tower 0.9.0 + tower-ui 0.8.0 — capacity bars on Server Detail

templates/backend-deployment.yaml

@@ -18,6 +18,7 @@ spec:
         {{- include "tower.labels" . | nindent 8 }}
         odoosky.io/role: backend
     spec:
+      serviceAccountName: tower
       containers:
         - name: tower
           image: "{{ .Values.backend.image.repository }}:{{ .Values.backend.image.tag }}"

templates/serviceaccount.yaml

@@ -0,0 +1,47 @@
+{{- if .Values.backend.enabled -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: tower
+  labels:
+    {{- include "tower.labels" . | nindent 4 }}
+---
+# Tower needs cluster-wide read on Nodes + node metrics for the
+# capacity-bar feature; namespace get/list/create so it can ensure
+# the tenants ns exists before ArgoCD creates instance resources;
+# argoproj.io CRD CRUD so it can create + delete Applications.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Release.Name }}-tower
+  labels:
+    {{- include "tower.labels" . | nindent 4 }}
+rules:
+  - apiGroups: ['argoproj.io']
+    resources: ['applications', 'appprojects']
+    verbs: ['get', 'list', 'create', 'update', 'patch', 'delete']
+  - apiGroups: ['']
+    resources: ['namespaces']
+    verbs: ['get', 'list', 'create']
+  - apiGroups: ['']
+    resources: ['nodes']
+    verbs: ['get', 'list']
+  - apiGroups: ['metrics.k8s.io']
+    resources: ['nodes']
+    verbs: ['get', 'list']
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ .Release.Name }}-tower
+  labels:
+    {{- include "tower.labels" . | nindent 4 }}
+subjects:
+  - kind: ServiceAccount
+    name: tower
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: {{ .Release.Name }}-tower
+  apiGroup: rbac.authorization.k8s.io
+{{- end }}