Update Chart CRD (#72)

Signed-off-by: fxiang1 <fxiang@redhat.com>

Author: fxiang1

chart/crds/rbac.open-cluster-management.io_clusterpermissions.yaml

@@ -194,6 +194,107 @@ spec:
                 x-kubernetes-validations:
                 - message: Either subject or subjects has to exist in clusterRoleBinding
                   rule: has(self.subject) || has(self.subjects)
+              clusterRoleBindings:
+                description: ClusterRoleBindings represents multiple ClusterRoleBindings
+                  that are being created on the managed cluster
+                items:
+                  description: ClusterRoleBinding represents the ClusterRoleBinding
+                    that is being created on the managed cluster
+                  properties:
+                    name:
+                      description: Name of the ClusterRoleBinding if a name different
+                        than the ClusterPermission name is used
+                      type: string
+                    roleRef:
+                      description: RoleRef contains information that points to the
+                        ClusterRole being used
+                      properties:
+                        apiGroup:
+                          description: APIGroup is the group for the resource being
+                            referenced
+                          type: string
+                        kind:
+                          description: Kind is the type of resource being referenced
+                          type: string
+                        name:
+                          description: Name is the name of resource being referenced
+                          type: string
+                      required:
+                      - apiGroup
+                      - kind
+                      - name
+                      type: object
+                      x-kubernetes-map-type: atomic
+                    subject:
+                      description: |-
+                        Subject contains a reference to the object or user identities a ClusterPermission binding applies to.
+                        Besides the typical subject for a binding, a ManagedServiceAccount can be used as a subject as well.
+                        If both subject and subjects exist then only subjects will be used.
+                      properties:
+                        apiGroup:
+                          description: |-
+                            APIGroup holds the API group of the referenced subject.
+                            Defaults to "" for ServiceAccount subjects.
+                            Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
+                          type: string
+                        kind:
+                          description: |-
+                            Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
+                            If the Authorizer does not recognized the kind value, the Authorizer should report an error.
+                          type: string
+                        name:
+                          description: Name of the object being referenced.
+                          type: string
+                        namespace:
+                          description: |-
+                            Namespace of the referenced object.  If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
+                            the Authorizer should report an error.
+                          type: string
+                      required:
+                      - kind
+                      - name
+                      type: object
+                      x-kubernetes-map-type: atomic
+                    subjects:
+                      description: |-
+                        Subjects contains an array of references to objects or user identities a ClusterPermission binding applies to.
+                        Besides the typical subject for a binding, a ManagedServiceAccount can be used as a subject as well.
+                        If both subject and subjects exist then only subjects will be used.
+                      items:
+                        description: |-
+                          Subject contains a reference to the object or user identities a role binding applies to.  This can either hold a direct API object reference,
+                          or a value for non-objects such as user and group names.
+                        properties:
+                          apiGroup:
+                            description: |-
+                              APIGroup holds the API group of the referenced subject.
+                              Defaults to "" for ServiceAccount subjects.
+                              Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
+                            type: string
+                          kind:
+                            description: |-
+                              Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
+                              If the Authorizer does not recognized the kind value, the Authorizer should report an error.
+                            type: string
+                          name:
+                            description: Name of the object being referenced.
+                            type: string
+                          namespace:
+                            description: |-
+                              Namespace of the referenced object.  If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
+                              the Authorizer should report an error.
+                            type: string
+                        required:
+                        - kind
+                        - name
+                        type: object
+                        x-kubernetes-map-type: atomic
+                      type: array
+                  type: object
+                type: array
+                x-kubernetes-validations:
+                - message: Either subject or subjects has to exist in every clusterRoleBinding
+                  rule: self.all(i, has(i.subject) || has(i.subjects))
               roleBindings:
                 description: RoleBindings represents RoleBindings that are being created
                   on the managed cluster
@@ -460,6 +561,12 @@ spec:
                   - rules
                   type: object
                 type: array
+              validate:
+                description: |-
+                  Validate enables validation of roles and clusterroles on the managed cluster using ManifestWork
+                  When enabled, the controller will create a validation ManifestWork to check if the referenced
+                  roles and clusterroles exist on the managed cluster
+                type: boolean
             type: object
           status:
             description: ClusterPermissionStatus defines the observed state of ClusterPermission