diff --git a/charts/eks-anywhere-packages/templates/role.yaml b/charts/eks-anywhere-packages/templates/role.yaml index d47ac0de..c483dcf2 100644 --- a/charts/eks-anywhere-packages/templates/role.yaml +++ b/charts/eks-anywhere-packages/templates/role.yaml @@ -44,4 +44,26 @@ rules: verbs: - create - patch -{{- end }} \ No newline at end of file +{{- end }} +{{- if .Values.workloadOnly }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ include "eks-anywhere-packages.fullname" . }}-manager-role + namespace: {{ .Values.namespace }}-{{ .Values.clusterName }} + labels: + {{- include "eks-anywhere-packages.labels" . | nindent 4 }} + {{- with .Values.additionalAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +rules: +- apiGroups: + - "" + resources: + - namespaces + - secrets + verbs: + - delete +{{- end }} diff --git a/charts/eks-anywhere-packages/templates/rolebinding.yaml b/charts/eks-anywhere-packages/templates/rolebinding.yaml index 44d542d4..50a48ae7 100644 --- a/charts/eks-anywhere-packages/templates/rolebinding.yaml +++ b/charts/eks-anywhere-packages/templates/rolebinding.yaml @@ -18,4 +18,26 @@ subjects: - kind: ServiceAccount name: {{ .Values.serviceAccount.name }} namespace: {{ .Values.namespace }} -{{- end }} \ No newline at end of file +{{- end }} +{{- if .Values.workloadOnly }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ include "eks-anywhere-packages.fullname" . }}-manager-rolebinding + namespace: {{ .Values.namespace }}-{{ .Values.clusterName }} + labels: + {{- include "eks-anywhere-packages.labels" . | nindent 4 }} + {{- with .Values.additionalAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ include "eks-anywhere-packages.fullname" . }}-manager-role +subjects: + - kind: ServiceAccount + name: eksa-controller-manager + namespace: eksa-system +{{- end }}