diff --git a/library/common-test/tests/rbac/data_test.yaml b/library/common-test/tests/rbac/data_test.yaml index e2114147..289fb4f7 100644 --- a/library/common-test/tests/rbac/data_test.yaml +++ b/library/common-test/tests/rbac/data_test.yaml @@ -35,6 +35,8 @@ tests: - "{{ .Values.some_group }}" resources: - "{{ .Values.some_resource }}" + resourceNames: + - "{{ .Values.some_name }}" verbs: - "{{ .Values.some_verb }}" subjects: @@ -67,6 +69,8 @@ tests: - apps resources: - deployments + resourceNames: + - some-name verbs: - list - documentIndex: &roleBinding 3 diff --git a/library/common-test/tests/rbac/validation_test.yaml b/library/common-test/tests/rbac/validation_test.yaml index b12ff144..f256e2e8 100644 --- a/library/common-test/tests/rbac/validation_test.yaml +++ b/library/common-test/tests/rbac/validation_test.yaml @@ -252,6 +252,25 @@ tests: - failedTemplate: errorMessage: RBAC - Expected non-empty [rbac.subjects.apiGroup] + - it: should fail with empty entry in resourceName in rules in rbac + set: + rbac: + my-rbac: + enabled: true + primary: true + rules: + - apiGroups: + - "" + resources: + - pods + resourceNames: + - "" + verbs: + - get + asserts: + - failedTemplate: + errorMessage: RBAC - Expected non-empty entry in [rbac.rules.resourceNames] + - it: should fail with namespace longer than 63 characters set: serviceAccount: diff --git a/library/common/Chart.yaml b/library/common/Chart.yaml index 1de82eef..b08284bb 100644 --- a/library/common/Chart.yaml +++ b/library/common/Chart.yaml @@ -15,4 +15,4 @@ maintainers: name: common sources: null type: library -version: 17.1.1 +version: 17.1.2 diff --git a/library/common/templates/lib/rbac/_rules.tpl b/library/common/templates/lib/rbac/_rules.tpl index be32dcc3..44fb9ff2 100644 --- a/library/common/templates/lib/rbac/_rules.tpl +++ b/library/common/templates/lib/rbac/_rules.tpl @@ -36,7 +36,17 @@ objectData: The object data to be used to render the RBAC. {{- fail "RBAC - Expected non-empty entry in [rbac.rules.resources]" -}} {{- end }} - {{ tpl . $rootCtx | quote }} - {{- end -}} + {{- end -}} + {{- /* resourceNames */}} + {{- if .resourceNames }} + resourceNames: + {{- range .resourceNames -}} + {{- if not . -}} + {{- fail "RBAC - Expected non-empty entry in [rbac.rules.resourceNames]" -}} + {{- end }} + - {{ tpl . $rootCtx | quote }} + {{- end -}} + {{- end -}} {{- /* verbs */}} verbs: {{- range .verbs -}}