From 1912822188517fa4c71554b047667d494a85ea2e Mon Sep 17 00:00:00 2001
From: Baron Lenardson <bblenard@mtu.edu>
Date: Fri, 1 Feb 2019 13:40:07 -0600
Subject: [PATCH] Add pod security policy support to metrics server (#11075)

* Add pod security policy support to metrics server

Signed-off-by: Baron Lenardson <baron.lenardson@target.com>

* Update Chart.yaml

Signed-off-by: David J. M. Karlsen <david@davidkarlsen.com>
---
 stable/metrics-server/Chart.yaml              |  2 +-
 stable/metrics-server/README.md               |  1 +
 .../templates/cluster-role.yaml               | 10 +++++++
 stable/metrics-server/templates/psp.yaml      | 26 +++++++++++++++++++
 stable/metrics-server/values.yaml             |  1 +
 5 files changed, 39 insertions(+), 1 deletion(-)
 create mode 100644 stable/metrics-server/templates/psp.yaml

diff --git a/stable/metrics-server/Chart.yaml b/stable/metrics-server/Chart.yaml
index 8c917bdbc9..ef0b8f0777 100755
--- a/stable/metrics-server/Chart.yaml
+++ b/stable/metrics-server/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v1
 appVersion: 0.3.1
 description: Metrics Server is a cluster-wide aggregator of resource usage data.
 name: metrics-server
-version: 2.2.0
+version: 2.3.0
 keywords:
 - metrics-server
 home: https://github.com/kubernetes-incubator/metrics-server
diff --git a/stable/metrics-server/README.md b/stable/metrics-server/README.md
index b8c664830c..d426078906 100644
--- a/stable/metrics-server/README.md
+++ b/stable/metrics-server/README.md
@@ -7,6 +7,7 @@ Metrics Server is a cluster-wide aggregator of resource usage data.
 Parameter | Description | Default
 --- | --- | ---
 `rbac.create` | Enable Role-based authentication | `true`
+`rbac.pspEnabled` | Enable pod security policy support | `false`
 `serviceAccount.create` | If `true`, create a new service account | `true`
 `serviceAccount.name` | Service account to be used. If not set and `serviceAccount.create` is `true`, a name is generated using the fullname template | ``
 `apiService.create` | Create the v1beta1.metrics.k8s.io API service | `true`
diff --git a/stable/metrics-server/templates/cluster-role.yaml b/stable/metrics-server/templates/cluster-role.yaml
index 4c94f175bb..c91c47fc5e 100644
--- a/stable/metrics-server/templates/cluster-role.yaml
+++ b/stable/metrics-server/templates/cluster-role.yaml
@@ -26,4 +26,14 @@ rules:
     verbs:
     - get
     - create
+  {{- if .Values.rbac.pspEnabled }}
+  - apiGroups:
+    - extensions
+    resources:
+    - podsecuritypolicies
+    resourceNames:
+    - privileged-{{ template "metrics-server.fullname" . }}
+    verbs:
+    - use
+  {{- end -}}
 {{- end -}}
diff --git a/stable/metrics-server/templates/psp.yaml b/stable/metrics-server/templates/psp.yaml
new file mode 100644
index 0000000000..021ef97219
--- /dev/null
+++ b/stable/metrics-server/templates/psp.yaml
@@ -0,0 +1,26 @@
+{{- if .Values.rbac.pspEnabled }}
+apiVersion: extensions/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: privileged-{{ template "metrics-server.fullname" . }}
+spec:
+  allowedCapabilities:
+  - '*'
+  fsGroup:
+    rule: RunAsAny
+  privileged: true
+  runAsUser:
+    rule: RunAsAny
+  seLinux:
+    rule: RunAsAny
+  supplementalGroups:
+    rule: RunAsAny
+  volumes:
+  - '*'
+  hostPID: true
+  hostIPC: true
+  hostNetwork: true
+  hostPorts:
+  - min: 1
+    max: 65536
+{{- end }}
diff --git a/stable/metrics-server/values.yaml b/stable/metrics-server/values.yaml
index c05332e98d..1b267fd43e 100644
--- a/stable/metrics-server/values.yaml
+++ b/stable/metrics-server/values.yaml
@@ -1,6 +1,7 @@
 rbac:
   # Specifies whether RBAC resources should be created
   create: true
+  pspEnabled: false
 
 serviceAccount:
   # Specifies whether a ServiceAccount should be created