[stable/external-dns] Enable PSP (#15251)

Signed-off-by: Kevin Lefevre <lefevre.kevin@gmail.com>

stable/external-dns/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v1
 name: external-dns
-version: 2.1.2
+version: 2.2.0
 appVersion: 0.5.15
 description: ExternalDNS is a Kubernetes addon that configures public DNS servers with information about exposed Kubernetes services to make them discoverable.
 keywords:

stable/external-dns/README.md

@@ -130,6 +130,7 @@ The following table lists the configurable parameters of the external-dns chart
 | `rbac.create`                      | Wether to create & use RBAC resources or not                                                             | `false`                                                  |
 | `rbac.serviceAccountName`          | ServiceAccount (ignored if rbac.create == true)                                                          | `default`                                                |
 | `rbac.apiVersion`                  | Version of the RBAC API                                                                                  | `v1beta1`                                                |
+| `rbac.pspEnabled`                  | PodSecurityPolicy                                                                                        | `false`                                                |
 | `resources`                        | CPU/Memory resource requests/limits.                                                                     | `{}`                                                     |
 | `livenessProbe`                    | Deployment Liveness Probe                                                                                | See `values.yaml`                                        |
 | `readinessProbe`                   | Deployment Readiness Probe                                                                               | See `values.yaml`                                        |

stable/external-dns/templates/psp-clusterrole.yaml

@@ -0,0 +1,13 @@
+{{- if .Values.rbac.pspEnabled }}
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ template "external-dns.fullname" . }}-psp
+  labels: {{ include "external-dns.labels" . | nindent 4 }}
+rules:
+- apiGroups: ['extensions']
+  resources: ['podsecuritypolicies']
+  verbs:     ['use']
+  resourceNames:
+  - {{ template "external-dns.fullname" . }}
+{{- end }}

stable/external-dns/templates/psp-clusterrolebinding.yaml

@@ -0,0 +1,15 @@
+{{- if .Values.rbac.pspEnabled }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "external-dns.fullname" . }}-psp
+  labels: {{ include "external-dns.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "external-dns.fullname" . }}-psp
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "external-dns.fullname" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end }}

stable/external-dns/templates/psp.yaml

@@ -0,0 +1,38 @@
+{{- if .Values.rbac.pspEnabled }}
+apiVersion: extensions/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: {{ template "external-dns.fullname" . }}
+  labels: {{ include "external-dns.labels" . | nindent 4 }}
+spec:
+  privileged: false
+  allowPrivilegeEscalation: false
+  requiredDropCapabilities:
+  - ALL
+  volumes:
+  - 'configMap'
+  - 'emptyDir'
+  - 'projected'
+  - 'secret'
+  - 'downwardAPI'
+  hostNetwork: false
+  hostIPC: false
+  hostPID: false
+  runAsUser:
+    rule: 'MustRunAs'
+    ranges:
+    - min: 1001
+      max: 1001
+  seLinux:
+    rule: 'RunAsAny'
+  supplementalGroups:
+    rule: 'MustRunAs'
+    ranges:
+    - min: 1001
+      max: 1001
+  fsGroup:
+    rule: 'MustRunAs'
+    ranges:
+    - min: 1001
+      max: 1001
+{{- end }}

stable/external-dns/values-production.yaml

@@ -278,6 +278,9 @@ rbac:
   ## RBAC API version
   ##
   apiVersion: v1beta1
+  ## Podsecuritypolicy
+  ##
+  pspEnabled: false
 
 ## Kubernetes Security Context
 ## https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

stable/external-dns/values.yaml

@@ -278,6 +278,9 @@ rbac:
   ## RBAC API version
   ##
   apiVersion: v1beta1
+  ## Podsecuritypolicy
+  ##
+  pspEnabled: false
 
 ## Kubernetes Security Context
 ## https://kubernetes.io/docs/tasks/configure-pod-container/security-context/