From e44817aaeb18979b527f9a9d7e649c4cf6732543 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Grzegorz=20Burzy=C5=84ski?= <czeslavo@gmail.com>
Date: Wed, 6 Dec 2023 14:28:12 +0100
Subject: [PATCH] feat: add KongServiceFacade RBACs, release kong/kong 2.33.0
 (#963)

---
 charts/kong/CHANGELOG.md           |  5 ++++-
 charts/kong/Chart.yaml             |  2 +-
 charts/kong/templates/_helpers.tpl | 19 +++++++++++++++++++
 3 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/charts/kong/CHANGELOG.md b/charts/kong/CHANGELOG.md
index 2900754f2..a47ce6464 100644
--- a/charts/kong/CHANGELOG.md
+++ b/charts/kong/CHANGELOG.md
@@ -1,6 +1,6 @@
 # Changelog
 
-## Unreleased
+## 2.33.0
 
 ### Improvements
 
@@ -14,6 +14,9 @@
 * Validate Gateway API's `Gateway` and `HTTPRoute` resources in the controller's
   admission webhook only when KIC version is 3.0 or higher.
   [#954](https://github.com/Kong/charts/pull/954)
+* Added controller's RBAC rules for `KongServiceFacade` CRD (installed only when
+  KongServiceFacade feature gate turned on and KIC version >= 3.1.0).
+  [#963](https://github.com/Kong/charts/pull/963)
 
 ## 2.32.0
 
diff --git a/charts/kong/Chart.yaml b/charts/kong/Chart.yaml
index 2839fbd47..db7c31596 100644
--- a/charts/kong/Chart.yaml
+++ b/charts/kong/Chart.yaml
@@ -8,7 +8,7 @@ maintainers:
 name: kong
 sources:
   - https://github.com/Kong/charts/tree/main/charts/kong
-version: 2.32.0
+version: 2.33.0
 appVersion: "3.5"
 dependencies:
   - name: postgresql
diff --git a/charts/kong/templates/_helpers.tpl b/charts/kong/templates/_helpers.tpl
index eaf0299ba..5ff57d67d 100644
--- a/charts/kong/templates/_helpers.tpl
+++ b/charts/kong/templates/_helpers.tpl
@@ -1263,6 +1263,25 @@ role sets used in the charts. Updating these requires separating out cluster
 resource roles into their separate templates.
 */}}
 {{- define "kong.kubernetesRBACRules" -}}
+{{- if and (semverCompare ">= 3.1.0" (include "kong.effectiveVersion" .Values.ingressController.image))
+           (contains (print .Values.ingressController.env.feature_gates) "KongServiceFacade=true") }}
+- apiGroups:
+  - incubator.konghq.com
+  resources:
+  - kongservicefacades
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - incubator.konghq.com
+  resources:
+  - kongservicefacades/status
+  verbs:
+  - get
+  - patch
+  - update
+{{- end }}
 {{- if (semverCompare ">= 3.0.0" (include "kong.effectiveVersion" .Values.ingressController.image)) }}
 - apiGroups:
   - configuration.konghq.com