Upgrade - rbacmanager pack to 1.10.0

packs/rbacmanager-1.10.0/README.md

@@ -0,0 +1,90 @@
+# RBAC Manager
+
+[RBAC Manager](https://fairwindsops.github.io/rbac-manager/) was designed to simplify authorization in Kubernetes. This is an operator that supports declarative configuration for RBAC with new custom resources. Instead of managing role bindings or service accounts directly, you can specify a desired state and RBAC Manager will make the necessary changes to achieve that state.
+
+This project has three main goals:
+1. Provide a declarative approach to RBAC that is more approachable and scalable.
+2. Reduce the amount of configuration required for great auth.
+3. Enable automation of RBAC configuration updates with CI/CD.
+
+## Prerequisites
+
+As of chart version 1.6.0 Kubernetes 1.16+, Helm 2.10+
+
+Helm 3 will be made mandatory in the future.
+
+## Parameters
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| image.repository | string | `"us-docker.pkg.dev/fairwinds-ops/oss/rbac-manager"` | The image to run for rbac manager |
+| image.tag | string | `"v1.10.0"` | The tag of the image to run. **Note:** Requires the prefix 'v' for version 1.10.0+ |
+| image.digest | string | `""` | The digest of the image to run |
+| image.pullPolicy | string | `"Always"` | The image pullPolicy. Recommend not changing this |
+| image.imagePullSecrets | list | `[]` | |
+| extraArgs | object | `{}` | A map of flag=value to pass to rbac-manager |
+| installCRDs | bool | `true` | If true, install and upgrade CRDs. See the Helm documentation for [best practices regarding CRDs](https://helm.sh/docs/chart_best_practices/custom_resource_definitions/#install-a-crd-declaration-before-using-the-resource). |
+| crds.additionalLabels | object | `{}` | add additional labels to the installed CRDs |
+| rbac.additionalLabels | object | `{}` | add additional labels to the installed RBAC resources |
+| resources | object | `{"limits":{"cpu":"100m","memory":"128Mi"},"requests":{"cpu":"100m","memory":"128Mi"}}` | A resources block for the rbac-manager pods |
+| priorityClassName | string | `""` | The name of a priorityClass to use |
+| nodeSelector | object | `{}` | Deployment nodeSelector |
+| tolerations | list | `[]` | Deployment tolerations |
+| affinity | object | `{}` | Deployment affinity |
+| podAnnotations | object | `{}` | Annotations to apply to the pods |
+| podLabels | object | `{}` | Labels to apply to the pod |
+| podSecurityContext | object | `{}` | securityContext to apply to the whole pod |
+| securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | securityContext to apply to the rbac-manager container |
+| deploymentLabels | object | `{}` | Labels to apply to the Deployment resource |
+| serviceMonitor.enabled | bool | `false` | If true, a ServiceMonitor will be created for Prometheus |
+| serviceMonitor.additionalLabels | list | `[]` | Additional labels to ServiceMonitor |
+| serviceMonitor.annotations | object | `{}` | Annotations to apply to the serviceMonitor and headless service |
+| serviceMonitor.namespace | string | `""` | The namespace to deploy the serviceMonitor into |
+| serviceMonitor.interval | string | `"60s"` | How often to scrape the metrics endpoint |
+| serviceMonitor.relabelings | list | `[]` | RelabelConfigs to apply to samples before scraping |
+
+## Upgrade
+
+### Upgrading to Chart Version 2.0.0
+**Breaking:** The default container image is now `us-docker.pkg.dev/fairwinds-ops/oss/rbac-manager`. The previous default, `quay.io/reactiveops/rbac-manager`, is deprecated.
+
+To remain on Quay during migration, set `image.repository` (and `image.tag` if needed) in your values.
+
+### Upgrading to Chart Version 1.0.0
+The upgrade to version 1.0.0 of this chart removes support for installing RBAC Definitions as part of the chart values. This change was made to simplify CRD installation with Helm. We recommend installing RBAC Definitions separately from the chart.
+
+For backwards compatibility with the chart originally included in the rbac-manager repository, we've removed the Helm `install-crd` hook from this chart. Unfortunately as part of improving backwards compatibility with the chart in the rbac-manager repository, we have made it more difficult to upgrade from the inital versions of the charts here.
+
+Some quirks in Helm make the upgrade process from 0.x of this chart to 1.x challenging due to the potential of the RBAC Definition CRD getting deleted. In most cases, reinstalling the chart will be the best path forward.
+
+If either of the following apply and you are upgrading from an earlier version of the chart found in this repository, keep on reading:
+1. A momentary lapse in access granted by RBAC Definitions is unacceptable.
+2. You're using auth tokens from Service Accounts created by RBAC Manager.
+
+The following process has worked repeatedly for us to upgrade from an older version of this chart to 1.0.0. These steps worked with Helm and Tiller 2.12.3 for us, but due to the absurdity of this process, we can't guarantee it will work for you.
+
+1. Install rbac-manager with chart that uses install-crd hook (`fairwinds-stable/rbac-manager@0.2.1`)
+2. Upgrade to rbac-manager chart that doesn't use install-crd hook (`fairwinds-stable/rbac-manager@1.0.0`) - this upgrade fails but is important later
+3. Upgrade to original rbac-manager chart that uses install-crd hook (`fairwinds-stable/rbac-manager@0.2.1`) - this works
+4. Rollback to revision 2 - this fails
+5. Rollback to revision 2 - this works
+
+In the above workflow, an RBAC Definition installed between revision 1 and 2 should persist through to revision 5. This process is admittedly quite strange, and in our testing the second rollback (step 5) is indeed required for this process to work.
+
+## Usage
+
+We recommend installing rbac-manager in its own namespace and specifying the version to ensure consistency:
+
+```bash
+helm repo add fairwinds-stable [https://charts.fairwinds.com/stable](https://charts.fairwinds.com/stable)
+helm install rbac-manager fairwinds-stable/rbac-manager --namespace rbac-manager --set image.tag=v1.10.0
+```
+
+## References
+https://github.com/FairwindsOps/rbac-manager
+https://rbac-manager.docs.fairwinds.com/
+
+
+
+
+

