From 7796295a91d655a16543bcf7ef957dd92db030d0 Mon Sep 17 00:00:00 2001
From: Cyril Jouve <jv.cyril@gmail.com>
Date: Mon, 5 Jun 2023 19:42:51 +0200
Subject: [PATCH] helm: obc rbac aggregation to user facing roles

add view & edit ClusterRole for obc.

the roles are added to the default user facing roles
view / edit / admin respectively using k8s ClusterRole aggregation.

feature disabled for backward compatibility
and controlled with rbacAggregate.enableOBCs.

Signed-off-by: Cyril Jouve <jv.cyril@gmail.com>
(cherry picked from commit 45d897b8b32eb1247450699073315c984da9856e)
---
 Documentation/Helm-Charts/operator-chart.md   |  1 +
 .../rook-ceph/templates/aggregate-roles.yaml  | 35 +++++++++++++++++++
 deploy/charts/rook-ceph/values.yaml           |  4 +++
 3 files changed, 40 insertions(+)
 create mode 100644 deploy/charts/rook-ceph/templates/aggregate-roles.yaml

diff --git a/Documentation/Helm-Charts/operator-chart.md b/Documentation/Helm-Charts/operator-chart.md
index 815872871..eb870baf0 100644
--- a/Documentation/Helm-Charts/operator-chart.md
+++ b/Documentation/Helm-Charts/operator-chart.md
@@ -148,6 +148,7 @@ The following table lists the configurable parameters of the rook-operator chart
 | `nodeSelector` | Kubernetes [`nodeSelector`](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector) to add to the Deployment. | `{}` |
 | `priorityClassName` | Set the priority class for the rook operator deployment if desired | `nil` |
 | `pspEnable` | If true, create & use PSP resources | `false` |
+| `rbacAggregate.enableOBCs` | If true, create a ClusterRole aggregated to [user facing roles](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles) for objectbucketclaims | `false` |
 | `rbacEnable` | If true, create & use RBAC resources | `true` |
 | `resources` | Pod resource requests & limits | `{"limits":{"cpu":"500m","memory":"512Mi"},"requests":{"cpu":"100m","memory":"128Mi"}}` |
 | `scaleDownOperator` | If true, scale down the rook operator. This is useful for administrative actions where the rook operator must be scaled down, while using gitops style tooling to deploy your helm charts. | `false` |
diff --git a/deploy/charts/rook-ceph/templates/aggregate-roles.yaml b/deploy/charts/rook-ceph/templates/aggregate-roles.yaml
new file mode 100644
index 000000000..a9da8422d
--- /dev/null
+++ b/deploy/charts/rook-ceph/templates/aggregate-roles.yaml
@@ -0,0 +1,35 @@
+{{- if .Values.rbacAggregate.enableOBCs }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: rook-ceph-obc-view
+  labels:
+    rbac.authorization.k8s.io/aggregate-to-view: "true"
+rules:
+- apiGroups:
+  - objectbucket.io
+  resources:
+  - objectbucketclaims
+  verbs:
+  - get
+  - list
+  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: rook-ceph-obc-edit
+  labels:
+    rbac.authorization.k8s.io/aggregate-to-edit: "true"
+rules:
+- apiGroups:
+  - objectbucket.io
+  resources:
+  - objectbucketclaims
+  verbs:
+  - create
+  - delete
+  - deletecollection
+  - patch
+  - update
+{{- end }}
diff --git a/deploy/charts/rook-ceph/values.yaml b/deploy/charts/rook-ceph/values.yaml
index 3617ce901..b07ee668d 100644
--- a/deploy/charts/rook-ceph/values.yaml
+++ b/deploy/charts/rook-ceph/values.yaml
@@ -55,6 +55,10 @@ logLevel: INFO
 # -- If true, create & use RBAC resources
 rbacEnable: true
 
+rbacAggregate:
+  # -- If true, create a ClusterRole aggregated to [user facing roles](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles) for objectbucketclaims
+  enableOBCs: false
+
 # -- If true, create & use PSP resources
 pspEnable: false