Security
- Fix
namespacelabeler controller label selector. - Fix
role name reference in OIDC group and service accounts rolebinding.
Changed
- Push tags to aliyun repository.
- Move
rbac controller code into rbac package. - Add
namespacelabeler controller, which labels legacy namespaces. - Add
automation service account in global namespace, which has admin access to all the tenant namespaces.
Changed
- Reconcile
rolebinding subject group changes properly. - Fix bug with binding role to the
view-all read role instead of tenant-admin write role.
Added
- Add condition for ingress resource installation.
- Add support for internal Control Plane API access.
Changed
- Allowed resource requests and limits to be configured with
values.yaml. (#24)
Changed
- Use Release.Revision in annotation for Helm 3 compatibility.
Added
- Tenant admin role tenant-admin-manage-rbac to manage
serviceaccounts, roles, clusterroles, rolebindings and clusterrolebindings. - Add tenant admin full access to
global and default namespaces.
Changed
- Fixed sub-chart resources namespace. (#19, #21)
Changed
- Make rbac-operator optional for installation without OIDC.
Added
- Read-only role for customer access into Control Plane.