mirror of
https://github.com/helm/charts.git
synced 2026-08-23 22:37:45 +00:00
Add PodSecurityPolicy support (#10480)
Signed-off-by: Derek Heldt-Werle <derek.heldt-werle@viasat.com>
This commit is contained in:
DerekHeldtWerle
committed by
Kubernetes Prow Robot
Kubernetes Prow Robot
parent
3c951bbae7
commit
2ab1981ea0
@@ -5,7 +5,7 @@ keywords:
|
||||
- metric
|
||||
- monitoring
|
||||
- prometheus
|
||||
version: 0.12.2
|
||||
version: 0.13.0
|
||||
appVersion: 1.4.0
|
||||
home: https://github.com/kubernetes/kube-state-metrics/
|
||||
sources:
|
||||
|
||||
@@ -20,11 +20,13 @@ $ helm install stable/kube-state-metrics
|
||||
| `service.port` | The port of the container | 8080 |
|
||||
| `prometheusScrape` | Whether or not enable prom scrape | true |
|
||||
| `rbac.create` | If true, create & use RBAC resources | true |
|
||||
| `podSecurityPolicy.enabled` | If true, create & use PodSecurityPolicy resources | false |
|
||||
| `podSecurityPolicy.annotations` | Specify pod annotations in the pod security policy | {} |
|
||||
| `rbac.serviceAccountName` | ServiceAccount to be used (ignored if rbac.create=true) | default |
|
||||
| `securityContext.enabled` | Enable security context | `true` |
|
||||
| `securityContext.fsGroup` | Group ID for the container | `65534` |
|
||||
| `securityContext.runAsUser` | User ID for the container | `65534` |
|
||||
| `priorityClassName` | Name of Priority Class to assign pods | `nil` |
|
||||
| `priorityClassName` | Name of Priority Class to assign pods | `nil` |
|
||||
| `nodeSelector` | Node labels for pod assignment | {} |
|
||||
| `tolerations` | Tolerations for pod assignment | [] |
|
||||
| `podAnnotations` | Annotations to be added to the pod | {} |
|
||||
|
||||
@@ -0,0 +1,39 @@
|
||||
{{- if .Values.podSecurityPolicy.enabled }}
|
||||
apiVersion: extensions/v1beta1
|
||||
kind: PodSecurityPolicy
|
||||
metadata:
|
||||
name: {{ template "kube-state-metrics.fullname" . }}
|
||||
labels:
|
||||
app: {{ template "kube-state-metrics.name" . }}
|
||||
chart: {{ .Chart.Name }}-{{ .Chart.Version }}
|
||||
heritage: {{ .Release.Service }}
|
||||
release: {{ .Release.Name }}
|
||||
annotations:
|
||||
{{- if .Values.podSecurityPolicy.annotations }}
|
||||
{{ toYaml .Values.podSecurityPolicy.annotations | indent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
privileged: false
|
||||
volumes:
|
||||
- 'secret'
|
||||
hostNetwork: false
|
||||
hostIPC: false
|
||||
hostPID: false
|
||||
runAsUser:
|
||||
rule: 'MustRunAsNonRoot'
|
||||
seLinux:
|
||||
rule: 'RunAsAny'
|
||||
supplementalGroups:
|
||||
rule: 'MustRunAs'
|
||||
ranges:
|
||||
# Forbid adding the root group.
|
||||
- min: 1
|
||||
max: 65535
|
||||
fsGroup:
|
||||
rule: 'MustRunAs'
|
||||
ranges:
|
||||
# Forbid adding the root group.
|
||||
- min: 1
|
||||
max: 65535
|
||||
readOnlyRootFilesystem: false
|
||||
{{- end }}
|
||||
@@ -0,0 +1,21 @@
|
||||
{{- if and .Values.podSecurityPolicy.enabled -}}
|
||||
kind: ClusterRole
|
||||
{{- if .Capabilities.APIVersions.Has "rbac.authorization.k8s.io/v1beta1" }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||
{{- else if .Capabilities.APIVersions.Has "rbac.authorization.k8s.io/v1alpha1" }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1alpha1
|
||||
{{- end }}
|
||||
metadata:
|
||||
labels:
|
||||
app: {{ template "kube-state-metrics.name" . }}
|
||||
chart: {{ .Chart.Name }}-{{ .Chart.Version }}
|
||||
heritage: {{ .Release.Service }}
|
||||
release: {{ .Release.Name }}
|
||||
name: psp-{{ template "kube-state-metrics.fullname" . }}
|
||||
rules:
|
||||
- apiGroups: ['extensions']
|
||||
resources: ['podsecuritypolicies']
|
||||
verbs: ['use']
|
||||
resourceNames:
|
||||
- {{ template "kube-state-metrics.fullname" . }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,23 @@
|
||||
{{- if and .Values.podSecurityPolicy.enabled -}}
|
||||
{{- if .Capabilities.APIVersions.Has "rbac.authorization.k8s.io/v1beta1" }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||
{{- else if .Capabilities.APIVersions.Has "rbac.authorization.k8s.io/v1alpha1" }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1alpha1
|
||||
{{- end }}
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app: {{ template "kube-state-metrics.name" . }}
|
||||
chart: {{ .Chart.Name }}-{{ .Chart.Version }}
|
||||
heritage: {{ .Release.Service }}
|
||||
release: {{ .Release.Name }}
|
||||
name: psp-{{ template "kube-state-metrics.fullname" . }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: psp-{{ template "kube-state-metrics.fullname" . }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "kube-state-metrics.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
@@ -16,6 +16,22 @@ rbac:
|
||||
# Ignored if rbac.create is true
|
||||
serviceAccountName: default
|
||||
|
||||
## Specify if a Pod Security Policy for kube-state-metrics must be created
|
||||
## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/
|
||||
##
|
||||
podSecurityPolicy:
|
||||
enabled: false
|
||||
annotations: {}
|
||||
## Specify pod annotations
|
||||
## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#apparmor
|
||||
## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#seccomp
|
||||
## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#sysctl
|
||||
##
|
||||
# seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'
|
||||
# seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default'
|
||||
# apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
|
||||
|
||||
|
||||
securityContext:
|
||||
enabled: true
|
||||
runAsUser: 65534
|
||||
|
||||
Reference in New Issue
Block a user