allow to disable cluster roles

Author: RoiGlinik

helm/robusta/templates/runner-service-account.yaml

@@ -1,3 +1,20 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "robusta.fullname" . }}-runner-service-account
+  namespace: {{ .Release.Namespace }}
+  {{- if .Values.runnerServiceAccount.annotations }}
+  annotations:
+  {{- with .Values.runnerServiceAccount.annotations }}
+    {{- toYaml . | nindent 4}}
+  {{- end }}
+  {{- end }}
+{{- if .Values.runnerServiceAccount.imagePullSecrets }}
+imagePullSecrets:
+{{- toYaml .Values.runnerServiceAccount.imagePullSecrets | nindent 2}}
+{{- end }}
+{{- if .Values.runner.createClusterRole }}
+---
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
@@ -327,23 +344,6 @@ rules:
     - patch
     - update
 {{- end }}
-
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ include "robusta.fullname" . }}-runner-service-account
-  namespace: {{ .Release.Namespace }}
-  {{- if .Values.runnerServiceAccount.annotations }}
-  annotations:
-  {{- with .Values.runnerServiceAccount.annotations }}
-    {{- toYaml . | nindent 4}}
-  {{- end }}
-  {{- end }}
-{{- if .Values.runnerServiceAccount.imagePullSecrets }}
-imagePullSecrets:
-{{- toYaml .Values.runnerServiceAccount.imagePullSecrets | nindent 2}}
-{{- end }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -357,6 +357,7 @@ subjects:
   - kind: ServiceAccount
     name: {{ include "robusta.fullname" . }}-runner-service-account
     namespace: {{ .Release.Namespace }}
+{{- end -}} # createClusterRole 
 {{- if .Values.openshift.enabled }}
 ---
 kind: ClusterRoleBinding

helm/robusta/values.yaml

@@ -697,6 +697,7 @@ runner:
   sentry_dsn: https://4f1a66f025c60830fec303a094dcdf94@o1120648.ingest.sentry.io/6156573
   sendAdditionalTelemetry: false
   certificate: "" # base64 encoded
+  createClusterRole: true
   customServiceAccount: "" # to override the runner service account
   resources:
     requests: