RBAC should be more configurable

[jmymy]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Pulling an issue from here -> : hashicorp/terraform-k8s#99

RBAC is too permissive and should be configurable to the use case. I understand the need for some of these permissions if I were controlling k8s applications inside this k8s cluster, however I have another use case where its not managing k8s apps, and thus I'd like to remove those permissions.

- apiGroups:
  - apps
  resources:
  - deployments
  - daemonsets
  - replicasets
  - statefulsets
  verbs:
  - '*'

Also, there is no documentation on why it needs certain roles. Maybe thats another ticket?

Potential Helm Configuration

{{- if $managingKubernetesApps }}
- apiGroups:
  - apps
  resources:
  - deployments
  - daemonsets
  - replicasets
  - statefulsets
  verbs:
  - '*'
 {{- end }}

References

https://github.com/hashicorp/terraform-helm/blob/master/templates/sync-workspace-role.yaml