1+ {{- if .Values.createServiceAccount }}
2+ kind : ClusterRole
3+ apiVersion : rbac.authorization.k8s.io/v1
4+ metadata :
5+ name : {{ .Release.Name }}-ai-agent-cluster-role
6+ namespace : {{ .Release.Namespace }}
7+ rules :
8+ {{- if .Values.customClusterRoleRules }}
9+ {{ toYaml .Values.customClusterRoleRules | indent 2 }}
10+ {{- end }}
11+ - apiGroups :
12+ - " storage.k8s.io"
13+ resources :
14+ - storageclasses
15+ verbs :
16+ - list
17+ - get
18+ - watch
19+ - apiGroups :
20+ - " metrics.k8s.io"
21+ resources :
22+ - pods
23+ - nodes
24+ verbs :
25+ - get
26+ - list
27+ - apiGroups :
28+ - " "
29+ resources :
30+ - configmaps
31+ - daemonsets
32+ - deployments
33+ - events
34+ - namespaces
35+ - persistentvolumes
36+ - persistentvolumeclaims
37+ - pods
38+ - pods/status
39+ - pods/log
40+ - replicasets
41+ - replicationcontrollers
42+ - services
43+ - serviceaccounts
44+ - endpoints
45+ verbs :
46+ - get
47+ - list
48+ - watch
49+
50+ - apiGroups :
51+ - " "
52+ resources :
53+ - nodes
54+ verbs :
55+ - get
56+ - list
57+ - watch
58+
59+ - apiGroups :
60+ - " apiregistration.k8s.io"
61+ resources :
62+ - apiservices
63+ verbs :
64+ - get
65+ - list
66+
67+ - apiGroups :
68+ - " rbac.authorization.k8s.io"
69+ resources :
70+ - clusterroles
71+ - clusterrolebindings
72+ verbs :
73+ - get
74+ - list
75+ - watch
76+ - apiGroups :
77+ - " autoscaling"
78+ resources :
79+ - horizontalpodautoscalers
80+ verbs :
81+ - get
82+ - list
83+ - watch
84+
85+ - apiGroups :
86+ - apps
87+ resources :
88+ - daemonsets
89+ - deployments
90+ - deployments/scale
91+ - replicasets
92+ - replicasets/scale
93+ - statefulsets
94+ verbs :
95+ - get
96+ - list
97+ - watch
98+
99+ - apiGroups :
100+ - extensions
101+ resources :
102+ - daemonsets
103+ - deployments
104+ - deployments/scale
105+ - ingresses
106+ - replicasets
107+ - replicasets/scale
108+ - replicationcontrollers/scale
109+ verbs :
110+ - get
111+ - list
112+ - watch
113+
114+ - apiGroups :
115+ - batch
116+ resources :
117+ - cronjobs
118+ - jobs
119+ verbs :
120+ - get
121+ - list
122+ - watch
123+
124+ - apiGroups :
125+ - " events.k8s.io"
126+ resources :
127+ - events
128+ verbs :
129+ - get
130+ - list
131+
132+ - apiGroups :
133+ - networking.k8s.io
134+ resources :
135+ - ingresses
136+ - networkpolicies
137+ verbs :
138+ - get
139+ - list
140+ - watch
141+ - apiGroups :
142+ - autoscaling
143+ resources :
144+ - horizontalpodautoscalers
145+ verbs :
146+ - get
147+ - list
148+ - apiGroups :
149+ - " policy"
150+ resources :
151+ - poddisruptionbudgets
152+ - podsecuritypolicies
153+ verbs :
154+ - get
155+ - list
156+ - apiGroups :
157+ - rbac.authorization.k8s.io
158+ resources :
159+ - clusterroles
160+ - clusterrolebindings
161+ - roles
162+ - rolebindings
163+ verbs :
164+ - get
165+ - list
166+
167+ # Prometheus CRDs
168+ - apiGroups :
169+ - monitoring.coreos.com
170+ resources :
171+ - alertmanagers
172+ - alertmanagers/finalizers
173+ - alertmanagers/status
174+ - alertmanagerconfigs
175+ - prometheuses
176+ - prometheuses/finalizers
177+ - prometheuses/status
178+ - prometheusagents
179+ - prometheusagents/finalizers
180+ - prometheusagents/status
181+ - thanosrulers
182+ - thanosrulers/finalizers
183+ - thanosrulers/status
184+ - scrapeconfigs
185+ - servicemonitors
186+ - podmonitors
187+ - probes
188+ - prometheusrules
189+ verbs :
190+ - get
191+ - list
192+ - watch
193+
194+ ---
195+ apiVersion : v1
196+ kind : ServiceAccount
197+ metadata :
198+ name : {{ .Release.Name }}-ai-agent-service-account
199+ namespace : {{ .Release.Namespace }}
200+ {{- if .Values.serviceAccount.annotations }}
201+ annotations :
202+ {{- with .Values.serviceAccount.annotations }}
203+ {{- toYaml . | nindent 4}}
204+ {{- end }}
205+ {{- end }}
206+ {{- if .Values.serviceAccount.imagePullSecrets }}
207+ imagePullSecrets :
208+ {{- toYaml .Values.serviceAccount.imagePullSecrets | nindent 2}}
209+ {{- end }}
210+ ---
211+ apiVersion : rbac.authorization.k8s.io/v1
212+ kind : ClusterRoleBinding
213+ metadata :
214+ name : {{ .Release.Name }}-ai-agent-cluster-role-binding
215+ roleRef :
216+ apiGroup : rbac.authorization.k8s.io
217+ kind : ClusterRole
218+ name : {{ .Release.Name }}-ai-agent-cluster-role
219+ subjects :
220+ - kind : ServiceAccount
221+ name : {{ .Release.Name }}-ai-agent-service-account
222+ namespace : {{ .Release.Namespace }}
223+ {{- end }}
0 commit comments