From 209f35bc512063fc54d84c592220ec01650df40e Mon Sep 17 00:00:00 2001
From: lcavajani <33934779+lcavajani@users.noreply.github.com>
Date: Thu, 25 Oct 2018 17:43:32 +0200
Subject: [PATCH] [stable/prometheus] Make pod annotations configurable for
 PodSecurityPolicy (#8746)

Signed-off-by: Ludovic Cavajani <lcavajani@suse.com>
---
 stable/prometheus/Chart.yaml                             | 2 +-
 stable/prometheus/README.md                              | 1 +
 .../templates/node-exporter-podsecuritypolicy.yaml       | 4 ++++
 stable/prometheus/values.yaml                            | 9 +++++++++
 4 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/stable/prometheus/Chart.yaml b/stable/prometheus/Chart.yaml
index 0331ac0f9d..d59360d946 100755
--- a/stable/prometheus/Chart.yaml
+++ b/stable/prometheus/Chart.yaml
@@ -1,5 +1,5 @@
 name: prometheus
-version: 7.3.3
+version: 7.3.4
 appVersion: 2.4.3
 description: Prometheus is a monitoring system and time series database.
 home: https://prometheus.io/
diff --git a/stable/prometheus/README.md b/stable/prometheus/README.md
index d49beb123c..4fc8146449 100644
--- a/stable/prometheus/README.md
+++ b/stable/prometheus/README.md
@@ -179,6 +179,7 @@ Parameter | Description | Default
 `nodeExporter.nodeSelector` | node labels for node-exporter pod assignment | `{}`
 `nodeExporter.podAnnotations` | annotations to be added to node-exporter pods | `{}`
 `nodeExporter.pod.labels` | labels to be added to node-exporter pods | `{}`
+`nodeExporter.podSecurityPolicy.annotations` | Specify pod annotations in the pod security policy | `{}` |
 `nodeExporter.podSecurityPolicy.enabled` | Specify if a Pod Security Policy for node-exporter must be created | `false`
 `nodeExporter.tolerations` | node taints to tolerate (requires Kubernetes >=1.6) | `[]`
 `nodeExporter.priorityClassName` | node-exporter priorityClassName | `nil`
diff --git a/stable/prometheus/templates/node-exporter-podsecuritypolicy.yaml b/stable/prometheus/templates/node-exporter-podsecuritypolicy.yaml
index 434e24c8ca..dce5cb1fef 100644
--- a/stable/prometheus/templates/node-exporter-podsecuritypolicy.yaml
+++ b/stable/prometheus/templates/node-exporter-podsecuritypolicy.yaml
@@ -10,6 +10,10 @@ metadata:
     component: "{{ .Values.nodeExporter.name }}"
     heritage: {{ .Release.Service }}
     release: {{ .Release.Name }}
+  annotations:
+{{- if .Values.nodeExporter.podSecurityPolicy.annotations }}
+{{ toYaml .Values.nodeExporter.podSecurityPolicy.annotations | indent 4 }}
+{{- end }}
 spec:
   privileged: false
   allowPrivilegeEscalation: false
diff --git a/stable/prometheus/values.yaml b/stable/prometheus/values.yaml
index 8c85a9c727..c4f60b1660 100644
--- a/stable/prometheus/values.yaml
+++ b/stable/prometheus/values.yaml
@@ -376,6 +376,15 @@ nodeExporter:
   ##
   podSecurityPolicy:
     enabled: False
+    annotations: {}
+      ## Specify pod annotations
+      ## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#apparmor
+      ## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#seccomp
+      ## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#sysctl
+      ##
+      # seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'
+      # seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default'
+      # apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
 
   ## node-exporter priorityClassName
   ##