Fix helm when memberlist is enabled
Before adding the permissions to the crds, the the controller's role was
added only if memberlist is enabled. Now we always need the permission,
but we only enable the api required by the flag when it's set.
Additionally, the account is always created.
@@ -75,7 +75,6 @@ rules:
- apiGroups: ["metallb.io"]
resources: ["ipaddresspools"]
verbs: ["get", "list", "watch"]
-{{- if .Values.speaker.memberlist.enabled }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
@@ -83,6 +82,7 @@ metadata:
name: {{ include "metallb.fullname" . }}-controller
labels: {{- include "metallb.labels" . | nindent 4 }}
rules:
+{{- if .Values.speaker.memberlist.enabled }}
- apiGroups: [""]
resources: ["secrets"]
verbs: ["create", "get", "list", "watch"]
@@ -94,6 +94,7 @@ rules:
resources: ["deployments"]
resourceNames: ["{{ template "metallb.fullname" . }}-controller"]
verbs: ["get"]
+{{- end }}
- apiGroups: ["metallb.io"]
resources: ["addresspools"]
verbs: ["get", "list", "watch"]
@@ -109,7 +110,6 @@ rules:
- apiGroups: ["metallb.io"]
resources: ["l2advertisements"]
verbs: ["get", "list"]
-{{- end }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
@@ -153,7 +153,6 @@ roleRef:
subjects:
- kind: ServiceAccount
name: {{ include "metallb.speaker.serviceAccountName" . }}
-{{- if .Values.speaker.memberlist.enabled }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
@@ -168,4 +167,3 @@ subjects:
- kind: ServiceAccount
name: {{ include "metallb.controller.serviceAccountName" . }}
{{- end -}}
-{{- end -}}
