From 01038017b03d26341660707fea8cb262e60039f9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20R=C3=BCger?= Date: Tue, 4 Dec 2018 18:23:30 +0100 Subject: [PATCH] [stable/coredns] Split rbac.yaml into actual objects, provide PodSecurityPolicy, update coredns to 1.2.6 (#7600) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * [stable/coredns] Add PodSecurityPolicy Based on https://raw.githubusercontent.com/kubernetes/website/master/content/en/examples/policy/restricted-psp.yaml Signed-off-by: Manuel Rüger * [stable/coredns] Split rbac.yaml into actual objects Signed-off-by: Manuel Rüger * [stable/coredns] Create ServiceAccount separately from RBAC Signed-off-by: Manuel Rüger * [stable/coredns] Update apiVersion for rbac authorization Signed-off-by: Manuel Rüger * [stable/coredns] Bump chart and coredns to 1.2.6 Signed-off-by: Manuel Rüger * [stable/coredns] rbac should be active by default Signed-off-by: David J. M. Karlsen --- stable/coredns/Chart.yaml | 4 +- stable/coredns/templates/_helpers.tpl | 11 ++++ stable/coredns/templates/clusterrole.yaml | 38 +++++++++++ .../coredns/templates/clusterrolebinding.yaml | 24 +++++++ stable/coredns/templates/deployment.yaml | 4 +- .../coredns/templates/podsecuritypolicy.yaml | 53 +++++++++++++++ stable/coredns/templates/rbac.yaml | 65 ------------------- stable/coredns/templates/serviceaccount.yaml | 16 +++++ stable/coredns/values.yaml | 17 +++-- 9 files changed, 158 insertions(+), 74 deletions(-) create mode 100644 stable/coredns/templates/clusterrole.yaml create mode 100644 stable/coredns/templates/clusterrolebinding.yaml create mode 100644 stable/coredns/templates/podsecuritypolicy.yaml delete mode 100644 stable/coredns/templates/rbac.yaml create mode 100644 stable/coredns/templates/serviceaccount.yaml diff --git a/stable/coredns/Chart.yaml b/stable/coredns/Chart.yaml index 8dd95bcecd..bba37104b9 100644 --- a/stable/coredns/Chart.yaml +++ b/stable/coredns/Chart.yaml @@ -1,6 +1,6 @@ name: coredns -version: 1.1.3 -appVersion: 1.2.0 +version: 1.2.0 +appVersion: 1.2.6 description: CoreDNS is a DNS server that chains plugins and provides Kubernetes DNS Services keywords: - coredns diff --git a/stable/coredns/templates/_helpers.tpl b/stable/coredns/templates/_helpers.tpl index 72b2ad34ac..c11d5c23f9 100644 --- a/stable/coredns/templates/_helpers.tpl +++ b/stable/coredns/templates/_helpers.tpl @@ -122,3 +122,14 @@ Generate the list of ports automatically from the server definitions {{- end -}} {{- end -}} {{- end -}} + +{{/* +Create the name of the service account to use +*/}} +{{- define "coredns.serviceAccountName" -}} +{{- if .Values.serviceAccount.create -}} + {{ default (include "coredns.fullname" .) .Values.serviceAccount.name }} +{{- else -}} + {{ default "default" .Values.serviceAccount.name }} +{{- end -}} +{{- end -}} diff --git a/stable/coredns/templates/clusterrole.yaml b/stable/coredns/templates/clusterrole.yaml new file mode 100644 index 0000000000..a45c65b4a3 --- /dev/null +++ b/stable/coredns/templates/clusterrole.yaml @@ -0,0 +1,38 @@ +{{- if .Values.rbac.create }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ template "coredns.fullname" . }} + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}" + {{- if .Values.isClusterService }} + k8s-app: {{ .Chart.Name | quote }} + kubernetes.io/cluster-service: "true" + kubernetes.io/name: "CoreDNS" + {{- end }} + app: {{ template "coredns.name" . }} +rules: +- apiGroups: + - "" + resources: + - endpoints + - services + - pods + - namespaces + verbs: + - list + - watch +{{- if .Values.rbac.pspEnable }} +- apiGroups: + - policy + - extensions + resources: + - podsecuritypolicies + verbs: + - use + resourceNames: + - {{ template "coredns.fullname" . }} +{{- end }} +{{- end }} diff --git a/stable/coredns/templates/clusterrolebinding.yaml b/stable/coredns/templates/clusterrolebinding.yaml new file mode 100644 index 0000000000..80ade3d25e --- /dev/null +++ b/stable/coredns/templates/clusterrolebinding.yaml @@ -0,0 +1,24 @@ +{{- if .Values.rbac.create }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ template "coredns.fullname" . }} + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}" + {{- if .Values.isClusterService }} + k8s-app: {{ .Chart.Name | quote }} + kubernetes.io/cluster-service: "true" + kubernetes.io/name: "CoreDNS" + {{- end }} + app: {{ template "coredns.name" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "coredns.fullname" . }} +subjects: +- kind: ServiceAccount + name: {{ template "coredns.fullname" . }} + namespace: {{ .Release.Namespace }} +{{- end }} diff --git a/stable/coredns/templates/deployment.yaml b/stable/coredns/templates/deployment.yaml index 81647b2d0c..db0ba5e68f 100644 --- a/stable/coredns/templates/deployment.yaml +++ b/stable/coredns/templates/deployment.yaml @@ -36,9 +36,7 @@ spec: scheduler.alpha.kubernetes.io/tolerations: '[{"key":"CriticalAddonsOnly", "operator":"Exists"}]' {{- end }} spec: - {{- if or .Values.rbac.create .Values.rbac.serviceAccountName }} - serviceAccountName: {{ if .Values.rbac.create }}{{ template "coredns.fullname" . }}{{ else }}"{{ .Values.rbac.serviceAccountName }}"{{ end }} - {{- end }} + serviceAccountName: {{ template "coredns.serviceAccountName" . }} {{- if .Values.isClusterService }} dnsPolicy: Default {{- end }} diff --git a/stable/coredns/templates/podsecuritypolicy.yaml b/stable/coredns/templates/podsecuritypolicy.yaml new file mode 100644 index 0000000000..eacb7ee228 --- /dev/null +++ b/stable/coredns/templates/podsecuritypolicy.yaml @@ -0,0 +1,53 @@ +{{- if .Values.rbac.pspEnable }} +apiVersion: extensions/v1beta1 +kind: PodSecurityPolicy +metadata: + name: {{ template "coredns.fullname" . }} + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}" + {{- if .Values.isClusterService }} + k8s-app: {{ .Chart.Name | quote }} + kubernetes.io/cluster-service: "true" + kubernetes.io/name: "CoreDNS" + {{- else }} + app: {{ template "coredns.name" . }} + {{- end }} +spec: + privileged: false + # Required to prevent escalations to root. + allowPrivilegeEscalation: false + # Add back CAP_NET_BIND_SERVICE so that coredns can run on port 53 + allowedCapabilities: + - CAP_NET_BIND_SERVICE + # Allow core volume types. + volumes: + - 'configMap' + - 'emptyDir' + - 'projected' + - 'secret' + - 'downwardAPI' + hostNetwork: false + hostIPC: false + hostPID: false + runAsUser: + # Require the container to run without root privileges. + rule: 'RunAsAny' + seLinux: + # This policy assumes the nodes are using AppArmor rather than SELinux. + rule: 'RunAsAny' + supplementalGroups: + rule: 'MustRunAs' + ranges: + # Forbid adding the root group. + - min: 1 + max: 65535 + fsGroup: + rule: 'MustRunAs' + ranges: + # Forbid adding the root group. + - min: 1 + max: 65535 + readOnlyRootFilesystem: false +{{- end }} diff --git a/stable/coredns/templates/rbac.yaml b/stable/coredns/templates/rbac.yaml deleted file mode 100644 index 1400b96b34..0000000000 --- a/stable/coredns/templates/rbac.yaml +++ /dev/null @@ -1,65 +0,0 @@ -{{- if .Values.rbac.create }} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ template "coredns.fullname" . }} - labels: - heritage: {{ .Release.Service | quote }} - release: {{ .Release.Name | quote }} - chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}" - {{- if .Values.isClusterService }} - k8s-app: {{ .Chart.Name | quote }} - kubernetes.io/cluster-service: "true" - kubernetes.io/name: "CoreDNS" - {{- end }} - app: {{ template "coredns.name" . }} ---- -apiVersion: rbac.authorization.k8s.io/v1beta1 -kind: ClusterRole -metadata: - name: {{ template "coredns.fullname" . }} - labels: - heritage: {{ .Release.Service | quote }} - release: {{ .Release.Name | quote }} - chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}" - {{- if .Values.isClusterService }} - k8s-app: {{ .Chart.Name | quote }} - kubernetes.io/cluster-service: "true" - kubernetes.io/name: "CoreDNS" - {{- end }} - app: {{ template "coredns.name" . }} -rules: -- apiGroups: - - "" - resources: - - endpoints - - services - - pods - - namespaces - verbs: - - list - - watch ---- -apiVersion: rbac.authorization.k8s.io/v1beta1 -kind: ClusterRoleBinding -metadata: - name: {{ template "coredns.fullname" . }} - labels: - heritage: {{ .Release.Service | quote }} - release: {{ .Release.Name | quote }} - chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}" - {{- if .Values.isClusterService }} - k8s-app: {{ .Chart.Name | quote }} - kubernetes.io/cluster-service: "true" - kubernetes.io/name: "CoreDNS" - {{- end }} - app: {{ template "coredns.name" . }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: {{ template "coredns.fullname" . }} -subjects: -- kind: ServiceAccount - name: {{ template "coredns.fullname" . }} - namespace: {{ .Release.Namespace }} -{{- end }} diff --git a/stable/coredns/templates/serviceaccount.yaml b/stable/coredns/templates/serviceaccount.yaml new file mode 100644 index 0000000000..6db7e291a4 --- /dev/null +++ b/stable/coredns/templates/serviceaccount.yaml @@ -0,0 +1,16 @@ +{{- if .Values.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "coredns.serviceAccountName" . }} + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}" + {{- if .Values.isClusterService }} + k8s-app: {{ .Chart.Name | quote }} + kubernetes.io/cluster-service: "true" + kubernetes.io/name: "CoreDNS" + {{- end }} + app: {{ template "coredns.name" . }} +{{- end }} diff --git a/stable/coredns/values.yaml b/stable/coredns/values.yaml index 964e72b1b2..5a136ccf1b 100644 --- a/stable/coredns/values.yaml +++ b/stable/coredns/values.yaml @@ -6,7 +6,7 @@ replicaCount: 1 image: repository: coredns/coredns - tag: "1.2.0" + tag: "1.2.6" pullPolicy: IfNotPresent resources: @@ -25,11 +25,20 @@ service: prometheus.io/scrape: "true" prometheus.io/port: "9153" +serviceAccount: + create: false + # The name of the ServiceAccount to use + # If not set and create is true, a name is generated using the fullname template + name: + rbac: # If true, create & use RBAC resources - create: false - # Ignored if rbac.create is true - serviceAccountName: default + create: true + # If true, create and use PodSecurityPolicy + pspEnable: false + # The name of the ServiceAccount to use. + # If not set and create is true, a name is generated using the fullname template + # name: # isClusterService specifies whether chart should be deployed as cluster-service or normal k8s app. isClusterService: true