packs/rbacmanager-1.10.0/charts/rbac-manager/.helmignore

@@ -0,0 +1,21 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj

packs/rbacmanager-1.10.0/charts/rbac-manager/Chart.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+appVersion: 1.10.0
+description: A Kubernetes operator that simplifies the management of Role Bindings
+  and Service Accounts.
+home: https://rbac-manager.docs.fairwinds.com
+icon: https://raw.githubusercontent.com/FairwindsOps/charts/master/stable/rbac-manager/icon.png
+keywords:
+- rbac
+- authorization
+kubeVersion: '>= 1.22.0-0'
+maintainers:
+- email: andy@fairwinds.com
+  name: sudermanjr
+name: rbac-manager
+sources:
+- https://github.com/FairwindsOps/charts/tree/master/stable/rbac-manager
+- https://github.com/FairwindsOps/rbac-manager
+version: 2.0.0

packs/rbacmanager-1.10.0/charts/rbac-manager/README.md

@@ -0,0 +1,85 @@
+# RBAC Manager
+
+[RBAC Manager](https://fairwindsops.github.io/rbac-manager/) was designed to simplify authorization in Kubernetes. This is an operator that supports declarative configuration for RBAC with new custom resources. Instead of managing role bindings or service accounts directly, you can specify a desired state and RBAC Manager will make the necessary changes to achieve that state.
+
+This project has three main goals:
+
+1. Provide a declarative approach to RBAC that is more approachable and scalable.
+2. Reduce the amount of configuration required for great auth.
+3. Enable automation of RBAC configuration updates with CI/CD.
+
+More information about RBAC Manager is available on [GitHub](https://github.com/FairwindsOps/rbac-manager) as well as from the [official documentation](https://fairwindsops.github.io/rbac-manager/).
+
+## Installation
+
+We recommend installing rbac-manager in its own namespace and a simple release name:
+
+```
+helm repo add fairwinds-stable https://charts.fairwinds.com/stable
+helm install rbac-manager fairwinds-stable/rbac-manager --namespace rbac-manager
+```
+
+## Prerequisites
+
+As of chart version 1.6.0 Kubernetes 1.16+, Helm 2.10+
+
+Helm 3 will be made mandatory in the future.
+
+## Upgrading to Chart Version 2.0.0
+
+**Breaking:** The default container image is now `us-docker.pkg.dev/fairwinds-ops/oss/rbac-manager`. The previous default, `quay.io/reactiveops/rbac-manager`, is deprecated.
+
+To remain on Quay during migration, set `image.repository` (and `image.tag` if needed) in your values.
+
+## Upgrading to Chart Version 1.0.0
+
+The upgrade to version 1.0.0 of this chart removes support for installing RBAC Definitions as part of the chart values. This change was made to simplify CRD installation with Helm. We recommend installing RBAC Definitions separately from the chart.
+
+For backwards compatibility with the chart originally included in the rbac-manager repository, we've removed the Helm `install-crd` hook from this chart. Unfortunately as part of improving backwards compatibility with the chart in the rbac-manager repository, we have made it more difficult to upgrade from the inital versions of the charts here.
+
+Some quirks in Helm make the upgrade process from 0.x of this chart to 1.x challenging due to the potential of the RBAC Definition CRD getting deleted. In most cases, reinstalling the chart will be the best path forward.
+
+If either of the following apply and you are upgrading from an earlier version of the chart found in this repository, keep on reading:
+
+1. A momentary lapse in access granted by RBAC Definitions is unacceptable
+2. You're using auth tokens from Service Accounts created by RBAC Manager
+
+The following process has worked repeatedly for us to upgrade from an older version of this chart to 1.0.0. These steps worked with Helm and Tiller 2.12.3 for us, but due to the absurdity of this process, we can't guarantee it will work for you.
+
+1. Install rbac-manager with chart that uses install-crd hook (fairwinds-stable/rbac-manager@0.2.1)
+2. Upgrade to rbac-manager chart that doesn't use install-crd hook (fairwinds-stable/rbac-manager@1.0.0) - this upgrade fails but is important later
+3. Upgrade to original rbac-manager chart that uses install-crd hook (fairwinds-stable/rbac-manager@0.2.1) - this works
+4. Rollback to revision 2 - this fails
+5. Rollback to revision 2 - this works
+
+In the above workflow, an RBAC Definition installed between revision 1 and 2 should persist through to revision 5. This process is admittedly quite strange, and in our testing the second rollback (step 5) is indeed required for this process to work.
+
+## Values
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| image.repository | string | `"us-docker.pkg.dev/fairwinds-ops/oss/rbac-manager"` | The image to run for rbac manager |
+| image.tag | string | `""` | The tag of the image to run. Defaults to the Chart's AppVersion |
+| image.digest | string | `""` | The digest of the image to run |
+| image.pullPolicy | string | `"Always"` | The image pullPolicy. Recommend not changing this |
+| image.imagePullSecrets | list | `[]` |  |
+| extraArgs | object | `{}` | A map of flag=value to pass to rbac-manager |
+| installCRDs | bool | `true` | If true, install and upgrade CRDs. See the Helm documentation for [best practices regarding CRDs](https://helm.sh/docs/chart_best_practices/custom_resource_definitions/#install-a-crd-declaration-before-using-the-resource). |
+| crds.additionalLabels | object | `{}` | add additional labels to the installed CRDs |
+| rbac.additionalLabels | object | `{}` | add additional labels to the installed RBAC resources |
+| resources | object | `{"limits":{"cpu":"100m","memory":"128Mi"},"requests":{"cpu":"100m","memory":"128Mi"}}` | A resources block for the rbac-manager pods |
+| priorityClassName | string | `""` | The name of a priorityClass to use |
+| nodeSelector | object | `{}` | Deployment nodeSelector |
+| tolerations | list | `[]` | Deployment tolerations |
+| affinity | object | `{}` | Deployment affinity |
+| podAnnotations | object | `{}` | Annotations to apply to the pods |
+| podLabels | object | `{}` | Labels to apply to the pod |
+| podSecurityContext | object | `{}` | securityContext to apply to the whole pod |
+| securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | securityContext to apply to the rbac-manager container |
+| deploymentLabels | object | `{}` | Labels to apply to the Deployment resource |
+| serviceMonitor.enabled | bool | `false` | If true, a ServiceMonitor will be created for Prometheus |
+| serviceMonitor.additionalLabels | list | `[]` | Additional labels to ServiceMonitor |
+| serviceMonitor.annotations | object | `{}` | Annotations to apply to the serviceMonitor and headless service |
+| serviceMonitor.namespace | string | `""` | The namespace to deploy the serviceMonitor into |
+| serviceMonitor.interval | string | `"60s"` | How often to scrape the metrics endpoint |
+| serviceMonitor.relabelings | list | `[]` | RelabelConfigs to apply to samples before scraping |

packs/rbacmanager-1.10.0/charts/rbac-manager/README.md.gotmpl

@@ -0,0 +1,57 @@
+# RBAC Manager
+
+[RBAC Manager](https://fairwindsops.github.io/rbac-manager/) was designed to simplify authorization in Kubernetes. This is an operator that supports declarative configuration for RBAC with new custom resources. Instead of managing role bindings or service accounts directly, you can specify a desired state and RBAC Manager will make the necessary changes to achieve that state.
+
+This project has three main goals:
+
+1. Provide a declarative approach to RBAC that is more approachable and scalable.
+2. Reduce the amount of configuration required for great auth.
+3. Enable automation of RBAC configuration updates with CI/CD.
+
+More information about RBAC Manager is available on [GitHub](https://github.com/FairwindsOps/rbac-manager) as well as from the [official documentation](https://fairwindsops.github.io/rbac-manager/).
+
+## Installation
+
+We recommend installing rbac-manager in its own namespace and a simple release name:
+
+```
+helm repo add fairwinds-stable https://charts.fairwinds.com/stable
+helm install rbac-manager fairwinds-stable/rbac-manager --namespace rbac-manager
+```
+
+## Prerequisites
+
+As of chart version 1.6.0 Kubernetes 1.16+, Helm 2.10+
+
+Helm 3 will be made mandatory in the future.
+
+## Upgrading to Chart Version 2.0.0
+
+**Breaking:** The default container image is now `us-docker.pkg.dev/fairwinds-ops/oss/rbac-manager`. The previous default, `quay.io/reactiveops/rbac-manager`, is deprecated.
+
+To remain on Quay during migration, set `image.repository` (and `image.tag` if needed) in your values.
+
+## Upgrading to Chart Version 1.0.0
+
+The upgrade to version 1.0.0 of this chart removes support for installing RBAC Definitions as part of the chart values. This change was made to simplify CRD installation with Helm. We recommend installing RBAC Definitions separately from the chart.
+
+For backwards compatibility with the chart originally included in the rbac-manager repository, we've removed the Helm `install-crd` hook from this chart. Unfortunately as part of improving backwards compatibility with the chart in the rbac-manager repository, we have made it more difficult to upgrade from the inital versions of the charts here.
+
+Some quirks in Helm make the upgrade process from 0.x of this chart to 1.x challenging due to the potential of the RBAC Definition CRD getting deleted. In most cases, reinstalling the chart will be the best path forward.
+
+If either of the following apply and you are upgrading from an earlier version of the chart found in this repository, keep on reading:
+
+1. A momentary lapse in access granted by RBAC Definitions is unacceptable
+2. You're using auth tokens from Service Accounts created by RBAC Manager
+
+The following process has worked repeatedly for us to upgrade from an older version of this chart to 1.0.0. These steps worked with Helm and Tiller 2.12.3 for us, but due to the absurdity of this process, we can't guarantee it will work for you.
+
+1. Install rbac-manager with chart that uses install-crd hook (fairwinds-stable/rbac-manager@0.2.1)
+2. Upgrade to rbac-manager chart that doesn't use install-crd hook (fairwinds-stable/rbac-manager@1.0.0) - this upgrade fails but is important later
+3. Upgrade to original rbac-manager chart that uses install-crd hook (fairwinds-stable/rbac-manager@0.2.1) - this works
+4. Rollback to revision 2 - this fails
+5. Rollback to revision 2 - this works
+
+In the above workflow, an RBAC Definition installed between revision 1 and 2 should persist through to revision 5. This process is admittedly quite strange, and in our testing the second rollback (step 5) is indeed required for this process to work.
+
+{{ template "chart.valuesSection" . }}

packs/rbacmanager-1.10.0/charts/rbac-manager/ci/digest-values.yaml

@@ -0,0 +1,2 @@
+image:
+  digest: sha256:6d19fab047a0fa6c687e94bb6bf02f73bc304938add5501aefc1524a2bf381b1

packs/rbacmanager-1.10.0/charts/rbac-manager/ci/test-values.yaml

@@ -0,0 +1,5 @@
+extraArgs:
+  log-level: DEBUG
+
+deploymentLabels:
+  test: test

packs/rbacmanager-1.10.0/charts/rbac-manager/templates/NOTES.txt

@@ -0,0 +1,7 @@
+Thanks for installing RBAC Manager! To see what it's doing, use `kubectl logs` for your new RBAC Manager pod.
+
+If you haven't already installed an RBAC Definition to configure your authorization, visit https://rbac-manager.docs.fairwinds.com/ for more information.
+
+For more information on integrating RBAC with common authentication patterns, visit https://rbac-manager.docs.fairwinds.com/ -> Cloud Provider Auth.
+
+If you run into any problems or find something missing in the documentation, don't hesitate to open an issue here: https://github.com/fairwindsops/rbac-manager/issues.

packs/rbacmanager-1.10.0/charts/rbac-manager/templates/_helpers.tpl

@@ -0,0 +1,48 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "rbac-manager.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "rbac-manager.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "rbac-manager.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+RBAC Manager OSS images use v-prefixed semver tags on Artifact Registry (e.g. v1.10.0).
+*/}}
+{{- define "rbac-manager.imageTag" -}}
+{{- if .Values.image.tag -}}
+{{- .Values.image.tag -}}
+{{- else -}}
+{{- $v := .Chart.AppVersion -}}
+{{- if hasPrefix "v" $v -}}
+{{- $v -}}
+{{- else -}}
+{{- printf "v%s" $v -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}