63 lines
2.1 KiB
YAML
63 lines
2.1 KiB
YAML
{{- $cluster := .Values.clusterName -}}
|
|
{{- $namespace := .Values.piNamespace -}}
|
|
{{- $name := .Values.name -}}
|
|
{{- $root := . -}}
|
|
{{- $serviceAccounts := .Values.serviceAccounts -}}
|
|
{{- $policyDocument := .Values.policyDocument -}}
|
|
{{- range $serviceAccounts }}
|
|
apiVersion: kro.run/v1alpha1
|
|
kind: PodIdentity
|
|
metadata:
|
|
name: "{{ include "kro-pi-instance.name" $root }}-{{ . }}"
|
|
annotations:
|
|
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
|
|
argocd.argoproj.io/sync-wave: "-5"
|
|
spec:
|
|
name: {{$name}}
|
|
values:
|
|
aws:
|
|
clusterName: {{ $cluster }}
|
|
policy:
|
|
policyDocument: |
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{{- range $index, $policy := $policyDocument }}
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
{{- range $i, $action := $policy.actions }}
|
|
"{{ $action }}"{{ if not (eq (add $i 1) (len $policy.actions)) }},{{ end }}
|
|
{{- end }}
|
|
],
|
|
"Resource": [
|
|
{{- if $policy.customArn }}
|
|
"{{ $policy.customArn }}"
|
|
{{- else if eq $policy.resourceName "*" }}
|
|
"*"
|
|
{{- else }}
|
|
"arn:aws:{{ $policy.resourceType }}:{{ $.Values.region }}:{{ $.Values.accountId }}:{{ $policy.resourceName }}"
|
|
{{- end }}
|
|
]
|
|
{{- if $policy.conditions }}
|
|
,"Condition": {
|
|
{{- range $j, $condition := $policy.conditions }}
|
|
"{{ $condition.test }}": {
|
|
"{{ $condition.variable }}": [
|
|
{{- range $k, $value := $condition.values }}
|
|
"{{ $value }}"{{ if not (eq (add $k 1) (len $condition.values)) }},{{ end }}
|
|
{{- end }}
|
|
]
|
|
}
|
|
{{- end }}
|
|
}
|
|
{{- end }}
|
|
}{{ if not (eq (add $index 1) (len $.Values.policyDocument)) }},{{ end }}
|
|
{{- end }}
|
|
]
|
|
}
|
|
piAssociation:
|
|
serviceAccount: {{ . }}
|
|
piNamespace: {{ $namespace }}
|
|
---
|
|
{{- end}} |