github/deprecated-helm-charts
1
0
Fork 0
mirror of https://github.com/helm/charts.git synced 2026-08-23 22:37:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

[stable/redis] add RBAC (#5971)

Browse Source 
* [stable/redis] add RBAC

* [stable/redis] bump chart version

* [stable/redis] use "default" SA if SA is not defined
This commit is contained in:
Thierno IB. BARRY
2018-06-13 09:49:27 -07:00
committed by k8s-ci-robot
parent ab3b8e7e37
commit 247c852dfe
10 changed files with 85 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
stable/redis/Chart.yaml
+1 -1
View File
@@ -1,5 +1,5 @@
name: redis
version: 3.3.6
version: 3.4.0
appVersion: 4.0.9
description: Open source, advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets.
keywords:
stable/redis/README.md
+4
View File
@@ -63,6 +63,10 @@ The following table lists the configurable parameters of the Redis chart and the
| `password` | Redis password (ignored if existingSecret set) | Randomly generated |
| `networkPolicy.enabled` | Enable NetworkPolicy | `false` |
| `networkPolicy.allowExternal` | Don't require client label for connections | `true` |
| `serviceAccount.create` | Specifies whether a ServiceAccount should be created | `false` |
| `serviceAccount.name` | The name of the ServiceAccount to create | Generated using the fullname template |
| `rbac.create` | Specifies whether RBAC resources should be created | `false` |
| `rbac.role.rules` | Rules to create | `[]` |
| `metrics.enabled` | Start a side-car prometheus exporter | `false` |
| `metrics.image.registry` | Redis Image registry | `docker.io` |
| `metrics.image.repository` | Redis Image name | `bitnami/redis` |
stable/redis/templates/_helpers.tpl
+11
View File
@@ -117,3 +117,14 @@ securityContext:
{{- end }}
{{- end }}
{{- end -}}
{{/*
Create the name of the service account to use
*/}}
{{- define "redis.serviceAccountName" -}}
{{- if .Values.serviceAccount.create -}}
{{ default (include "redis.fullname" .) .Values.serviceAccount.name }}
{{- else -}}
{{ default "default" .Values.serviceAccount.name }}
{{- end -}}
{{- end -}}
stable/redis/templates/metrics-deployment.yaml
+1 -1
View File
@@ -45,7 +45,7 @@ spec:
- name: REDIS_ADDR
{{- if .Values.cluster.enabled }}
value: {{ printf "%s-master:%d,%s-slave:%d" ( include "redis.fullname" . ) ( int .Values.master.port ) ( include "redis.fullname" . ) ( .Values.slave.port | default .Values.master.port | int ) | quote }}
{{- else }}
{{- else }}
value: {{ printf "%s-master:%d" (include "redis.fullname" . ) (int .Values.master.port) | quote }}
{{- end }}
- name: REDIS_ALIAS
stable/redis/templates/redis-master-statefulset.yaml
+1
View File
@@ -39,6 +39,7 @@ spec:
fsGroup: {{ .Values.master.securityContext.fsGroup }}
runAsUser: {{ .Values.master.securityContext.runAsUser }}
{{- end }}
serviceAccountName: "{{ template "redis.serviceAccountName" . }}"
{{- if .Values.master.nodeSelector }}
nodeSelector:
{{ toYaml .Values.master.nodeSelector | indent 8 }}
stable/redis/templates/redis-role.yaml
+13
View File
@@ -0,0 +1,13 @@
{{- if and .Values.rbac.create .Values.rbac.role.rules -}}
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: {{ template "redis.fullname" . }}
labels:
app: {{ template "redis.name" . }}
chart: {{ template "redis.chart" . }}
release: "{{ .Release.Name }}"
heritage: "{{ .Release.Service }}"
rules:
{{ toYaml .Values.rbac.role.rules }}
{{- end -}}
stable/redis/templates/redis-rolebinding.yaml
+18
View File
@@ -0,0 +1,18 @@
{{- if .Values.rbac.create -}}
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: RoleBinding
metadata:
name: {{ template "redis.fullname" . }}
labels:
app: {{ template "redis.name" . }}
chart: {{ template "redis.chart" . }}
release: "{{ .Release.Name }}"
heritage: "{{ .Release.Service }}"
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: {{ template "redis.fullname" . }}
subjects:
- kind: ServiceAccount
name: {{ template "redis.serviceAccountName" . }}
{{- end -}}
stable/redis/templates/redis-serviceaccount.yaml
+11
View File
@@ -0,0 +1,11 @@
{{- if .Values.serviceAccount.create -}}
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ template "redis.serviceAccountName" . }}
labels:
app: {{ template "redis.name" . }}
chart: {{ template "redis.chart" . }}
release: "{{ .Release.Name }}"
heritage: "{{ .Release.Service }}"
{{- end -}}
stable/redis/templates/redis-slave-deployment.yaml
+1
View File
@@ -34,6 +34,7 @@ spec:
{{- end}}
{{- /* Include master securityContext if slave securityContext not defined */ -}}
{{ include "redis.slave.securityContext" . | indent 6 }}
serviceAccountName: "{{ template "redis.serviceAccountName" . }}"
{{- if (.Values.slave.nodeSelector | default .Values.master.nodeSelector) }}
nodeSelector:
{{ toYaml (.Values.slave.nodeSelector | default .Values.master.nodeSelector) | indent 8 }}
stable/redis/values.yaml
+24
View File
@@ -64,6 +64,30 @@ networkPolicy:
##
# allowExternal: true
serviceAccount:
# Specifies whether a ServiceAccount should be created
create: false
# The name of the ServiceAccount to use.
# If not set and create is true, a name is generated using the fullname template
name:
rbac:
# Specifies whether RBAC resources should be created
create: false
role:
## Rules to create. It follows the role specification
# rules:
# - apiGroups:
# - extensions
# resources:
# - podsecuritypolicies
# verbs:
# - use
# resourceNames:
# - gce.unprivileged
rules: []
## Redis password (both master and slave)
## Defaults to a random 10-character alphanumeric string if not set and usePassword is true
## ref: https://github.com/bitnami/bitnami-docker-redis#setting-the-server-password-on-first-run