option for read all

Author: puckpuck

charts/seashell/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: seashell
 description: A tool that provides a shell to debug Kubernetes workloads
 type: application
-version: 0.1.1
+version: 0.2.0
 appVersion: 0.1
 keywords:
   - debug

charts/seashell/README.md

@@ -26,19 +26,20 @@ helm install seashell puckpuck/seashell
 
 ## Parameters
 
-| Parameter                    | Description                                                | Default                                          |
-|------------------------------|------------------------------------------------------------|--------------------------------------------------|
-| `image.repository`           | seashell Image repository                                  | `puckpuck/seashell`                              |
-| `image.tag`                  | seashell Image tag (leave blank to use app version)        | `nil`                                            |
-| `image.pullPolicy`           | seashell Image pull policy                                 | `IfNotPresent`                                   |
-| `serviceAccount.create`      | Specify whether a ServiceAccount should be created         | `true`                                           |
-| `serviceAccount.annotations` | Annotations to be applied to ServiceAccount                | `{}`                                             |
-| `serviceAccount.name`        | The name of the ServiceAccount to create                   | Generated using the `seashell.fullname` template |
-| `rbac.create`                | Specify whether RBAC resources should be created and used  | `true`                                           |
-| `podAnnotations`             | Pod annotations                                            | `{}`                                             |
-| `podSecurityContext`         | Security context for pod                                   | `{}`                                             | 
-| `securityContext`            | Security context for container                             | `{}`                                             | 
-| `resources`                  | CPU/Memory resource requests/limits                        | `{}`                                             | 
-| `nodeSelector`               | Node labels for pod assignment                             | `{}`                                             | 
-| `tolerations`                | Tolerations for pod assignment                             | `[]`                                             | 
-| `affinity`                   | Map of node/pod affinities                                 | `{}`                                             |
+| Parameter                    | Description                                                            | Default                                          |
+|------------------------------|------------------------------------------------------------------------|--------------------------------------------------|
+| `image.repository`           | seashell Image repository                                              | `puckpuck/seashell`                              |
+| `image.tag`                  | seashell Image tag (leave blank to use app version)                    | `nil`                                            |
+| `image.pullPolicy`           | seashell Image pull policy                                             | `IfNotPresent`                                   |
+| `serviceAccount.create`      | Specify whether a ServiceAccount should be created                     | `true`                                           |
+| `serviceAccount.annotations` | Annotations to be applied to ServiceAccount                            | `{}`                                             |
+| `serviceAccount.name`        | The name of the ServiceAccount to create                               | Generated using the `seashell.fullname` template |
+| `rbac.create`                | Specify whether RBAC resources should be created and used              | `true`                                           |
+| `rbac.readAll`               | Specify whether to include READ permssions on ALL Kubernetes resources | `false`                                          |
+| `podAnnotations`             | Pod annotations                                                        | `{}`                                             |
+| `podSecurityContext`         | Security context for pod                                               | `{}`                                             | 
+| `securityContext`            | Security context for container                                         | `{}`                                             | 
+| `resources`                  | CPU/Memory resource requests/limits                                    | `{}`                                             | 
+| `nodeSelector`               | Node labels for pod assignment                                         | `{}`                                             | 
+| `tolerations`                | Tolerations for pod assignment                                         | `[]`                                             | 
+| `affinity`                   | Map of node/pod affinities                                             | `{}`                                             |

charts/seashell/templates/cluster-role-binding.yaml

@@ -1,4 +1,4 @@
-{{- if .Values.rbac.create }}
+{{- if and .Values.rbac.create .Values.rbac.readAll }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
@@ -13,4 +13,4 @@ subjects:
   - kind: ServiceAccount
     name: {{ include "seashell.serviceAccountName" . }}
     namespace: {{ .Release.Namespace }}
-  {{- end }}
+{{- end }}

charts/seashell/templates/cluster-role.yaml

@@ -1,4 +1,4 @@
-{{- if .Values.rbac.create }}
+{{- if and .Values.rbac.create .Values.rbac.readAll }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
@@ -16,4 +16,4 @@ rules:
       - get
       - list
       - watch
-  {{- end }}
+{{- end }}

charts/seashell/values.yaml

@@ -24,6 +24,8 @@ serviceAccount:
 rbac:
   # Specifies whether to create cluster roles and bindings
   create: true
+  # If set to true, a Role and RoleBinding with READ permissions on ALL objects will be created
+  readAll: false
 
 podAnnotations: { }