Add pod security policy support to metrics server (#11075)

* Add pod security policy support to metrics server

Signed-off-by: Baron Lenardson <baron.lenardson@target.com>

* Update Chart.yaml

Signed-off-by: David J. M. Karlsen <david@davidkarlsen.com>

stable/metrics-server/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v1
 appVersion: 0.3.1
 description: Metrics Server is a cluster-wide aggregator of resource usage data.
 name: metrics-server
-version: 2.2.0
+version: 2.3.0
 keywords:
 - metrics-server
 home: https://github.com/kubernetes-incubator/metrics-server

stable/metrics-server/README.md

@@ -7,6 +7,7 @@ Metrics Server is a cluster-wide aggregator of resource usage data.
 Parameter | Description | Default
 --- | --- | ---
 `rbac.create` | Enable Role-based authentication | `true`
+`rbac.pspEnabled` | Enable pod security policy support | `false`
 `serviceAccount.create` | If `true`, create a new service account | `true`
 `serviceAccount.name` | Service account to be used. If not set and `serviceAccount.create` is `true`, a name is generated using the fullname template | ``
 `apiService.create` | Create the v1beta1.metrics.k8s.io API service | `true`

stable/metrics-server/templates/cluster-role.yaml

@@ -26,4 +26,14 @@ rules:
     verbs:
     - get
     - create
+  {{- if .Values.rbac.pspEnabled }}
+  - apiGroups:
+    - extensions
+    resources:
+    - podsecuritypolicies
+    resourceNames:
+    - privileged-{{ template "metrics-server.fullname" . }}
+    verbs:
+    - use
+  {{- end -}}
 {{- end -}}

stable/metrics-server/templates/psp.yaml

@@ -0,0 +1,26 @@
+{{- if .Values.rbac.pspEnabled }}
+apiVersion: extensions/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: privileged-{{ template "metrics-server.fullname" . }}
+spec:
+  allowedCapabilities:
+  - '*'
+  fsGroup:
+    rule: RunAsAny
+  privileged: true
+  runAsUser:
+    rule: RunAsAny
+  seLinux:
+    rule: RunAsAny
+  supplementalGroups:
+    rule: RunAsAny
+  volumes:
+  - '*'
+  hostPID: true
+  hostIPC: true
+  hostNetwork: true
+  hostPorts:
+  - min: 1
+    max: 65536
+{{- end }}

stable/metrics-server/values.yaml

@@ -1,6 +1,7 @@
 rbac:
   # Specifies whether RBAC resources should be created
   create: true
+  pspEnabled: false
 
 serviceAccount:
   # Specifies whether a ServiceAccount should be created