fixing rolebinding-least.yaml

Author: venkateshjayagopal

charts/core/templates/rolebinding-least.yaml

@@ -67,7 +67,6 @@ userNames:
 
 ---
 
-{{- if .Values.internal.autoGenerateCert }}
 {{- if $oc3 }}
 apiVersion: authorization.openshift.io/v1
 {{- else if (semverCompare ">=1.8-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }}
@@ -77,7 +76,7 @@ apiVersion: v1
 {{- end }}
 kind: RoleBinding
 metadata:
-  name: neuvector-binding-lease
+  name: neuvector-binding-secret
   namespace: {{ .Release.Namespace }}
   labels:
     chart: {{ template "neuvector.chart" . }}
@@ -87,21 +86,31 @@ roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
 {{- end }}
-  name: neuvector-binding-lease
+  name: neuvector-binding-secret
 subjects:
 - kind: ServiceAccount
   name: controller
   namespace: {{ .Release.Namespace }}
 - kind: ServiceAccount
-  name: cert-upgrader
+  name: enforcer
+  namespace: {{ .Release.Namespace }}
+- kind: ServiceAccount
+  name: scanner
+  namespace: {{ .Release.Namespace }}
+- kind: ServiceAccount
+  name: registry-adapter
   namespace: {{ .Release.Namespace }}
 {{- if $oc3 }}
 userNames:
-- system:serviceaccount:{{ .Release.Namespace }}:{{ .Values.serviceAccount }}
 - system:serviceaccount:{{ .Release.Namespace }}:controller
-- system:serviceaccount:{{ .Release.Namespace }}:cert-upgrader
+- system:serviceaccount:{{ .Release.Namespace }}:enforcer
+- system:serviceaccount:{{ .Release.Namespace }}:scanner
+- system:serviceaccount:{{ .Release.Namespace }}:registry-adapter
 {{- end }}
+
 ---
+
+{{- if .Values.internal.autoGenerateCert }}
 {{- if $oc3 }}
 apiVersion: authorization.openshift.io/v1
 {{- else if (semverCompare ">=1.8-0" (substr 1 -1 .Capabilities.KubeVersion.GitVersion)) }}
@@ -111,7 +120,7 @@ apiVersion: v1
 {{- end }}
 kind: RoleBinding
 metadata:
-  name: neuvector-binding-job-creation
+  name: neuvector-binding-lease
   namespace: {{ .Release.Namespace }}
   labels:
     chart: {{ template "neuvector.chart" . }}
@@ -121,14 +130,19 @@ roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
 {{- end }}
-  name: neuvector-binding-job-creation
+  name: neuvector-binding-lease
 subjects:
 - kind: ServiceAccount
   name: controller
   namespace: {{ .Release.Namespace }}
+- kind: ServiceAccount
+  name: cert-upgrader
+  namespace: {{ .Release.Namespace }}
 {{- if $oc3 }}
 userNames:
+- system:serviceaccount:{{ .Release.Namespace }}:{{ .Values.serviceAccount }}
 - system:serviceaccount:{{ .Release.Namespace }}:controller
+- system:serviceaccount:{{ .Release.Namespace }}:cert-upgrader
 {{- end }}
 ---
 {{- if $oc3 }}
@@ -140,7 +154,7 @@ apiVersion: v1
 {{- end }}
 kind: RoleBinding
 metadata:
-  name: neuvector-binding-cert-upgrader
+  name: neuvector-binding-job-creation
   namespace: {{ .Release.Namespace }}
   labels:
     chart: {{ template "neuvector.chart" . }}
@@ -150,15 +164,14 @@ roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
 {{- end }}
-  name: neuvector-binding-cert-upgrader
+  name: neuvector-binding-job-creation
 subjects:
 - kind: ServiceAccount
-  name: cert-upgrader
+  name: controller
   namespace: {{ .Release.Namespace }}
 {{- if $oc3 }}
 userNames:
-- system:serviceaccount:{{ .Release.Namespace }}:cert-upgrader
-{{- end }}
+- system:serviceaccount:{{ .Release.Namespace }}:controller
 {{- end }}
 ---
 {{- if $oc3 }}
@@ -170,7 +183,7 @@ apiVersion: v1
 {{- end }}
 kind: RoleBinding
 metadata:
-  name: neuvector-binding-secret
+  name: neuvector-binding-cert-upgrader
   namespace: {{ .Release.Namespace }}
   labels:
     chart: {{ template "neuvector.chart" . }}
@@ -180,26 +193,15 @@ roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
 {{- end }}
-  name: neuvector-binding-secret
+  name: neuvector-binding-cert-upgrader
 subjects:
 - kind: ServiceAccount
-  name: controller
-  namespace: {{ .Release.Namespace }}
-- kind: ServiceAccount
-  name: enforcer
-  namespace: {{ .Release.Namespace }}
-- kind: ServiceAccount
-  name: scanner
-  namespace: {{ .Release.Namespace }}
-- kind: ServiceAccount
-  name: registry-adapter
+  name: cert-upgrader
   namespace: {{ .Release.Namespace }}
 {{- if $oc3 }}
 userNames:
-- system:serviceaccount:{{ .Release.Namespace }}:controller
-- system:serviceaccount:{{ .Release.Namespace }}:enforcer
-- system:serviceaccount:{{ .Release.Namespace }}:scanner
-- system:serviceaccount:{{ .Release.Namespace }}:registry-adapter
+- system:serviceaccount:{{ .Release.Namespace }}:cert-upgrader
+{{- end }}
 {{- end }}
 ---
 {{- if $oc4 }}