diff --git a/stable/kube-state-metrics/Chart.yaml b/stable/kube-state-metrics/Chart.yaml index 3b0bad43d1..e64bcad98e 100644 --- a/stable/kube-state-metrics/Chart.yaml +++ b/stable/kube-state-metrics/Chart.yaml @@ -5,7 +5,7 @@ keywords: - metric - monitoring - prometheus -version: 0.12.2 +version: 0.13.0 appVersion: 1.4.0 home: https://github.com/kubernetes/kube-state-metrics/ sources: diff --git a/stable/kube-state-metrics/README.md b/stable/kube-state-metrics/README.md index 3f4d6d044a..d751dc46c1 100644 --- a/stable/kube-state-metrics/README.md +++ b/stable/kube-state-metrics/README.md @@ -20,11 +20,13 @@ $ helm install stable/kube-state-metrics | `service.port` | The port of the container | 8080 | | `prometheusScrape` | Whether or not enable prom scrape | true | | `rbac.create` | If true, create & use RBAC resources | true | +| `podSecurityPolicy.enabled` | If true, create & use PodSecurityPolicy resources | false | +| `podSecurityPolicy.annotations` | Specify pod annotations in the pod security policy | {} | | `rbac.serviceAccountName` | ServiceAccount to be used (ignored if rbac.create=true) | default | | `securityContext.enabled` | Enable security context | `true` | | `securityContext.fsGroup` | Group ID for the container | `65534` | | `securityContext.runAsUser` | User ID for the container | `65534` | -| `priorityClassName` | Name of Priority Class to assign pods | `nil` | +| `priorityClassName` | Name of Priority Class to assign pods | `nil` | | `nodeSelector` | Node labels for pod assignment | {} | | `tolerations` | Tolerations for pod assignment | [] | | `podAnnotations` | Annotations to be added to the pod | {} | diff --git a/stable/kube-state-metrics/templates/podsecuritypolicy.yaml b/stable/kube-state-metrics/templates/podsecuritypolicy.yaml new file mode 100644 index 0000000000..d195a5fdaf --- /dev/null +++ b/stable/kube-state-metrics/templates/podsecuritypolicy.yaml @@ -0,0 +1,39 @@ +{{- if .Values.podSecurityPolicy.enabled }} +apiVersion: extensions/v1beta1 +kind: PodSecurityPolicy +metadata: + name: {{ template "kube-state-metrics.fullname" . }} + labels: + app: {{ template "kube-state-metrics.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version }} + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} + annotations: +{{- if .Values.podSecurityPolicy.annotations }} +{{ toYaml .Values.podSecurityPolicy.annotations | indent 4 }} +{{- end }} +spec: + privileged: false + volumes: + - 'secret' + hostNetwork: false + hostIPC: false + hostPID: false + runAsUser: + rule: 'MustRunAsNonRoot' + seLinux: + rule: 'RunAsAny' + supplementalGroups: + rule: 'MustRunAs' + ranges: + # Forbid adding the root group. + - min: 1 + max: 65535 + fsGroup: + rule: 'MustRunAs' + ranges: + # Forbid adding the root group. + - min: 1 + max: 65535 + readOnlyRootFilesystem: false +{{- end }} diff --git a/stable/kube-state-metrics/templates/psp-clusterrole.yaml b/stable/kube-state-metrics/templates/psp-clusterrole.yaml new file mode 100644 index 0000000000..bdc774af7d --- /dev/null +++ b/stable/kube-state-metrics/templates/psp-clusterrole.yaml @@ -0,0 +1,21 @@ +{{- if and .Values.podSecurityPolicy.enabled -}} +kind: ClusterRole +{{- if .Capabilities.APIVersions.Has "rbac.authorization.k8s.io/v1beta1" }} +apiVersion: rbac.authorization.k8s.io/v1beta1 +{{- else if .Capabilities.APIVersions.Has "rbac.authorization.k8s.io/v1alpha1" }} +apiVersion: rbac.authorization.k8s.io/v1alpha1 +{{- end }} +metadata: + labels: + app: {{ template "kube-state-metrics.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version }} + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} + name: psp-{{ template "kube-state-metrics.fullname" . }} +rules: +- apiGroups: ['extensions'] + resources: ['podsecuritypolicies'] + verbs: ['use'] + resourceNames: + - {{ template "kube-state-metrics.fullname" . }} +{{- end }} diff --git a/stable/kube-state-metrics/templates/psp-clusterrolebinding.yaml b/stable/kube-state-metrics/templates/psp-clusterrolebinding.yaml new file mode 100644 index 0000000000..611a9a2464 --- /dev/null +++ b/stable/kube-state-metrics/templates/psp-clusterrolebinding.yaml @@ -0,0 +1,23 @@ +{{- if and .Values.podSecurityPolicy.enabled -}} +{{- if .Capabilities.APIVersions.Has "rbac.authorization.k8s.io/v1beta1" }} +apiVersion: rbac.authorization.k8s.io/v1beta1 +{{- else if .Capabilities.APIVersions.Has "rbac.authorization.k8s.io/v1alpha1" }} +apiVersion: rbac.authorization.k8s.io/v1alpha1 +{{- end }} +kind: ClusterRoleBinding +metadata: + labels: + app: {{ template "kube-state-metrics.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version }} + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} + name: psp-{{ template "kube-state-metrics.fullname" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: psp-{{ template "kube-state-metrics.fullname" . }} +subjects: + - kind: ServiceAccount + name: {{ template "kube-state-metrics.fullname" . }} + namespace: {{ .Release.Namespace }} +{{- end }} diff --git a/stable/kube-state-metrics/values.yaml b/stable/kube-state-metrics/values.yaml index 626b17d9e2..7d6448501c 100644 --- a/stable/kube-state-metrics/values.yaml +++ b/stable/kube-state-metrics/values.yaml @@ -16,6 +16,22 @@ rbac: # Ignored if rbac.create is true serviceAccountName: default +## Specify if a Pod Security Policy for kube-state-metrics must be created +## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/ +## +podSecurityPolicy: + enabled: false + annotations: {} + ## Specify pod annotations + ## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#apparmor + ## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#seccomp + ## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#sysctl + ## + # seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*' + # seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default' + # apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default' + + securityContext: enabled: true runAsUser: 65534