[stable/nginx-ingress] Add PodSecurityPolicy support (#7466)

* Add PodSecurityPolicy support

Signed-off-by: Bart Verwilst <bart@verwilst.be>

* fix trailing spaces

Signed-off-by: Bart Verwilst <bart@verwilst.be>

* add labels to psp

Signed-off-by: Bart Verwilst <bart@verwilst.be>

* fix hostPorts array

Signed-off-by: Bart Verwilst <bart@verwilst.be>

* configurable by podSecurityPolicy.enable

Signed-off-by: Bart Verwilst <bart@verwilst.be>

* bump version

Signed-off-by: Bart Verwilst <bart@verwilst.be>

* fix trailing space

Signed-off-by: Bart Verwilst <bart@verwilst.be>

* fix conditionals

Signed-off-by: Bart Verwilst <bart@verwilst.be>

* add ci test for podsecurity

Signed-off-by: Bart Verwilst <bart@verwilst.be>

stable/nginx-ingress/Chart.yaml

@@ -1,5 +1,5 @@
 name: nginx-ingress
-version: 0.27.0
+version: 0.28.0
 appVersion: 0.19.0
 home: https://github.com/kubernetes/ingress-nginx
 description: An nginx Ingress controller that uses ConfigMap to store the nginx configuration.

stable/nginx-ingress/README.md

@@ -149,6 +149,7 @@ Parameter | Description | Default
 `defaultBackend.service.type` | type of default backend service to create | `ClusterIP`
 `imagePullSecrets` | name of Secret resource containing private registry credentials | `nil`
 `rbac.create` | if `true`, create & use RBAC resources | `true`
+`podSecurityPolicy.enabled` | if `true`, create & use Pod Security Policy resources | `false`
 `serviceAccount.create` | if `true`, create a service account | ``
 `serviceAccount.name` | The name of the service account to use. If not set and `create` is `true`, a name is generated using the fullname template. | ``
 `revisionHistoryLimit` | The number of old history to retain to allow rollback. | `10`

stable/nginx-ingress/ci/psp-values.yaml

@@ -0,0 +1,2 @@
+podSecurityPolicy:
+  enabled: true

stable/nginx-ingress/templates/podsecuritypolicy.yaml

@@ -0,0 +1,47 @@
+{{- if .Values.podSecurityPolicy.enabled}}
+apiVersion: extensions/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: {{ template "nginx-ingress.fullname" . }} 
+  labels:
+    app: {{ template "nginx-ingress.name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+spec:
+  allowedCapabilities:
+    - NET_BIND_SERVICE
+  privileged: false
+  allowPrivilegeEscalation: true
+  # Allow core volume types.
+  volumes:
+    - 'configMap'
+    #- 'emptyDir'
+    #- 'projected'
+    - 'secret'
+    #- 'downwardAPI'
+  hostNetwork: false
+  hostIPC: false
+  hostPID: false
+  runAsUser:
+    # Require the container to run without root privileges.
+    rule: 'MustRunAsNonRoot'
+  supplementalGroups:
+    rule: 'MustRunAs'
+    ranges:
+      # Forbid adding the root group.
+      - min: 1
+        max: 65535
+  fsGroup:
+    rule: 'MustRunAs'
+    ranges:
+      # Forbid adding the root group.
+      - min: 1
+        max: 65535
+  readOnlyRootFilesystem: false
+  seLinux:
+    rule: 'RunAsAny'
+  hostPorts:
+    - max: 65535
+      min: 1
+{{- end }}

stable/nginx-ingress/templates/role.yaml

@@ -79,4 +79,11 @@ rules:
     verbs:
       - create
       - patch
+{{- if .Values.podSecurityPolicy.enabled }}
+  - apiGroups:      ['extensions']
+    resources:      ['podsecuritypolicies']
+    verbs:          ['use']
+    resourceNames:  [{{ template "nginx-ingress.fullname" . }}]
+{{- end }}
+
 {{- end -}}

stable/nginx-ingress/values.yaml

@@ -354,6 +354,11 @@ defaultBackend:
 rbac:
   create: true
 
+# If true, create & use Pod Security Policy resources
+# https://kubernetes.io/docs/concepts/policy/pod-security-policy/
+podSecurityPolicy:
+  enabled: false
+
 serviceAccount:
   create: true
   name: