaml b/keda/templates/manager/rolebinding.yaml
@@ -1,4 +1,4 @@
-{{- if and .Values.certificates.autoGenerated ( not .Values.certificates.certManager.enabled ) }}
+{{- if or (and .Values.certificates.autoGenerated (not .Values.certificates.certManager.enabled)) (.Values.permissions.operator.restrict.secret) }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata: