github/deprecated-helm-charts
1
0
Fork 0
mirror of https://github.com/helm/charts.git synced 2026-08-23 22:37:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

[stable/elasticsearch] Add ServiceAccounts for each components + PodSecurityPolicy (#8529)

Browse Source 
* [stable/elasticsearch] Add ServiceAccounts for each components

Signed-off-by: Ludovic Cavajani <lcavajani@suse.com>

* Add PodSecurityPolicy support

Signed-off-by: Ludovic Cavajani <lcavajani@suse.com>

* minor fixes

Signed-off-by: Ludovic Cavajani <lcavajani@suse.com>
This commit is contained in:
lcavajani
2018-10-24 05:16:08 -07:00
committed by k8s-ci-robot
parent 071fef7e4c
commit 167dafe04b
13 changed files with 186 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
stable/elasticsearch/Chart.yaml
+1 -1
View File
@@ -1,6 +1,6 @@
name: elasticsearch
home: https://www.elastic.co/products/elasticsearch
version: 1.11.1
version: 1.12.0
appVersion: 6.4.2
description: Flexible and powerful open source, distributed real-time search and analytics
engine.
stable/elasticsearch/README.md
+7
View File
@@ -122,6 +122,13 @@ The following table lists the configurable parameters of the elasticsearch chart
| `data.antiAffinity` | Data anti-affinity policy | `soft` |
| `data.nodeAffinity` | Data node affinity policy | `{}` |
| `extraInitContainers` | Additional init container passed through the tpl | `` |
| `podSecurityPolicy.enabled` | Specify if a Pod Security Policy must be created | `false` |
| `serviceAccounts.client.create` | If true, create the client service account | `true` |
| `serviceAccounts.client.name` | Name of the client service account to use or create | `{{ elasticsearch.client.fullname }}` |
| `serviceAccounts.master.create` | If true, create the master service account | `true` |
| `serviceAccounts.master.name` | Name of the master service account to use or create | `{{ elasticsearch.master.fullname }}` |
| `serviceAccounts.data.create` | If true, create the data service account | `true` |
| `serviceAccounts.data.name` | Name of the data service account to use or create | `{{ elasticsearch.data.fullname }}` |
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`.
stable/elasticsearch/templates/_helpers.tpl
+33
View File
@@ -46,3 +46,36 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
{{- define "elasticsearch.master.fullname" -}}
{{ template "elasticsearch.fullname" . }}-{{ .Values.master.name }}
{{- end -}}
{{/*
Create the name of the service account to use for the client component
*/}}
{{- define "elasticsearch.serviceAccountName.client" -}}
{{- if .Values.serviceAccounts.client.create -}}
{{ default (include "elasticsearch.client.fullname" .) .Values.serviceAccounts.client.name }}
{{- else -}}
{{ default "default" .Values.serviceAccounts.client.name }}
{{- end -}}
{{- end -}}
{{/*
Create the name of the service account to use for the data component
*/}}
{{- define "elasticsearch.serviceAccountName.data" -}}
{{- if .Values.serviceAccounts.data.create -}}
{{ default (include "elasticsearch.data.fullname" .) .Values.serviceAccounts.data.name }}
{{- else -}}
{{ default "default" .Values.serviceAccounts.data.name }}
{{- end -}}
{{- end -}}
{{/*
Create the name of the service account to use for the master component
*/}}
{{- define "elasticsearch.serviceAccountName.master" -}}
{{- if .Values.serviceAccounts.master.create -}}
{{ default (include "elasticsearch.master.fullname" .) .Values.serviceAccounts.master.name }}
{{- else -}}
{{ default "default" .Values.serviceAccounts.master.name }}
{{- end -}}
{{- end -}}
stable/elasticsearch/templates/client-deployment.yaml
+1
View File
@@ -21,6 +21,7 @@ spec:
{{ toYaml .Values.client.podAnnotations | indent 8 }}
{{- end }}
spec:
serviceAccountName: {{ template "elasticsearch.serviceAccountName.client" . }}
{{- if .Values.client.priorityClassName }}
priorityClassName: "{{ .Values.client.priorityClassName }}"
{{- end }}
stable/elasticsearch/templates/client-serviceaccount.yaml
+12
View File
@@ -0,0 +1,12 @@
{{- if .Values.serviceAccounts.client.create }}
apiVersion: v1
kind: ServiceAccount
metadata:
labels:
app: {{ template "elasticsearch.name" . }}
chart: {{ .Chart.Name }}-{{ .Chart.Version }}
component: "{{ .Values.client.name }}"
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
name: {{ template "elasticsearch.client.fullname" . }}
{{- end }}
stable/elasticsearch/templates/data-serviceaccount.yaml
+12
View File
@@ -0,0 +1,12 @@
{{- if .Values.serviceAccounts.data.create }}
apiVersion: v1
