From 6ffaad31a9e06d934c046bcbd0a2cb1dcd287612 Mon Sep 17 00:00:00 2001
From: Tamal Saha <tamal@appscode.com>
Date: Fri, 7 Jun 2024 00:31:27 -0700
Subject: [PATCH] Add permissions for cluster-presets

Signed-off-by: Tamal Saha <tamal@appscode.com>
---
 .../templates/cluster-role-binding.yaml       |  2 +-
 .../templates/cluster-role.yaml               | 71 +++++++++++++++++++
 .../cluster-presets/templates/deployment.yaml |  1 +
 .../templates/serviceaccount.yaml             |  1 +
 4 files changed, 74 insertions(+), 1 deletion(-)

diff --git a/charts/cluster-presets/templates/cluster-role-binding.yaml b/charts/cluster-presets/templates/cluster-role-binding.yaml
index 3b2f38034..16cc7ee2d 100644
--- a/charts/cluster-presets/templates/cluster-role-binding.yaml
+++ b/charts/cluster-presets/templates/cluster-role-binding.yaml
@@ -10,5 +10,5 @@ roleRef:
   name: {{ include "cluster-presets.fullname" . }}
 subjects:
 - kind: ServiceAccount
-  name: {{ include "cluster-presets.fullname" . }}
+  name: {{ include "cluster-presets.serviceAccountName" . }}
   namespace: {{ .Release.Namespace }}
diff --git a/charts/cluster-presets/templates/cluster-role.yaml b/charts/cluster-presets/templates/cluster-role.yaml
index b8253920b..b120373e4 100644
--- a/charts/cluster-presets/templates/cluster-role.yaml
+++ b/charts/cluster-presets/templates/cluster-role.yaml
@@ -11,3 +11,74 @@ rules:
   resources:
   - namespaces
   verbs: ["get"]
+# chart presets
+- apiGroups:
+  - charts.x-helm.dev
+  resources:
+  - chartpresets
+  - clusterchartpresets
+  verbs: ["*"]
+# kubedb
+- apiGroups:
+  - kubedb.com
+  - ops.kubedb.com
+  - autoscaling.kubedb.com
+  resources: ["*"]
+  verbs: ["get", "list", "watch"]
+- apiGroups:
+  - archiver.kubedb.com
+  resources: ["*"]
+  verbs: ["*"]
+# petset
+- apiGroups:
+  - apps.k8s.appscode.com
+  resources:
+  - placementpolicies
+  verbs: ["*"]
+# node topologies
+- apiGroups:
+  - node.k8s.appscode.com
+  resources:
+  - nodetopologies
+  verbs: ["*"]
+# kubestash
+- apiGroups:
+  - storage.kubestash.com
+  resources:
+  - backupstorages
+  - repositories
+  verbs: ["get", "list", "watch"]
+# capi
+- apiGroups:
+  - cluster.x-k8s.io
+  resources:
+  - machinepools
+  verbs: ["*"]
+- apiGroups:
+  - infrastructure.cluster.x-k8s.io
+  resources:
+  - azuremachinepools
+  - gcpmanagedmachinepools
+  verbs: ["*"]
+# karpenter aws
+- apiGroups:
+  - karpenter.sh
+  resources:
+  - nodepools
+  verbs: ["*"]
+- apiGroups:
+  - karpenter.k8s.aws
+  resources:
+  - ec2nodeclasses
+  verbs: ["*"]
+# storage class
+- apiGroups:
+  - storage.k8s.io
+  resources:
+  - storageclasses
+  verbs: ["get", "list", "watch"]
+- apiGroups:
+  - snapshot.storage.k8s.io
+  resources:
+  - volumesnapshotclasses
+  verbs: ["get", "list", "watch"]
diff --git a/charts/cluster-presets/templates/deployment.yaml b/charts/cluster-presets/templates/deployment.yaml
index 5b29a32d3..c979caa5f 100644
--- a/charts/cluster-presets/templates/deployment.yaml
+++ b/charts/cluster-presets/templates/deployment.yaml
@@ -2,6 +2,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ include "cluster-presets.fullname" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "cluster-presets.labels" . | nindent 4 }}
 spec:
diff --git a/charts/cluster-presets/templates/serviceaccount.yaml b/charts/cluster-presets/templates/serviceaccount.yaml
index 1d8be7a07..552601ae6 100644
--- a/charts/cluster-presets/templates/serviceaccount.yaml
+++ b/charts/cluster-presets/templates/serviceaccount.yaml
@@ -3,6 +3,7 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: {{ include "cluster-presets.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
   labels:
     {{- include "cluster-presets.labels" . | nindent 4 }}
   {{- with .Values.serviceAccount.annotations }}