Make the metallb rbac namespaced for the metallb CRs

charts/metallb/templates/rbac.yaml

@@ -15,24 +15,6 @@ rules:
 - apiGroups: [""]
   resources: ["events"]
   verbs: ["create", "patch"]
-- apiGroups: ["metallb.io"]
-  resources: ["addresspools"]
-  verbs: ["get", "list", "watch"]
-- apiGroups: ["metallb.io"]
-  resources: ["bfdprofiles"]
-  verbs: ["get", "list", "watch"]
-- apiGroups: ["metallb.io"]
-  resources: ["bgppeers"]
-  verbs: ["get", "list", "watch"]
-- apiGroups: ["metallb.io"]
-  resources: ["l2advertisements"]
-  verbs: ["get", "list", "watch"]
-- apiGroups: ["metallb.io"]
-  resources: ["bgpadvertisements"]
-  verbs: ["get", "list", "watch"]
-- apiGroups: ["metallb.io"]
-  resources: ["ippools"]
-  verbs: ["get", "list", "watch"]
 {{- if .Values.psp.create }}
 - apiGroups: ["policy"]
   resources: ["podsecuritypolicies"]
@@ -56,6 +38,22 @@ rules:
 - apiGroups: [""]
   resources: ["events"]
   verbs: ["create", "patch"]
+{{- if .Values.psp.create }}
+- apiGroups: ["policy"]
+  resources: ["podsecuritypolicies"]
+  resourceNames: ["{{ template "metallb.fullname" . }}-speaker"]
+  verbs: ["use"]
+{{- end }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "metallb.fullname" . }}-pod-lister
+  labels: {{- include "metallb.labels" . | nindent 4 }}
+rules:
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["list"]
 - apiGroups: ["metallb.io"]
   resources: ["addresspools"]
   verbs: ["get", "list", "watch"]
@@ -74,33 +72,6 @@ rules:
 - apiGroups: ["metallb.io"]
   resources: ["ippools"]
   verbs: ["get", "list", "watch"]
-{{- if .Values.psp.create }}
-- apiGroups: ["policy"]
-  resources: ["podsecuritypolicies"]
-  resourceNames: ["{{ template "metallb.fullname" . }}-speaker"]
-  verbs: ["use"]
-{{- end }}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: {{ template "metallb.fullname" . }}-config-watcher
-  labels:
-    {{- include "metallb.labels" . | nindent 4 }}
-rules:
-- apiGroups: [""]
-  resources: ["configmaps"]
-  verbs: ["get", "list", "watch"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: {{ include "metallb.fullname" . }}-pod-lister
-  labels: {{- include "metallb.labels" . | nindent 4 }}
-rules:
-- apiGroups: [""]
-  resources: ["pods"]
-  verbs: ["list"]
 {{- if .Values.speaker.memberlist.enabled }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -120,6 +91,24 @@ rules:
   resources: ["deployments"]
   resourceNames: ["{{ template "metallb.fullname" . }}-controller"]
   verbs: ["get"]
+- apiGroups: ["metallb.io"]
+  resources: ["addresspools"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: ["metallb.io"]
+  resources: ["bfdprofiles"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: ["metallb.io"]
+  resources: ["bgppeers"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: ["metallb.io"]
+  resources: ["l2advertisements"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: ["metallb.io"]
+  resources: ["bgpadvertisements"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: ["metallb.io"]
+  resources: ["ippools"]
+  verbs: ["get", "list", "watch"]
 {{- end }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1

config/controllers/kustomization.yaml

@@ -4,5 +4,3 @@ resources:
   - speaker.yaml
   - controller.yaml
   - psp.yaml
-  - service-accounts.yaml
-  - rbac.yaml