feat: add option to disable ClusterRoles

helm-chart/renku/templates/data-service/rbac.yaml

@@ -9,16 +9,6 @@ metadata:
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
 rules:
-  - apiGroups:
-      - ""
-    resources:
-      - resourcequotas
-    verbs:
-      - get
-      - list
-      - patch
-      - delete
-      - create
   - apiGroups:
       - ""
     resources:
@@ -98,27 +88,6 @@ rules:
   {{- end }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ template "renku.fullname" . }}-data-service
-  labels:
-    app: {{ template "renku.name" . }}
-    chart: {{ template "renku.chart" . }}
-    release: {{ .Release.Name }}
-    heritage: {{ .Release.Service }}
-rules:
-  - apiGroups:
-      - "scheduling.k8s.io"
-    resources:
-      - priorityclasses
-    verbs:
-      - get
-      - list
-      - patch
-      - delete
-      - create
----
-apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   name: {{ template "renku.fullname" . }}-data-service
@@ -135,22 +104,4 @@ subjects:
   - kind: ServiceAccount
     name: {{ template "renku.fullname" . }}-data-service
     namespace: {{ .Release.Namespace }}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ template "renku.fullname" . }}-data-service
-  labels:
-    app: {{ template "renku.name" . }}
-    chart: {{ template "renku.chart" . }}
-    release: {{ .Release.Name }}
-    heritage: {{ .Release.Service }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ template "renku.fullname" . }}-data-service
-subjects:
-  - kind: ServiceAccount
-    name: {{ template "renku.fullname" . }}-data-service
-    namespace: {{ .Release.Namespace }}
 {{- end -}}

helm-chart/renku/templates/data-service/rbac_resource_pool.yaml

@@ -0,0 +1,80 @@
+{{ if and .Values.dataService.rbac.enableResourcePool .Values.dataService.rbac.create}}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ template "renku.fullname" . }}-data-service-resource-pool
+  labels:
+    app: {{ template "renku.name" . }}
+    chart: {{ template "renku.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - resourcequotas
+    verbs:
+      - get
+      - list
+      - patch
+      - delete
+      - create
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "renku.fullname" . }}-data-service-resource-pool
+  labels:
+    app: {{ template "renku.name" . }}
+    chart: {{ template "renku.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "renku.fullname" . }}-data-service-resource-pool
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "renku.fullname" . }}-data-service-resource-pool
+    namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "renku.fullname" . }}-data-service-resource-pool
+  labels:
+    app: {{ template "renku.name" . }}
+    chart: {{ template "renku.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+rules:
+  - apiGroups:
+      - "scheduling.k8s.io"
+    resources:
+      - priorityclasses
+    verbs:
+      - get
+      - list
+      - patch
+      - delete
+      - create
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "renku.fullname" . }}-data-service-resource-pool
+  labels:
+    app: {{ template "renku.name" . }}
+    chart: {{ template "renku.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "renku.fullname" . }}-data-service-resource-pool
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "renku.fullname" . }}-data-service-resource-pool
+    namespace: {{ .Release.Namespace }}
+{{- end -}}

helm-chart/renku/values.yaml

@@ -1477,6 +1477,14 @@ platformInit:
 dataService:
   rbac:
     create: true
+    # Resource pools allow Renkulab administrators to define pools of compute resources
+    # that can be used for user sessions. This allows to separate resources for different
+    # user groups, e.g. students vs researchers.
+    # The feature is based on Kubernetes PriorityClasses, which are non-namespaced, therefore to access that resource
+    # the data-service service account needs a ClusterRole and the corresponding ClusterRoleBinding.
+    # If you are not allowed to create ClusterRoles in your cluster, you can disable the feature by setting
+    # `enableResourcePool` to false.
+    enableResourcePool: true
   image:
     repository: renku/renku-data-service
     tag: "0.65.0"