implement roles

charts/operator-wandb/values.yaml

@@ -773,6 +773,18 @@ settingsMigrationHook:
   install: false
   service:
     enabled: false
+  role:
+    create: true
+    rules:
+      - apiGroups:
+          - ""
+        resources:
+          - secrets
+        verbs:
+          - get
+          - list
+          - update
+          - patch
   env:
     SMH_FILE_STORE:
       value: '{{ (include "wandb.bucket" . | fromYaml).url }}'

charts/wandb-base/templates/role.yaml

@@ -0,0 +1,12 @@
+{{- if .Values.role.create }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "wandb-base.fullname" .}}
+  labels:
+    {{- include "wandb-base.labels" . | nindent 4 }}
+rules:
+    {{- with .Values.role.rules }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+{{- end }}

charts/wandb-base/templates/rolebinding.yaml

@@ -0,0 +1,16 @@
+{{- if .Values.role.create }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "wandb-base.fullname" . }}
+  labels:
+    {{- include "wandb-base.labels" . | nindent 4 }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "wandb-base.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: Role
+  name: {{ include "wandb-base.fullname" . }}
+  apiGroup: rbac.authorization.k8s.io
+{{- end }}

charts/wandb-base/values.yaml

@@ -27,6 +27,10 @@ serviceAccount:
   annotations: {}
   name: ""
 
+role:
+  create: false
+  rules: []
+
 podAnnotations: {}
 podLabels: {}