[stable/kube2iam]: add rbac support

[SamClinckspoor]

Adds support in kube2iam for RBAC.

setting rbac.enabled to true will create a role, rolebinding and service account.

[k8s-ci-robot]

Hi @SamClinckspoor. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with @k8s-bot ok to test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[SamClinckspoor]

Can I get a review on this?

[icereval]

Reviewed discussion from @c-knowles' merged traefik PR and this looks good, thanks!

LGTM

[cknowles]

If you'd like to account for users switching RBAC enabled from true to false then currently you'll need to explicitly set serviceAccountName to default. The reason is that there's a deprecated serviceAccount attribute in k8s 1.6 so if you only unset serviceAccountName it will be restored from the deprecated attribute.

You can see the fault by installing a chart that does not do this and then trying to turn RBAC off, you will notice the deployment still has the RBAC service account and not the default service account:

helm install stable/etcd-operator --name tester --wait --set rbac.install=true
helm upgrade tester stable/etcd-operator --install --wait --set rbac.install=false

[cknowles]

I think it's definitely an edge case though so the rest of this PR looks great.

[SamClinckspoor]

@c-knowles you mean I should set the following?

{{- if .Values.rbac.enabled }}
      serviceAccountName: {{ template "fullname" . }}
{{- else }}
      serviceAccountName: default
{{- end }}

[cknowles]

@SamClinckspoor yes exactly that. As above it's an edge case but may be worth including. It will go away whenever k8s gets rid of the deprecated attribute.

[icereval]

@c-knowles, thanks for pointing out the SA default.

[icereval]

LGTM, cc @lachie83 @viglesiasce @prydonius

[viglesiasce]

/ok-to-test