1 files changed, 40 insertions, 12 deletions
diff --git a/lib/gitlab/kubernetes/helm/install_command.rb b/lib/gitlab/kubernetes/helm/install_command.rb
index 9672f80687e..1be7924d6ac 100644
--- a/lib/gitlab/kubernetes/helm/install_command.rb
+++ b/lib/gitlab/kubernetes/helm/install_command.rb
@@ -6,10 +6,11 @@ module Gitlab
 
         attr_reader :name, :files, :chart, :version, :repository
 
-        def initialize(name:, chart:, files:, version: nil, repository: nil)
+        def initialize(name:, chart:, files:, rbac:, version: nil, repository: nil)
           @name = name
           @chart = chart
           @version = version
+          @rbac = rbac
           @files = files
           @repository = repository
         end
@@ -22,6 +23,10 @@ module Gitlab
           ].compact.join("\n")
         end
 
+        def rbac?
+          @rbac
+        end
+
         private
 
         def init_command
@@ -29,28 +34,51 @@ module Gitlab
         end
 
         def repository_command
-          "helm repo add #{name} #{repository}" if repository
+          ['helm', 'repo', 'add', name, repository].shelljoin if repository
         end
 
         def script_command
-          init_flags = "--name #{name}#{optional_tls_flags}#{optional_version_flag}" \
-            " --namespace #{Gitlab::Kubernetes::Helm::NAMESPACE}" \
-            " -f /data/helm/#{name}/config/values.yaml"
+          command = ['helm', 'install', chart] + install_command_flags
+
+          command.shelljoin + " >/dev/null\n"
+        end
+
+        def install_command_flags
+          name_flag      = ['--name', name]
+          namespace_flag = ['--namespace', Gitlab::Kubernetes::Helm::NAMESPACE]
+          value_flag     = ['-f', "/data/helm/#{name}/config/values.yaml"]
 
-          "helm install #{chart} #{init_flags} >/dev/null\n"
+          name_flag +
+            optional_tls_flags +
+            optional_version_flag +
+            optional_rbac_create_flag +
+            namespace_flag +
+            value_flag
+        end
+
+        def optional_rbac_create_flag
+          return [] unless rbac?
+
+          # jupyterhub helm chart is using rbac.enabled
+          #   https://github.com/jupyterhub/zero-to-jupyterhub-k8s/tree/master/jupyterhub
+          %w[--set rbac.create=true,rbac.enabled=true]
         end
 
         def optional_version_flag
-          " --version #{version}" if version
+          return [] unless version
+
+          ['--version', version]
         end
 
         def optional_tls_flags
-          return unless files.key?(:'ca.pem')
+          return [] unless files.key?(:'ca.pem')
 
-          " --tls" \
-            " --tls-ca-cert #{files_dir}/ca.pem" \
-            " --tls-cert #{files_dir}/cert.pem" \
-            " --tls-key #{files_dir}/key.pem"
+          [
+            '--tls',
+            '--tls-ca-cert', "#{files_dir}/ca.pem",
+            '--tls-cert', "#{files_dir}/cert.pem",
+            '--tls-key', "#{files_dir}/key.pem"
+          ]
         end
       end
     end