Autorelease from health check operator - 0.4.2

charts/health-check-operator/Chart.yaml

@@ -2,5 +2,5 @@ apiVersion: v2
 name: health-check-operator
 description: A Helm chart for deploying the Health Check Operator.
 type: application
-version: 0.4.1
-appVersion: "0.4.1"
+version: 0.4.2
+appVersion: "0.4.2"

charts/health-check-operator/templates/_helpers.tpl

@@ -64,6 +64,17 @@ Metrics service name. Keep this short enough for Kubernetes' 63-character DNS la
 {{- printf "%s-metrics" (include "health-check-operator.fullname" .) | trunc 63 | trimSuffix "-" -}}
 {{- end -}}
 
+{{/*
+Suffix for cluster-scoped RBAC resources. Namespace-scoped releases share the
+cluster with other releases of this chart, so the release namespace is appended
+to keep the cluster-wide names unique per installation.
+*/}}
+{{- define "health-check-operator.clusterRBACSuffix" -}}
+{{- if not .Values.clusterScoped -}}
+{{- printf "-%s" .Release.Namespace -}}
+{{- end -}}
+{{- end -}}
+
 {{/*
 Container port derived from the health probe bind address, so the two cannot drift apart.
 */}}

charts/health-check-operator/templates/rbac.yaml

@@ -136,11 +136,13 @@ subjects:
     name: {{ include "health-check-operator.serviceAccountName" . }}
     namespace: {{ .Release.Namespace }}
 {{- if and .Values.metrics.enabled .Values.metrics.secure .Values.rbac.metricsAuth.enabled }}
+{{- /* TokenReview/SubjectAccessReview and nonResourceURLs only exist cluster-scoped,
+       so these stay ClusterRoles even for namespace-scoped releases. */}}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: {{ include "health-check-operator.fullname" . }}-metrics-auth-role
+  name: {{ include "health-check-operator.fullname" . }}-metrics-auth-role{{ include "health-check-operator.clusterRBACSuffix" . }}
   labels:
     {{- include "health-check-operator.labels" . | nindent 4 }}
 rules:
@@ -160,13 +162,13 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: {{ include "health-check-operator.fullname" . }}-metrics-auth-rolebinding
+  name: {{ include "health-check-operator.fullname" . }}-metrics-auth-rolebinding{{ include "health-check-operator.clusterRBACSuffix" . }}
   labels:
     {{- include "health-check-operator.labels" . | nindent 4 }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: {{ include "health-check-operator.fullname" . }}-metrics-auth-role
+  name: {{ include "health-check-operator.fullname" . }}-metrics-auth-role{{ include "health-check-operator.clusterRBACSuffix" . }}
 subjects:
   - kind: ServiceAccount
     name: {{ include "health-check-operator.serviceAccountName" . }}
@@ -175,7 +177,7 @@ subjects:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: {{ include "health-check-operator.fullname" . }}-metrics-reader
+  name: {{ include "health-check-operator.fullname" . }}-metrics-reader{{ include "health-check-operator.clusterRBACSuffix" . }}
   labels:
     {{- include "health-check-operator.labels" . | nindent 4 }}
 rules:

charts/health-check-operator/values.yaml

@@ -21,8 +21,10 @@ crds:
 
 # When false (default), the operator only watches its own namespace: the
 # Deployment sets WATCH_NAMESPACE to the release namespace and RBAC is rendered
-# as a namespace-scoped Role/RoleBinding. Set to true to watch all namespaces,
-# which renders a ClusterRole/ClusterRoleBinding instead.
+# as a namespace-scoped Role/RoleBinding. The metrics RBAC objects must stay
+# cluster-scoped, so their names get the release namespace appended to keep
+# multiple installations on one cluster from colliding. Set to true to watch
+# all namespaces, which renders a ClusterRole/ClusterRoleBinding instead.
 clusterScoped: false
 
 serviceAccount: