deploy/jenkins/templates/jenkins-backup-rbac.yaml

{{- if .Values.backup.enabled }}
{{- if .Values.backup.serviceAccount.create }}
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ include "backup.serviceAccountBackupName" . }}
  namespace: {{ template "jenkins.namespace" . }}
  labels:
    "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
    {{- if .Values.renderHelmLabels }}
    "helm.sh/chart": "{{ template "jenkins.label" .}}"
    {{- end }}
    "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
    "app.kubernetes.io/instance": "{{ .Release.Name }}"
    "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
  {{- if .Values.backup.serviceAccount.annotations }}
  annotations:
    {{- toYaml .Values.backup.serviceAccount.annotations | nindent 4 }}
  {{- end }}
{{- end }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: {{ template "jenkins.fullname" . }}-backup
  namespace: {{ template "jenkins.namespace" . }}
  labels:
    "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
    {{- if .Values.renderHelmLabels }}
    "helm.sh/chart": "{{ template "jenkins.label" .}}"
    {{- end }}
    "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
    "app.kubernetes.io/instance": "{{ .Release.Name }}"
    "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
rules:
- apiGroups: [""]
  resources: ["pods", "pods/log"]
  verbs: ["get", "list"]
- apiGroups: [""]
  resources: ["pods/exec"]
  verbs: ["create"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: {{ template "jenkins.fullname" . }}-backup
  namespace: {{ template "jenkins.namespace" . }}
  labels:
    "app.kubernetes.io/name": '{{ template "jenkins.name" .}}'
    {{- if .Values.renderHelmLabels }}
    "helm.sh/chart": "{{ template "jenkins.label" .}}"
    {{- end }}
    "app.kubernetes.io/managed-by": "{{ .Release.Service }}"
    "app.kubernetes.io/instance": "{{ .Release.Name }}"
    "app.kubernetes.io/component": "{{ .Values.controller.componentName }}"
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: {{ template "jenkins.fullname" . }}-backup
subjects:
- kind: ServiceAccount
  name: {{ include "backup.serviceAccountBackupName" . }}
  namespace: {{ template "jenkins.namespace" . }}
{{- end }}