[cwrau]

Overview

Add ClusterRoles aggregated into the builtin edit and admin roles for the dex.coreos.com storage resources.

What this PR does / why we need it

Users bound to the builtin edit/admin ClusterRoles currently cannot see or manage Dex's Kubernetes-storage resources (dex.coreos.com) without hand-written RBAC. Kubernetes lets operators extend those roles through aggregated ClusterRoles (rbac.authorization.k8s.io/aggregate-to-{edit,admin}: "true").

This adds two ClusterRoles, both labelled aggregate-to-edit and aggregate-to-admin:

• <fullname>-aggregate-view-sensitive: get, list, watch
• <fullname>-aggregate-edit: create, delete, deletecollection, patch, update

covering all 12 kinds Dex stores as CRDs: authcodes, authrequests, authsessions, connectors, devicerequests, devicetokens, oauth2clients, offlinesessionses, passwords, refreshtokens, signingkeies, useridentities.

None of these is aggregated into view. Every kind holds credentials, tokens, keys or session state (password hashes, refresh tokens, signing keys, client secrets), and the builtin view role is meant to be safe to hand out widely. Read access is therefore only granted to edit and admin, the same as write access.

The roles are controlled by a new value rbac.createAggregation (default true, nested under rbac.create). They are only rendered if config.storage.type is kubernetes or not set. Dex only uses these CRDs with the Kubernetes storage backend; when the config comes from an external secret the chart cannot see the storage type, so the roles are rendered in that case as well. The gating handles a null config or config.storage.

Special notes for your reviewer

• Behaviour change for existing installs: with the default values, anyone bound to edit/admin gains read and write access to these resources (including OAuth2 clients, passwords, connectors and signing keys) in namespaces where Dex stores data. Setting rbac.createAggregation: false restores the previous behaviour.
• The chart has no unit tests; I checked rendering with helm template for config.storage.type set to memory, sqlite3 and kubernetes, for config=null and config.storage=null, and with rbac.createAggregation=false and rbac.create=false. helm lint and ct lint --config ct.yaml --charts charts/dex pass. I did not install the chart into a cluster.
• Version bumped 0.25.2 to 0.26.0 (new feature, minor). The artifacthub.io/changes annotation was cleared before adding the new entry, as the contributing guide asks, which is why the previous favicon entry is gone.
• make docs was not run, since it needs a pinned helm-docs; I edited only the version badge and the new rbac.createAggregation row of the README by hand to match the generator output.

Checklist

• Change log updated in Chart.yaml (see the contributing guide for details)
• Chart version bumped in Chart.yaml (see the contributing guide for details)
• Documentation regenerated by running make docs (the README rows for the version badge and rbac.createAggregation were updated by hand to match generator output)