kind: ServiceAccount
metadata:
labels:
app: {{ template "elasticsearch.name" . }}
chart: {{ .Chart.Name }}-{{ .Chart.Version }}
component: "{{ .Values.data.name }}"
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
name: {{ template "elasticsearch.data.fullname" . }}
{{- end }}
stable/elasticsearch/templates/data-statefulset.yaml
+1
View File
@@ -22,6 +22,7 @@ spec:
{{ toYaml .Values.data.podAnnotations | indent 8 }}
{{- end }}
spec:
serviceAccountName: {{ template "elasticsearch.serviceAccountName.data" . }}
{{- if .Values.data.priorityClassName }}
priorityClassName: "{{ .Values.data.priorityClassName }}"
{{- end }}
stable/elasticsearch/templates/master-serviceaccount.yaml
+12
View File
@@ -0,0 +1,12 @@
{{- if .Values.serviceAccounts.master.create }}
apiVersion: v1
kind: ServiceAccount
metadata:
labels:
app: {{ template "elasticsearch.name" . }}
chart: {{ .Chart.Name }}-{{ .Chart.Version }}
component: "{{ .Values.master.name }}"
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
name: {{ template "elasticsearch.master.fullname" . }}
{{- end }}
stable/elasticsearch/templates/master-statefulset.yaml
+1
View File
@@ -22,6 +22,7 @@ spec:
{{ toYaml .Values.master.podAnnotations | indent 8 }}
{{- end }}
spec:
serviceAccountName: {{ template "elasticsearch.serviceAccountName.master" . }}
{{- if .Values.master.priorityClassName }}
priorityClassName: "{{ .Values.master.priorityClassName }}"
{{- end }}
stable/elasticsearch/templates/podsecuritypolicy.yaml
+43
View File
@@ -0,0 +1,43 @@
{{- if .Values.podSecurityPolicy.enabled }}
apiVersion: extensions/v1beta1
kind: PodSecurityPolicy
metadata:
name: {{ template "elasticsearch.fullname" . }}
labels:
app: {{ template "elasticsearch.name" . }}
chart: {{ .Chart.Name }}-{{ .Chart.Version }}
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
annotations:
seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'
seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default'
apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
spec:
privileged: true
allowPrivilegeEscalation: true
volumes:
- 'configMap'
- 'secret'
- 'emptyDir'
- 'persistentVolumeClaim'
hostNetwork: false
hostPID: false
hostIPC: false
runAsUser:
rule: 'RunAsAny'
runAsGroup:
rule: 'RunAsAny'
seLinux:
rule: 'RunAsAny'
supplementalGroups:
rule: 'RunAsAny'
fsGroup:
rule: 'MustRunAs'
ranges:
- min: 1000
max: 1000
readOnlyRootFilesystem: false
hostPorts:
- min: 1
max: 65535
{{- end }}
stable/elasticsearch/templates/role.yaml
+18
View File
@@ -0,0 +1,18 @@
{{- if .Values.podSecurityPolicy.enabled }}
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: Role
metadata:
name: {{ template "elasticsearch.fullname" . }}
labels:
app: {{ template "elasticsearch.name" . }}
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
release: "{{ .Release.Name }}"
heritage: "{{ .Release.Service }}"
namespace: {{ .Release.Namespace }}
rules:
- apiGroups: ['extensions']
resources: ['podsecuritypolicies']
verbs: ['use']
resourceNames:
- {{ template "elasticsearch.fullname" . }}
{{- end }}
stable/elasticsearch/templates/rolebinding.yaml
+26
View File
@@ -0,0 +1,26 @@
{{- if .Values.podSecurityPolicy.enabled }}
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: RoleBinding
metadata:
name: {{ template "elasticsearch.fullname" . }}
labels:
app: {{ template "elasticsearch.name" . }}
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
release: "{{ .Release.Name }}"
heritage: "{{ .Release.Service }}"
roleRef:
kind: Role
name: {{ template "elasticsearch.fullname" . }}
apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
name: {{ template "elasticsearch.serviceAccountName.client" . }}
namespace: {{ .Release.Namespace }}
- kind: ServiceAccount
name: {{ template "elasticsearch.serviceAccountName.data" . }}
namespace: {{ .Release.Namespace }}
- kind: ServiceAccount
name: {{ template "elasticsearch.serviceAccountName.master" . }}
namespace: {{ .Release.Namespace }}
{{- end }}
stable/elasticsearch/values.yaml
+19
View File
@@ -3,6 +3,25 @@
# Declare variables to be passed into your templates.
appVersion: "6.4.2"
## Define serviceAccount names for components. Defaults to component's fully qualified name.
##
serviceAccounts:
client:
create: true
name:
master:
create: true
name:
data:
create: true
name:
## Specify if a Pod Security Policy for node-exporter must be created
## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/
##
podSecurityPolicy:
enabled: false
image:
repository: "docker.elastic.co/elasticsearch/elasticsearch-oss"
tag: "6.4.2"