From f45def71362ec04fd059dd988f78f3cbc2afe467 Mon Sep 17 00:00:00 2001
From: drzombey <drzombey@users.noreply.github.com>
Date: Thu, 30 Jul 2026 15:19:50 +0000
Subject: [PATCH] New health check operator image

---
 charts/health-check-operator/Chart.yaml             |  4 ++--
 charts/health-check-operator/templates/_helpers.tpl | 11 +++++++++++
 charts/health-check-operator/templates/rbac.yaml    | 10 ++++++----
 charts/health-check-operator/values.yaml            |  6 ++++--
 4 files changed, 23 insertions(+), 8 deletions(-)

diff --git a/charts/health-check-operator/Chart.yaml b/charts/health-check-operator/Chart.yaml
index d6e9d37..1f9dda7 100644
--- a/charts/health-check-operator/Chart.yaml
+++ b/charts/health-check-operator/Chart.yaml
@@ -2,5 +2,5 @@ apiVersion: v2
 name: health-check-operator
 description: A Helm chart for deploying the Health Check Operator.
 type: application
-version: 0.4.1
-appVersion: "0.4.1"
+version: 0.4.2
+appVersion: "0.4.2"
diff --git a/charts/health-check-operator/templates/_helpers.tpl b/charts/health-check-operator/templates/_helpers.tpl
index cc10665..69b4b9d 100644
--- a/charts/health-check-operator/templates/_helpers.tpl
+++ b/charts/health-check-operator/templates/_helpers.tpl
@@ -64,6 +64,17 @@ Metrics service name. Keep this short enough for Kubernetes' 63-character DNS la
 {{- printf "%s-metrics" (include "health-check-operator.fullname" .) | trunc 63 | trimSuffix "-" -}}
 {{- end -}}
 
+{{/*
+Suffix for cluster-scoped RBAC resources. Namespace-scoped releases share the
+cluster with other releases of this chart, so the release namespace is appended
+to keep the cluster-wide names unique per installation.
+*/}}
+{{- define "health-check-operator.clusterRBACSuffix" -}}
+{{- if not .Values.clusterScoped -}}
+{{- printf "-%s" .Release.Namespace -}}
+{{- end -}}
+{{- end -}}
+
 {{/*
 Container port derived from the health probe bind address, so the two cannot drift apart.
 */}}
diff --git a/charts/health-check-operator/templates/rbac.yaml b/charts/health-check-operator/templates/rbac.yaml
index 1013684..fd71d5c 100644
--- a/charts/health-check-operator/templates/rbac.yaml
+++ b/charts/health-check-operator/templates/rbac.yaml
@@ -136,11 +136,13 @@ subjects:
     name: {{ include "health-check-operator.serviceAccountName" . }}
     namespace: {{ .Release.Namespace }}
 {{- if and .Values.metrics.enabled .Values.metrics.secure .Values.rbac.metricsAuth.enabled }}
+{{- /* TokenReview/SubjectAccessReview and nonResourceURLs only exist cluster-scoped,
+       so these stay ClusterRoles even for namespace-scoped releases. */}}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: {{ include "health-check-operator.fullname" . }}-metrics-auth-role
+  name: {{ include "health-check-operator.fullname" . }}-metrics-auth-role{{ include "health-check-operator.clusterRBACSuffix" . }}
   labels:
     {{- include "health-check-operator.labels" . | nindent 4 }}
 rules:
@@ -160,13 +162,13 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: {{ include "health-check-operator.fullname" . }}-metrics-auth-rolebinding
+  name: {{ include "health-check-operator.fullname" . }}-metrics-auth-rolebinding{{ include "health-check-operator.clusterRBACSuffix" . }}
   labels:
     {{- include "health-check-operator.labels" . | nindent 4 }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: {{ include "health-check-operator.fullname" . }}-metrics-auth-role
+  name: {{ include "health-check-operator.fullname" . }}-metrics-auth-role{{ include "health-check-operator.clusterRBACSuffix" . }}
 subjects:
   - kind: ServiceAccount
     name: {{ include "health-check-operator.serviceAccountName" . }}
@@ -175,7 +177,7 @@ subjects:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: {{ include "health-check-operator.fullname" . }}-metrics-reader
+  name: {{ include "health-check-operator.fullname" . }}-metrics-reader{{ include "health-check-operator.clusterRBACSuffix" . }}
   labels:
     {{- include "health-check-operator.labels" . | nindent 4 }}
 rules:
diff --git a/charts/health-check-operator/values.yaml b/charts/health-check-operator/values.yaml
index ddd060e..f15459e 100644
--- a/charts/health-check-operator/values.yaml
+++ b/charts/health-check-operator/values.yaml
@@ -21,8 +21,10 @@ crds:
 
 # When false (default), the operator only watches its own namespace: the
 # Deployment sets WATCH_NAMESPACE to the release namespace and RBAC is rendered
-# as a namespace-scoped Role/RoleBinding. Set to true to watch all namespaces,
-# which renders a ClusterRole/ClusterRoleBinding instead.
+# as a namespace-scoped Role/RoleBinding. The metrics RBAC objects must stay
+# cluster-scoped, so their names get the release namespace appended to keep
+# multiple installations on one cluster from colliding. Set to true to watch
+# all namespaces, which renders a ClusterRole/ClusterRoleBinding instead.
 clusterScoped: false
 
 serviceAccount: