diff --git a/charts/kyverno-authz-server/templates/cluster-role.yaml b/charts/kyverno-authz-server/templates/cluster-role.yaml new file mode 100644 index 0000000..9b82ea1 --- /dev/null +++ b/charts/kyverno-authz-server/templates/cluster-role.yaml @@ -0,0 +1,18 @@ +{{- if .Values.rbac.create -}} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: +metadata: + name: {{ template "kyverno-authz-server.name" . }} + labels: + {{- include "kyverno-authz-server.labels" . | nindent 4 }} +rules: + - apiGroups: + - envoy.kyverno.io + resources: + - authorizationpolicies + verbs: + - get + - list + - watch +{{- end -}} diff --git a/charts/kyverno-authz-server/templates/role-binding.yaml b/charts/kyverno-authz-server/templates/role-binding.yaml new file mode 100644 index 0000000..0babdd8 --- /dev/null +++ b/charts/kyverno-authz-server/templates/role-binding.yaml @@ -0,0 +1,17 @@ +{{- if .Values.rbac.create -}} +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ template "kyverno-authz-server.name" . }} + namespace: {{ template "kyverno.lib.namespace" . }} + labels: + {{- include "kyverno-authz-server.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "kyverno-authz-server.name" . }} +subjects: + - kind: ServiceAccount + name: {{ template "kyverno-authz-server.service-account.name" . }} + namespace: {{ template "kyverno.lib.namespace" . }} +{{- end -}} diff --git a/charts/kyverno-authz-server/values.yaml b/charts/kyverno-authz-server/values.yaml index b4aca5a..0de9a8a 100644 --- a/charts/kyverno-authz-server/values.yaml +++ b/charts/kyverno-authz-server/values.yaml @@ -207,7 +207,7 @@ containers: service: # -- Service port. - port: 80 + port: 9081 # -- Service type. type: ClusterIP diff --git a/charts/kyverno-sidecar-injector/templates/rbac.yaml b/charts/kyverno-sidecar-injector/templates/service-account.yaml similarity index 100% rename from charts/kyverno-sidecar-injector/templates/rbac.yaml rename to charts/kyverno-sidecar-injector/templates/service-account.yaml