Follow-up from "Resolve "Test and Document Dev User RBAC""
The following discussion from !68 (merged) should be addressed:
-
@andrewshoell started a discussion: (+3 comments) When I run
helm template chart --set "bigbang.rbac.enabled=true"
I get invalid templates, e.g.--- # Source: headlamp/templates/bigbang/dev-clusterrolebinding.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: read-1 rules: - apiGroups: - "" resources: - namespaces - pods verbs: - get - list - watch --- # Source: headlamp/templates/bigbang/dev-clusterrolebinding.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: -binding roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: subjects: - kind: ServiceAccount name: release-name namespace: default ---
Further see the following:
helm template chart --set "bigbang.rbac.enabled=true" | kubectl apply --dry-run=server -f - serviceaccount/release-name-headlamp created (server dry run) secret/oidc created (server dry run) clusterrole.rbac.authorization.k8s.io/read-1 created (server dry run) service/release-name-headlamp created (server dry run) deployment.apps/release-name-headlamp created (server dry run) serviceaccount/headlamp-wait-job-sa created (server dry run) configmap/headlamp-wait-script created (server dry run) role.rbac.authorization.k8s.io/headlamp-wait-job-role created (server dry run) rolebinding.rbac.authorization.k8s.io/headlamp-wait-job-rolebinding created (server dry run) job.batch/headlamp-wait-job created (server dry run) The ClusterRoleBinding "-binding" is invalid: roleRef.name: Required value
We should turn on and test rbac with some combination of test-values.yaml, gluon script, cypress, and/or helm unit tests.