[stable/coredns] Split rbac.yaml into actual objects, provide PodSecurityPolicy, update coredns to 1.2.6 (#7600)

* [stable/coredns] Add PodSecurityPolicy Based on https://raw.githubusercontent.com/kubernetes/website/master/content/en/examples/policy/restricted-psp.yaml Signed-off-by: Manuel Rüger <manuel@rueg.eu> * [stable/coredns] Split rbac.yaml into actual objects Signed-off-by: Manuel Rüger <manuel@rueg.eu> * [stable/coredns] Create ServiceAccount separately from RBAC Signed-off-by: Manuel Rüger <manuel@rueg.eu> * [stable/coredns] Update apiVersion for rbac authorization Signed-off-by: Manuel Rüger <manuel@rueg.eu> * [stable/coredns] Bump chart and coredns to 1.2.6 Signed-off-by: Manuel Rüger <manuel@rueg.eu> * [stable/coredns] rbac should be active by default Signed-off-by: David J. M. Karlsen <david@davidkarlsen.com>
2026-08-23 22:37:45 +00:00 · 2018-12-04 09:23:30 -08:00
parent b4706da281
commit 01038017b0
9 changed files with 158 additions and 74 deletions
@@ -1,6 +1,6 @@
 name: coredns
-version: 1.1.3
-appVersion: 1.2.0
+version: 1.2.0
+appVersion: 1.2.6
 description: CoreDNS is a DNS server that chains plugins and provides Kubernetes DNS Services
 keywords:
 - coredns
@@ -122,3 +122,14 @@ Generate the list of ports automatically from the server definitions
        {{- end -}}
    {{- end -}}
 {{- end -}}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "coredns.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create -}}
+    {{ default (include "coredns.fullname" .) .Values.serviceAccount.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccount.name }}
+{{- end -}}
+{{- end -}}
@@ -0,0 +1,38 @@
+{{- if .Values.rbac.create }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "coredns.fullname" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
+    {{- if .Values.isClusterService }}
+    k8s-app: {{ .Chart.Name | quote }}
+    kubernetes.io/cluster-service: "true"
+    kubernetes.io/name: "CoreDNS"
+    {{- end }}
+    app: {{ template "coredns.name" . }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - endpoints
+  - services
+  - pods
+  - namespaces
+  verbs:
+  - list
+  - watch
+{{- if .Values.rbac.pspEnable }}
+- apiGroups:
+  - policy
+  - extensions
+  resources:
+  - podsecuritypolicies
+  verbs:
+  - use
+  resourceNames:
+  - {{ template "coredns.fullname" . }}
+{{- end }}
+{{- end }}
@@ -0,0 +1,24 @@
+{{- if .Values.rbac.create }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "coredns.fullname" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
+    {{- if .Values.isClusterService }}
+    k8s-app: {{ .Chart.Name | quote }}
+    kubernetes.io/cluster-service: "true"
+    kubernetes.io/name: "CoreDNS"
+    {{- end }}
+    app: {{ template "coredns.name" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "coredns.fullname" . }}
+subjects:
+- kind: ServiceAccount
+  name: {{ template "coredns.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+{{- end }}
@@ -36,9 +36,7 @@ spec:
        scheduler.alpha.kubernetes.io/tolerations: '[{"key":"CriticalAddonsOnly", "operator":"Exists"}]'
        {{- end }}
    spec:
-      {{- if or .Values.rbac.create .Values.rbac.serviceAccountName }}
-      serviceAccountName: {{ if .Values.rbac.create }}{{ template "coredns.fullname" . }}{{ else }}"{{ .Values.rbac.serviceAccountName }}"{{ end }}
-      {{- end }}
+      serviceAccountName: {{ template "coredns.serviceAccountName" . }}
      {{- if .Values.isClusterService }}
      dnsPolicy: Default
      {{- end }}
@@ -0,0 +1,53 @@
+{{- if .Values.rbac.pspEnable }}
+apiVersion: extensions/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: {{ template "coredns.fullname" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
+    {{- if .Values.isClusterService }}
+    k8s-app: {{ .Chart.Name | quote }}
+    kubernetes.io/cluster-service: "true"
+    kubernetes.io/name: "CoreDNS"
+    {{- else }}
