[stable/rethinkdb] Support rbac (#3436)

* Add rbac support to rethinkdb

* Bump version of rethinkdb chart

* Fix lint errors

* Update according to new RBAC best practices

* Add app, chart, release, heritage labels to ClusterRole and ClusterRoleBinding

* use template "rethinkdb.chart" for consistency

stable/rethinkdb/Chart.yaml

@@ -1,6 +1,6 @@
 name: rethinkdb
 description: The open-source database for the realtime web
-version: 0.1.0
+version: 0.1.1
 keywords:
 - rethinkdb
 - database

stable/rethinkdb/templates/_helpers.tpl

@@ -14,3 +14,21 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
 {{- $name := default .Chart.Name .Values.nameOverride -}}
 {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
 {{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "rethinkdb.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "rethinkdb.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create -}}
+    {{ default (include "rethinkdb.fullname" .) .Values.serviceAccount.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccount.name }}
+{{- end -}}
+{{- end -}}

stable/rethinkdb/templates/auth/clusterrole.yaml

@@ -0,0 +1,15 @@
+{{- if .Values.rbac.create -}}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRole
+metadata:
+  name: {{ template "rethinkdb.fullname" . }}
+  labels:
+    app: {{ template "rethinkdb.name" . }}
+    chart: {{ template "rethinkdb.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+rules:
+  - apiGroups: [""]
+    resources: ["endpoints"]
+    verbs: ["get", "list", "watch"]
+{{- end -}}

stable/rethinkdb/templates/auth/clusterrolebinding.yaml

@@ -0,0 +1,19 @@
+{{- if .Values.rbac.create -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "rethinkdb.fullname" . }}
+  labels:
+    app: {{ template "rethinkdb.name" . }}
+    chart: {{ template "rethinkdb.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "rethinkdb.fullname" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "rethinkdb.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end -}}

stable/rethinkdb/templates/auth/serviceaccount.yaml

@@ -0,0 +1,11 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "rethinkdb.serviceAccountName" . }}
+  labels:
+    app: {{ template "rethinkdb.name" . }}
+    chart: {{ template "rethinkdb.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+{{- end -}}

stable/rethinkdb/templates/rethinkdb-admin-service.yaml

@@ -4,7 +4,7 @@ metadata:
   name: "{{ template "rethinkdb.fullname" . }}-admin"
   labels:
     app: "{{ template "rethinkdb.name" . }}-admin"
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    chart: {{ template "rethinkdb.chart" . }}
     heritage: {{ .Release.Service | quote }}
     release: {{ .Release.Name | quote }}
 spec:

stable/rethinkdb/templates/rethinkdb-cluster-service.yaml

@@ -4,7 +4,7 @@ metadata:
   name: "{{ template "rethinkdb.fullname" . }}-cluster"
   labels:
     app: "{{ template "rethinkdb.name" . }}-cluster"
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    chart: {{ template "rethinkdb.chart" . }}
     heritage: {{ .Release.Service | quote }}
     release: {{ .Release.Name | quote }}
   annotations:

stable/rethinkdb/templates/rethinkdb-cluster-stateful-set.yaml

@@ -4,7 +4,7 @@ metadata:
   name: "{{ template "rethinkdb.fullname" . }}-cluster"
   labels:
     app: "{{ template "rethinkdb.name" . }}-cluster"
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    chart: {{ template "rethinkdb.chart" . }}
     heritage: {{ .Release.Service | quote }}
     release: {{ .Release.Name | quote }}
 spec:
@@ -17,12 +17,13 @@ spec:
         app: "{{ template "rethinkdb.name" . }}-cluster"
         heritage: {{ .Release.Service | quote }}
         release: {{ .Release.Name | quote }}
-        chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+        chart: {{ template "rethinkdb.chart" . }}
       annotations:
       {{- if .Values.cluster.podAnnotations }}
 {{ toYaml .Values.cluster.podAnnotations | indent 8 }}
       {{- end }}
     spec:
+      serviceAccountName: {{ template "rethinkdb.serviceAccountName" . }}
       containers:
         - name: {{ template "rethinkdb.name" . }}-cluster
           image: "{{ .Values.image.name }}:{{ .Values.image.tag }}"

stable/rethinkdb/templates/rethinkdb-cluster-storage-class.yaml

@@ -8,7 +8,7 @@ kind: StorageClass
 metadata:
   labels:
     app: "{{ template "rethinkdb.name" . }}-cluster"
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    chart: {{ template "rethinkdb.chart" . }}
     heritage: {{ .Release.Service | quote }}
     release: {{ .Release.Name | quote }}
   name: {{ template "rethinkdb.fullname" . }}

stable/rethinkdb/templates/rethinkdb-proxy-deployment.yaml

@@ -4,7 +4,7 @@ metadata:
   name: "{{ template "rethinkdb.fullname" . }}-proxy"
   labels:
     app: "{{ template "rethinkdb.name" . }}-proxy"
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    chart: {{ template "rethinkdb.chart" . }}
     heritage: {{ .Release.Service | quote }}
     release: {{ .Release.Name | quote }}
 spec:
@@ -16,12 +16,13 @@ spec:
         app: {{ template "rethinkdb.name" . }}-proxy
         heritage: {{ .Release.Service | quote }}
         release: {{ .Release.Name | quote }}
-        chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+        chart: {{ template "rethinkdb.chart" . }}
       annotations:
       {{- if .Values.proxy.podAnnotations }}
 {{ toYaml .Values.proxy.podAnnotations | indent 8 }}
       {{- end }}
     spec:
+      serviceAccountName: {{ template "rethinkdb.serviceAccountName" . }}
       containers:
         - name: {{ template "rethinkdb.name" . }}-proxy
           image: "{{ .Values.image.name }}:{{ .Values.image.tag }}"

stable/rethinkdb/templates/rethinkdb-proxy-service.yaml

@@ -4,7 +4,7 @@ metadata:
   name: {{ template "rethinkdb.fullname" . }}-proxy
   labels:
     app: {{ template "rethinkdb.name" . }}-proxy
-    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    chart: {{ template "rethinkdb.chart" . }}
     heritage: {{ .Release.Service }}
     release: {{ .Release.Name }}
   annotations:

stable/rethinkdb/templates/rethinkdb-secrets.yaml

@@ -4,7 +4,7 @@ metadata:
   name: {{ template "rethinkdb.fullname" . }}
   labels:
     app: {{ template "rethinkdb.name" . }}
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    chart: {{ template "rethinkdb.chart" . }}
     release: "{{ .Release.Name }}"
     heritage: "{{ .Release.Service }}"
 type: Opaque

stable/rethinkdb/values.yaml

@@ -25,7 +25,7 @@ cluster:
   persistentVolume:
     enabled: true
     # If defined, volume.beta.kubernetes.io/storage-class: <storageClass>
-    #storageClass: fast
+    # storageClass: fast
     accessModes:
       - ReadWriteOnce
     size: 1Gi
@@ -68,8 +68,19 @@ proxy:
 # RethinkDB Ports
 ports:
   cluster: 29015
-  driver:  28015
-  admin:   8080
+  driver: 28015
+  admin: 8080
 
 # RethinkDB Admin Password
 rethinkdbPassword: rethinkdb
+
+rbac:
+  # Specifies whether RBAC resources should be created
+  create: true
+
+serviceAccount:
+  # Specifies whether a ServiceAccount should be created
+  create: true
+  # The name of the ServiceAccount to use.
+  # If not set and create is true, a name is generated using the fullname template
+  name: