From 167dafe04becb346bbb9f5cc12dae368971803d1 Mon Sep 17 00:00:00 2001 From: lcavajani <33934779+lcavajani@users.noreply.github.com> Date: Wed, 24 Oct 2018 14:16:08 +0200 Subject: [PATCH] [stable/elasticsearch] Add ServiceAccounts for each components + PodSecurityPolicy (#8529) * [stable/elasticsearch] Add ServiceAccounts for each components Signed-off-by: Ludovic Cavajani * Add PodSecurityPolicy support Signed-off-by: Ludovic Cavajani * minor fixes Signed-off-by: Ludovic Cavajani --- stable/elasticsearch/Chart.yaml | 2 +- stable/elasticsearch/README.md | 7 +++ stable/elasticsearch/templates/_helpers.tpl | 33 ++++++++++++++ .../templates/client-deployment.yaml | 1 + .../templates/client-serviceaccount.yaml | 12 ++++++ .../templates/data-serviceaccount.yaml | 12 ++++++ .../templates/data-statefulset.yaml | 1 + .../templates/master-serviceaccount.yaml | 12 ++++++ .../templates/master-statefulset.yaml | 1 + .../templates/podsecuritypolicy.yaml | 43 +++++++++++++++++++ stable/elasticsearch/templates/role.yaml | 18 ++++++++ .../elasticsearch/templates/rolebinding.yaml | 26 +++++++++++ stable/elasticsearch/values.yaml | 19 ++++++++ 13 files changed, 186 insertions(+), 1 deletion(-) create mode 100644 stable/elasticsearch/templates/client-serviceaccount.yaml create mode 100644 stable/elasticsearch/templates/data-serviceaccount.yaml create mode 100644 stable/elasticsearch/templates/master-serviceaccount.yaml create mode 100644 stable/elasticsearch/templates/podsecuritypolicy.yaml create mode 100644 stable/elasticsearch/templates/role.yaml create mode 100644 stable/elasticsearch/templates/rolebinding.yaml diff --git a/stable/elasticsearch/Chart.yaml b/stable/elasticsearch/Chart.yaml index 14d0141a88..4e53fa69cc 100755 --- a/stable/elasticsearch/Chart.yaml +++ b/stable/elasticsearch/Chart.yaml @@ -1,6 +1,6 @@ name: elasticsearch home: https://www.elastic.co/products/elasticsearch -version: 1.11.1 +version: 1.12.0 appVersion: 6.4.2 description: Flexible and powerful open source, distributed real-time search and analytics engine. diff --git a/stable/elasticsearch/README.md b/stable/elasticsearch/README.md index ae9d0d424f..8b0a71642f 100644 --- a/stable/elasticsearch/README.md +++ b/stable/elasticsearch/README.md @@ -122,6 +122,13 @@ The following table lists the configurable parameters of the elasticsearch chart | `data.antiAffinity` | Data anti-affinity policy | `soft` | | `data.nodeAffinity` | Data node affinity policy | `{}` | | `extraInitContainers` | Additional init container passed through the tpl | `` | +| `podSecurityPolicy.enabled` | Specify if a Pod Security Policy must be created | `false` | +| `serviceAccounts.client.create` | If true, create the client service account | `true` | +| `serviceAccounts.client.name` | Name of the client service account to use or create | `{{ elasticsearch.client.fullname }}` | +| `serviceAccounts.master.create` | If true, create the master service account | `true` | +| `serviceAccounts.master.name` | Name of the master service account to use or create | `{{ elasticsearch.master.fullname }}` | +| `serviceAccounts.data.create` | If true, create the data service account | `true` | +| `serviceAccounts.data.name` | Name of the data service account to use or create | `{{ elasticsearch.data.fullname }}` | Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. diff --git a/stable/elasticsearch/templates/_helpers.tpl b/stable/elasticsearch/templates/_helpers.tpl index 100521c082..dbafe00621 100644 --- a/stable/elasticsearch/templates/_helpers.tpl +++ b/stable/elasticsearch/templates/_helpers.tpl @@ -46,3 +46,36 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this {{- define "elasticsearch.master.fullname" -}} {{ template "elasticsearch.fullname" . }}-{{ .Values.master.name }} {{- end -}} + +{{/* +Create the name of the service account to use for the client component +*/}} +{{- define "elasticsearch.serviceAccountName.client" -}} +{{- if .Values.serviceAccounts.client.create -}} + {{ default (include "elasticsearch.client.fullname" .) .Values.serviceAccounts.client.name }} +{{- else -}} + {{ default "default" .Values.serviceAccounts.client.name }} +{{- end -}} +{{- end -}} + +{{/* +Create the name of the service account to use for the data component +*/}} +{{- define "elasticsearch.serviceAccountName.data" -}} +{{- if .Values.serviceAccounts.data.create -}} + {{ default (include "elasticsearch.data.fullname" .) .Values.serviceAccounts.data.name }} +{{- else -}} + {{ default "default" .Values.serviceAccounts.data.name }} +{{- end -}} +{{- end -}} + +{{/* +Create the name of the service account to use for the master component +*/}} +{{- define "elasticsearch.serviceAccountName.master" -}} +{{- if .Values.serviceAccounts.master.create -}} + {{ default (include "elasticsearch.master.fullname" .) .Values.serviceAccounts.master.name }} +{{- else -}} + {{ default "default" .Values.serviceAccounts.master.name }} +{{- end -}} +{{- end -}} diff --git a/stable/elasticsearch/templates/client-deployment.yaml b/stable/elasticsearch/templates/client-deployment.yaml index 23ff9ede30..6c2032aa66 100644 --- a/stable/elasticsearch/templates/client-deployment.yaml +++ b/stable/elasticsearch/templates/client-deployment.yaml @@ -21,6 +21,7 @@ spec: {{ toYaml .Values.client.podAnnotations | indent 8 }} {{- end }} spec: + serviceAccountName: {{ template "elasticsearch.serviceAccountName.client" . }} {{- if .Values.client.priorityClassName }} priorityClassName: "{{ .Values.client.priorityClassName }}" {{- end }} diff --git a/stable/elasticsearch/templates/client-serviceaccount.yaml b/stable/elasticsearch/templates/client-serviceaccount.yaml new file mode 100644 index 0000000000..e64768279d --- /dev/null +++ b/stable/elasticsearch/templates/client-serviceaccount.yaml @@ -0,0 +1,12 @@ +{{- if .Values.serviceAccounts.client.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app: {{ template "elasticsearch.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version }} + component: "{{ .Values.client.name }}" + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} + name: {{ template "elasticsearch.client.fullname" . }} +{{- end }} diff --git a/stable/elasticsearch/templates/data-serviceaccount.yaml b/stable/elasticsearch/templates/data-serviceaccount.yaml new file mode 100644 index 0000000000..2a9b4fd3fa --- /dev/null +++ b/stable/elasticsearch/templates/data-serviceaccount.yaml @@ -0,0 +1,12 @@ +{{- if .Values.serviceAccounts.data.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app: {{ template "elasticsearch.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version }} + component: "{{ .Values.data.name }}" + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} + name: {{ template "elasticsearch.data.fullname" . }} +{{- end }} diff --git a/stable/elasticsearch/templates/data-statefulset.yaml b/stable/elasticsearch/templates/data-statefulset.yaml index d7ae76d6d7..2b3ca45a94 100644 --- a/stable/elasticsearch/templates/data-statefulset.yaml +++ b/stable/elasticsearch/templates/data-statefulset.yaml @@ -22,6 +22,7 @@ spec: {{ toYaml .Values.data.podAnnotations | indent 8 }} {{- end }} spec: + serviceAccountName: {{ template "elasticsearch.serviceAccountName.data" . }} {{- if .Values.data.priorityClassName }} priorityClassName: "{{ .Values.data.priorityClassName }}" {{- end }} diff --git a/stable/elasticsearch/templates/master-serviceaccount.yaml b/stable/elasticsearch/templates/master-serviceaccount.yaml new file mode 100644 index 0000000000..0f7dfbdbbb --- /dev/null +++ b/stable/elasticsearch/templates/master-serviceaccount.yaml @@ -0,0 +1,12 @@ +{{- if .Values.serviceAccounts.master.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app: {{ template "elasticsearch.