From 1325ea9486c06ce04ff9fc1145f51b44657d7d59 Mon Sep 17 00:00:00 2001 From: Kevin Lefevre Date: Tue, 9 Jul 2019 12:22:01 +0200 Subject: [PATCH] [stable/external-dns] Enable PSP (#15251) Signed-off-by: Kevin Lefevre --- stable/external-dns/Chart.yaml | 2 +- stable/external-dns/README.md | 1 + .../templates/psp-clusterrole.yaml | 13 +++++++ .../templates/psp-clusterrolebinding.yaml | 15 ++++++++ stable/external-dns/templates/psp.yaml | 38 +++++++++++++++++++ stable/external-dns/values-production.yaml | 3 ++ stable/external-dns/values.yaml | 3 ++ 7 files changed, 74 insertions(+), 1 deletion(-) create mode 100644 stable/external-dns/templates/psp-clusterrole.yaml create mode 100644 stable/external-dns/templates/psp-clusterrolebinding.yaml create mode 100644 stable/external-dns/templates/psp.yaml diff --git a/stable/external-dns/Chart.yaml b/stable/external-dns/Chart.yaml index 69cf0dc0b1..ca24713323 100644 --- a/stable/external-dns/Chart.yaml +++ b/stable/external-dns/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: external-dns -version: 2.1.2 +version: 2.2.0 appVersion: 0.5.15 description: ExternalDNS is a Kubernetes addon that configures public DNS servers with information about exposed Kubernetes services to make them discoverable. keywords: diff --git a/stable/external-dns/README.md b/stable/external-dns/README.md index b79e36aedb..69591bf783 100644 --- a/stable/external-dns/README.md +++ b/stable/external-dns/README.md @@ -130,6 +130,7 @@ The following table lists the configurable parameters of the external-dns chart | `rbac.create` | Wether to create & use RBAC resources or not | `false` | | `rbac.serviceAccountName` | ServiceAccount (ignored if rbac.create == true) | `default` | | `rbac.apiVersion` | Version of the RBAC API | `v1beta1` | +| `rbac.pspEnabled` | PodSecurityPolicy | `false` | | `resources` | CPU/Memory resource requests/limits. | `{}` | | `livenessProbe` | Deployment Liveness Probe | See `values.yaml` | | `readinessProbe` | Deployment Readiness Probe | See `values.yaml` | diff --git a/stable/external-dns/templates/psp-clusterrole.yaml b/stable/external-dns/templates/psp-clusterrole.yaml new file mode 100644 index 0000000000..fb2988ba41 --- /dev/null +++ b/stable/external-dns/templates/psp-clusterrole.yaml @@ -0,0 +1,13 @@ +{{- if .Values.rbac.pspEnabled }} +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ template "external-dns.fullname" . }}-psp + labels: {{ include "external-dns.labels" . | nindent 4 }} +rules: +- apiGroups: ['extensions'] + resources: ['podsecuritypolicies'] + verbs: ['use'] + resourceNames: + - {{ template "external-dns.fullname" . }} +{{- end }} diff --git a/stable/external-dns/templates/psp-clusterrolebinding.yaml b/stable/external-dns/templates/psp-clusterrolebinding.yaml new file mode 100644 index 0000000000..3311901ecb --- /dev/null +++ b/stable/external-dns/templates/psp-clusterrolebinding.yaml @@ -0,0 +1,15 @@ +{{- if .Values.rbac.pspEnabled }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ template "external-dns.fullname" . }}-psp + labels: {{ include "external-dns.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "external-dns.fullname" . }}-psp +subjects: + - kind: ServiceAccount + name: {{ template "external-dns.fullname" . }} + namespace: {{ .Release.Namespace }} +{{- end }} diff --git a/stable/external-dns/templates/psp.yaml b/stable/external-dns/templates/psp.yaml new file mode 100644 index 0000000000..5a1627829d --- /dev/null +++ b/stable/external-dns/templates/psp.yaml @@ -0,0 +1,38 @@ +{{- if .Values.rbac.pspEnabled }} +apiVersion: extensions/v1beta1 +kind: PodSecurityPolicy +metadata: + name: {{ template "external-dns.fullname" . }} + labels: {{ include "external-dns.labels" . | nindent 4 }} +spec: + privileged: false + allowPrivilegeEscalation: false + requiredDropCapabilities: + - ALL + volumes: + - 'configMap' + - 'emptyDir' + - 'projected' + - 'secret' + - 'downwardAPI' + hostNetwork: false + hostIPC: false + hostPID: false + runAsUser: + rule: 'MustRunAs' + ranges: + - min: 1001 + max: 1001 + seLinux: + rule: 'RunAsAny' + supplementalGroups: + rule: 'MustRunAs' + ranges: + - min: 1001 + max: 1001 + fsGroup: + rule: 'MustRunAs' + ranges: + - min: 1001 + max: 1001 +{{- end }} diff --git a/stable/external-dns/values-production.yaml b/stable/external-dns/values-production.yaml index 656e7bf7b5..7613c90c06 100644 --- a/stable/external-dns/values-production.yaml +++ b/stable/external-dns/values-production.yaml @@ -278,6 +278,9 @@ rbac: ## RBAC API version ## apiVersion: v1beta1 + ## Podsecuritypolicy + ## + pspEnabled: false ## Kubernetes Security Context ## https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ diff --git a/stable/external-dns/values.yaml b/stable/external-dns/values.yaml index 282a43867f..99d9c557ae 100644 --- a/stable/external-dns/values.yaml +++ b/stable/external-dns/values.yaml @@ -278,6 +278,9 @@ rbac: ## RBAC API version ## apiVersion: v1beta1 + ## Podsecuritypolicy + ## + pspEnabled: false ## Kubernetes Security Context ## https://kubernetes.io/docs/tasks/configure-pod-container/security-context/