diff --git a/stable/redis/Chart.yaml b/stable/redis/Chart.yaml index d24b49abd4..a24700a4ca 100644 --- a/stable/redis/Chart.yaml +++ b/stable/redis/Chart.yaml @@ -1,5 +1,5 @@ name: redis -version: 3.3.6 +version: 3.4.0 appVersion: 4.0.9 description: Open source, advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. keywords: diff --git a/stable/redis/README.md b/stable/redis/README.md index e8a5ecc242..6ec5ccfd1b 100644 --- a/stable/redis/README.md +++ b/stable/redis/README.md @@ -63,6 +63,10 @@ The following table lists the configurable parameters of the Redis chart and the | `password` | Redis password (ignored if existingSecret set) | Randomly generated | | `networkPolicy.enabled` | Enable NetworkPolicy | `false` | | `networkPolicy.allowExternal` | Don't require client label for connections | `true` | +| `serviceAccount.create` | Specifies whether a ServiceAccount should be created | `false` | +| `serviceAccount.name` | The name of the ServiceAccount to create | Generated using the fullname template | +| `rbac.create` | Specifies whether RBAC resources should be created | `false` | +| `rbac.role.rules` | Rules to create | `[]` | | `metrics.enabled` | Start a side-car prometheus exporter | `false` | | `metrics.image.registry` | Redis Image registry | `docker.io` | | `metrics.image.repository` | Redis Image name | `bitnami/redis` | diff --git a/stable/redis/templates/_helpers.tpl b/stable/redis/templates/_helpers.tpl index 62b4d268ab..af5aada511 100644 --- a/stable/redis/templates/_helpers.tpl +++ b/stable/redis/templates/_helpers.tpl @@ -117,3 +117,14 @@ securityContext: {{- end }} {{- end }} {{- end -}} + +{{/* +Create the name of the service account to use +*/}} +{{- define "redis.serviceAccountName" -}} +{{- if .Values.serviceAccount.create -}} + {{ default (include "redis.fullname" .) .Values.serviceAccount.name }} +{{- else -}} + {{ default "default" .Values.serviceAccount.name }} +{{- end -}} +{{- end -}} diff --git a/stable/redis/templates/metrics-deployment.yaml b/stable/redis/templates/metrics-deployment.yaml index f0ce18fe28..5d7d1b4f95 100644 --- a/stable/redis/templates/metrics-deployment.yaml +++ b/stable/redis/templates/metrics-deployment.yaml @@ -45,7 +45,7 @@ spec: - name: REDIS_ADDR {{- if .Values.cluster.enabled }} value: {{ printf "%s-master:%d,%s-slave:%d" ( include "redis.fullname" . ) ( int .Values.master.port ) ( include "redis.fullname" . ) ( .Values.slave.port | default .Values.master.port | int ) | quote }} - {{- else }} + {{- else }} value: {{ printf "%s-master:%d" (include "redis.fullname" . ) (int .Values.master.port) | quote }} {{- end }} - name: REDIS_ALIAS diff --git a/stable/redis/templates/redis-master-statefulset.yaml b/stable/redis/templates/redis-master-statefulset.yaml index bf05ca79f6..a24c399bea 100644 --- a/stable/redis/templates/redis-master-statefulset.yaml +++ b/stable/redis/templates/redis-master-statefulset.yaml @@ -39,6 +39,7 @@ spec: fsGroup: {{ .Values.master.securityContext.fsGroup }} runAsUser: {{ .Values.master.securityContext.runAsUser }} {{- end }} + serviceAccountName: "{{ template "redis.serviceAccountName" . }}" {{- if .Values.master.nodeSelector }} nodeSelector: {{ toYaml .Values.master.nodeSelector | indent 8 }} diff --git a/stable/redis/templates/redis-role.yaml b/stable/redis/templates/redis-role.yaml new file mode 100644 index 0000000000..26e04b727b --- /dev/null +++ b/stable/redis/templates/redis-role.yaml @@ -0,0 +1,13 @@ +{{- if and .Values.rbac.create .Values.rbac.role.rules -}} +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ template "redis.fullname" . }} + labels: + app: {{ template "redis.name" . }} + chart: {{ template "redis.chart" . }} + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" +rules: +{{ toYaml .Values.rbac.role.rules }} +{{- end -}} diff --git a/stable/redis/templates/redis-rolebinding.yaml b/stable/redis/templates/redis-rolebinding.yaml new file mode 100644 index 0000000000..3a641097e5 --- /dev/null +++ b/stable/redis/templates/redis-rolebinding.yaml @@ -0,0 +1,18 @@ +{{- if .Values.rbac.create -}} +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: RoleBinding +metadata: + name: {{ template "redis.fullname" . }} + labels: + app: {{ template "redis.name" . }} + chart: {{ template "redis.chart" . }} + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ template "redis.fullname" . }} +subjects: +- kind: ServiceAccount + name: {{ template "redis.serviceAccountName" . }} +{{- end -}} diff --git a/stable/redis/templates/redis-serviceaccount.yaml b/stable/redis/templates/redis-serviceaccount.yaml new file mode 100644 index 0000000000..392fb3f015 --- /dev/null +++ b/stable/redis/templates/redis-serviceaccount.yaml @@ -0,0 +1,11 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "redis.serviceAccountName" . }} + labels: + app: {{ template "redis.name" . }} + chart: {{ template "redis.chart" . }} + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" +{{- end -}} diff --git a/stable/redis/templates/redis-slave-deployment.yaml b/stable/redis/templates/redis-slave-deployment.yaml index 6e69013ee2..f3ee1f7cdb 100644 --- a/stable/redis/templates/redis-slave-deployment.yaml +++ b/stable/redis/templates/redis-slave-deployment.yaml @@ -34,6 +34,7 @@ spec: {{- end}} {{- /* Include master securityContext if slave securityContext not defined */ -}} {{ include "redis.slave.securityContext" . | indent 6 }} + serviceAccountName: "{{ template "redis.serviceAccountName" . }}" {{- if (.Values.slave.nodeSelector | default .Values.master.nodeSelector) }} nodeSelector: {{ toYaml (.Values.slave.nodeSelector | default .Values.master.nodeSelector) | indent 8 }} diff --git a/stable/redis/values.yaml b/stable/redis/values.yaml index 8cd5e84511..8f751a7ae7 100644 --- a/stable/redis/values.yaml +++ b/stable/redis/values.yaml @@ -64,6 +64,30 @@ networkPolicy: ## # allowExternal: true +serviceAccount: + # Specifies whether a ServiceAccount should be created + create: false + # The name of the ServiceAccount to use. + # If not set and create is true, a name is generated using the fullname template + name: + +rbac: + # Specifies whether RBAC resources should be created + create: false + + role: + ## Rules to create. It follows the role specification + # rules: + # - apiGroups: + # - extensions + # resources: + # - podsecuritypolicies + # verbs: + # - use + # resourceNames: + # - gce.unprivileged + rules: [] + ## Redis password (both master and slave) ## Defaults to a random 10-character alphanumeric string if not set and usePassword is true ## ref: https://github.com/bitnami/bitnami-docker-redis#setting-the-server-password-on-first-run