Enable the controller RBAC to read secrets within its namespace

In order to enable the controller to read licenses etc upon start-up. Signed-off-by: Alex Ellis (OpenFaaS Ltd) <[email protected]>
openfaas · Nov 7, 2023 · 5be95ca · 5be95ca
1 parent e5bbe43
commit 5be95ca
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 2 deletions.
diff --git a/chart/openfaas/templates/controller-rbac.yaml b/chart/openfaas/templates/controller-rbac.yaml
@@ -25,7 +25,6 @@ metadata:
     heritage: {{ .Release.Service }}
     release: {{ .Release.Name }}
   name: {{ .Release.Name }}-controller
-  namespace: {{ $functionNs | quote }}
 rules:
   - apiGroups:
       - ""
@@ -217,6 +216,12 @@ rules:
       - "get"
       - "list"
       - "watch"
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+    verbs:
+      - get
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding

diff --git a/chart/openfaas/templates/operator-rbac.yaml b/chart/openfaas/templates/operator-rbac.yaml
@@ -120,7 +120,6 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: {{ .Release.Name }}-operator-controller
-  namespace: {{ .Release.Namespace | quote }}
   labels:
     app: {{ template "openfaas.name" . }}
     chart: {{ .Chart.Name }}-{{ .Chart.Version }}