[stable/prometheus] Make pod annotations configurable for PodSecurityPolicy (#8746)

Signed-off-by: Ludovic Cavajani <lcavajani@suse.com>

stable/prometheus/Chart.yaml

@@ -1,5 +1,5 @@
 name: prometheus
-version: 7.3.3
+version: 7.3.4
 appVersion: 2.4.3
 description: Prometheus is a monitoring system and time series database.
 home: https://prometheus.io/

stable/prometheus/README.md

@@ -179,6 +179,7 @@ Parameter | Description | Default
 `nodeExporter.nodeSelector` | node labels for node-exporter pod assignment | `{}`
 `nodeExporter.podAnnotations` | annotations to be added to node-exporter pods | `{}`
 `nodeExporter.pod.labels` | labels to be added to node-exporter pods | `{}`
+`nodeExporter.podSecurityPolicy.annotations` | Specify pod annotations in the pod security policy | `{}` |
 `nodeExporter.podSecurityPolicy.enabled` | Specify if a Pod Security Policy for node-exporter must be created | `false`
 `nodeExporter.tolerations` | node taints to tolerate (requires Kubernetes >=1.6) | `[]`
 `nodeExporter.priorityClassName` | node-exporter priorityClassName | `nil`

stable/prometheus/templates/node-exporter-podsecuritypolicy.yaml

@@ -10,6 +10,10 @@ metadata:
     component: "{{ .Values.nodeExporter.name }}"
     heritage: {{ .Release.Service }}
     release: {{ .Release.Name }}
+  annotations:
+{{- if .Values.nodeExporter.podSecurityPolicy.annotations }}
+{{ toYaml .Values.nodeExporter.podSecurityPolicy.annotations | indent 4 }}
+{{- end }}
 spec:
   privileged: false
   allowPrivilegeEscalation: false

stable/prometheus/values.yaml

@@ -376,6 +376,15 @@ nodeExporter:
   ##
   podSecurityPolicy:
     enabled: False
+    annotations: {}
+      ## Specify pod annotations
+      ## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#apparmor
+      ## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#seccomp
+      ## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#sysctl
+      ##
+      # seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'
+      # seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default'
+      # apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
 
   ## node-exporter priorityClassName
   ##