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version }} + component: "{{ .Values.master.name }}" + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} + name: {{ template "elasticsearch.master.fullname" . }} +{{- end }} diff --git a/stable/elasticsearch/templates/master-statefulset.yaml b/stable/elasticsearch/templates/master-statefulset.yaml index 6530b00611..3a537ae68b 100644 --- a/stable/elasticsearch/templates/master-statefulset.yaml +++ b/stable/elasticsearch/templates/master-statefulset.yaml @@ -22,6 +22,7 @@ spec: {{ toYaml .Values.master.podAnnotations | indent 8 }} {{- end }} spec: + serviceAccountName: {{ template "elasticsearch.serviceAccountName.master" . }} {{- if .Values.master.priorityClassName }} priorityClassName: "{{ .Values.master.priorityClassName }}" {{- end }} diff --git a/stable/elasticsearch/templates/podsecuritypolicy.yaml b/stable/elasticsearch/templates/podsecuritypolicy.yaml new file mode 100644 index 0000000000..7047eba252 --- /dev/null +++ b/stable/elasticsearch/templates/podsecuritypolicy.yaml @@ -0,0 +1,43 @@ +{{- if .Values.podSecurityPolicy.enabled }} +apiVersion: extensions/v1beta1 +kind: PodSecurityPolicy +metadata: + name: {{ template "elasticsearch.fullname" . }} + labels: + app: {{ template "elasticsearch.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version }} + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} + annotations: + seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*' + seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default' + apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default' +spec: + privileged: true + allowPrivilegeEscalation: true + volumes: + - 'configMap' + - 'secret' + - 'emptyDir' + - 'persistentVolumeClaim' + hostNetwork: false + hostPID: false + hostIPC: false + runAsUser: + rule: 'RunAsAny' + runAsGroup: + rule: 'RunAsAny' + seLinux: + rule: 'RunAsAny' + supplementalGroups: + rule: 'RunAsAny' + fsGroup: + rule: 'MustRunAs' + ranges: + - min: 1000 + max: 1000 + readOnlyRootFilesystem: false + hostPorts: + - min: 1 + max: 65535 +{{- end }} diff --git a/stable/elasticsearch/templates/role.yaml b/stable/elasticsearch/templates/role.yaml new file mode 100644 index 0000000000..1da3a0ef63 --- /dev/null +++ b/stable/elasticsearch/templates/role.yaml @@ -0,0 +1,18 @@ +{{- if .Values.podSecurityPolicy.enabled }} +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: Role +metadata: + name: {{ template "elasticsearch.fullname" . }} + labels: + app: {{ template "elasticsearch.name" . }} + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" + namespace: {{ .Release.Namespace }} +rules: +- apiGroups: ['extensions'] + resources: ['podsecuritypolicies'] + verbs: ['use'] + resourceNames: + - {{ template "elasticsearch.fullname" . }} +{{- end }} diff --git a/stable/elasticsearch/templates/rolebinding.yaml b/stable/elasticsearch/templates/rolebinding.yaml new file mode 100644 index 0000000000..3606960b71 --- /dev/null +++ b/stable/elasticsearch/templates/rolebinding.yaml @@ -0,0 +1,26 @@ +{{- if .Values.podSecurityPolicy.enabled }} +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: RoleBinding +metadata: + name: {{ template "elasticsearch.fullname" . }} + labels: + app: {{ template "elasticsearch.name" . }} + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" +roleRef: + kind: Role + name: {{ template "elasticsearch.fullname" . }} + apiGroup: rbac.authorization.k8s.io +subjects: +- kind: ServiceAccount + name: {{ template "elasticsearch.serviceAccountName.client" . }} + namespace: {{ .Release.Namespace }} +- kind: ServiceAccount + name: {{ template "elasticsearch.serviceAccountName.data" . }} + namespace: {{ .Release.Namespace }} +- kind: ServiceAccount + name: {{ template "elasticsearch.serviceAccountName.master" . }} + namespace: {{ .Release.Namespace }} +{{- end }} + diff --git a/stable/elasticsearch/values.yaml b/stable/elasticsearch/values.yaml index fb8d0e21a9..5cd7ee9cb6 100644 --- a/stable/elasticsearch/values.yaml +++ b/stable/elasticsearch/values.yaml @@ -3,6 +3,25 @@ # Declare variables to be passed into your templates. appVersion: "6.4.2" +## Define serviceAccount names for components. Defaults to component's fully qualified name. +## +serviceAccounts: + client: + create: true + name: + master: + create: true + name: + data: + create: true + name: + +## Specify if a Pod Security Policy for node-exporter must be created +## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/ +## +podSecurityPolicy: + enabled: false + image: repository: "docker.elastic.co/elasticsearch/elasticsearch-oss" tag: "6.4.2"