+    app: {{ template "coredns.name" . }}
+    {{- end }}
+spec:
+  privileged: false
+  # Required to prevent escalations to root.
+  allowPrivilegeEscalation: false
+  # Add back CAP_NET_BIND_SERVICE so that coredns can run on port 53
+  allowedCapabilities:
+  - CAP_NET_BIND_SERVICE
+    # Allow core volume types.
+  volumes:
+    - 'configMap'
+    - 'emptyDir'
+    - 'projected'
+    - 'secret'
+    - 'downwardAPI'
+  hostNetwork: false
+  hostIPC: false
+  hostPID: false
+  runAsUser:
+    # Require the container to run without root privileges.
+    rule: 'RunAsAny'
+  seLinux:
+    # This policy assumes the nodes are using AppArmor rather than SELinux.
+    rule: 'RunAsAny'
+  supplementalGroups:
+    rule: 'MustRunAs'
+    ranges:
+      # Forbid adding the root group.
+      - min: 1
+        max: 65535
+  fsGroup:
+    rule: 'MustRunAs'
+    ranges:
+      # Forbid adding the root group.
+      - min: 1
+        max: 65535
+  readOnlyRootFilesystem: false
+{{- end }}
@@ -1,65 +0,0 @@
-{{- if .Values.rbac.create }}
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ template "coredns.fullname" . }}
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
-    {{- if .Values.isClusterService }}
-    k8s-app: {{ .Chart.Name | quote }}
-    kubernetes.io/cluster-service: "true"
-    kubernetes.io/name: "CoreDNS"
-    {{- end }}
-    app: {{ template "coredns.name" . }}
---
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: ClusterRole
-metadata:
-  name: {{ template "coredns.fullname" . }}
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
-    {{- if .Values.isClusterService }}
-    k8s-app: {{ .Chart.Name | quote }}
-    kubernetes.io/cluster-service: "true"
-    kubernetes.io/name: "CoreDNS"
-    {{- end }}
-    app: {{ template "coredns.name" . }}
-rules:
- apiGroups:
-  - ""
-  resources:
-  - endpoints
-  - services
-  - pods
-  - namespaces
-  verbs:
-  - list
-  - watch
---
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ template "coredns.fullname" . }}
-  labels:
-    heritage: {{ .Release.Service | quote }}
-    release: {{ .Release.Name | quote }}
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
-    {{- if .Values.isClusterService }}
-    k8s-app: {{ .Chart.Name | quote }}
-    kubernetes.io/cluster-service: "true"
-    kubernetes.io/name: "CoreDNS"
-    {{- end }}
-    app: {{ template "coredns.name" . }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ template "coredns.fullname" . }}
-subjects:
- kind: ServiceAccount
-  name: {{ template "coredns.fullname" . }}
-  namespace: {{ .Release.Namespace }}
-{{- end }}
@@ -0,0 +1,16 @@
+{{- if .Values.serviceAccount.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "coredns.serviceAccountName" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
+    {{- if .Values.isClusterService }}
+    k8s-app: {{ .Chart.Name | quote }}
+    kubernetes.io/cluster-service: "true"
+    kubernetes.io/name: "CoreDNS"
+    {{- end }}
+    app: {{ template "coredns.name" . }}
+{{- end }}
@@ -6,7 +6,7 @@ replicaCount: 1

 image:
  repository: coredns/coredns
-  tag: "1.2.0"
+  tag: "1.2.6"
  pullPolicy: IfNotPresent

 resources:
@@ -25,11 +25,20 @@ service:
    prometheus.io/scrape: "true"
    prometheus.io/port: "9153"

+serviceAccount:
+  create: false
+  # The name of the ServiceAccount to use
+  # If not set and create is true, a name is generated using the fullname template
+  name:
+
 rbac:
  # If true, create & use RBAC resources
-  create: false
-  # Ignored if rbac.create is true
-  serviceAccountName: default
+  create: true
+  # If true, create and use PodSecurityPolicy
+  pspEnable: false
+  # The name of the ServiceAccount to use.
+  # If not set and create is true, a name is generated using the fullname template
+  # name:

 # isClusterService specifies whether chart should be deployed as cluster-service or normal k8s app.
 isClusterService: true