From 37101eb0b8a55cd5f1571d3dec79d127ecc500fc Mon Sep 17 00:00:00 2001
From: dansible <danielpacrami@gmail.com>
Date: Thu, 2 May 2019 09:18:23 -0400
Subject: [PATCH] [stable/grafana] Add PSP, Role, RB & SA to test (#13205)

Signed-off-by: Daniel Pacrami <daniel.pacrami@sap.com>
---
 stable/grafana/Chart.yaml                     |  2 +-
 .../tests/test-podsecuritypolicy.yaml         | 31 +++++++++++++++++++
 stable/grafana/templates/tests/test-role.yaml | 16 ++++++++++
 .../templates/tests/test-rolebinding.yaml     | 19 ++++++++++++
 .../templates/tests/test-serviceaccount.yaml  |  9 ++++++
 stable/grafana/templates/tests/test.yaml      |  1 +
 6 files changed, 77 insertions(+), 1 deletion(-)
 create mode 100644 stable/grafana/templates/tests/test-podsecuritypolicy.yaml
 create mode 100644 stable/grafana/templates/tests/test-role.yaml
 create mode 100644 stable/grafana/templates/tests/test-rolebinding.yaml
 create mode 100644 stable/grafana/templates/tests/test-serviceaccount.yaml

diff --git a/stable/grafana/Chart.yaml b/stable/grafana/Chart.yaml
index d0b2f08852..3062f67df0 100755
--- a/stable/grafana/Chart.yaml
+++ b/stable/grafana/Chart.yaml
@@ -1,6 +1,6 @@
 apiVersion: v1
 name: grafana
-version: 3.3.5
+version: 3.3.6
 appVersion: 6.1.6
 kubeVersion: "^1.8.0-0"
 description: The leading tool for querying and visualizing time series and metrics.
diff --git a/stable/grafana/templates/tests/test-podsecuritypolicy.yaml b/stable/grafana/templates/tests/test-podsecuritypolicy.yaml
new file mode 100644
index 0000000000..1e8071581a
--- /dev/null
+++ b/stable/grafana/templates/tests/test-podsecuritypolicy.yaml
@@ -0,0 +1,31 @@
+{{- if .Values.rbac.pspEnabled }}
+apiVersion: extensions/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: {{ template "grafana.fullname" . }}-test
+  labels:
+    app: {{ template "grafana.name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+spec:
+  allowPrivilegeEscalation: true
+  privileged: false
+  hostNetwork: false
+  hostIPC: false
+  hostPID: false
+  fsGroup:
+    rule: RunAsAny
+  seLinux:
+    rule: RunAsAny
+  supplementalGroups:
+    rule: RunAsAny
+  runAsUser:
+    rule: RunAsAny
+  volumes:
+  - configMap
+  - downwardAPI
+  - emptyDir
+  - projected
+  - secret
+{{- end }}
diff --git a/stable/grafana/templates/tests/test-role.yaml b/stable/grafana/templates/tests/test-role.yaml
new file mode 100644
index 0000000000..e950046d4f
--- /dev/null
+++ b/stable/grafana/templates/tests/test-role.yaml
@@ -0,0 +1,16 @@
+{{- if .Values.rbac.pspEnabled -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ template "grafana.fullname" . }}-test
+  labels:
+    app: {{ template "grafana.name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+rules:
+- apiGroups:      ['policy']
+  resources:      ['podsecuritypolicies']
+  verbs:          ['use']
+  resourceNames:  [{{ template "grafana.fullname" . }}-test]
+{{- end }}
diff --git a/stable/grafana/templates/tests/test-rolebinding.yaml b/stable/grafana/templates/tests/test-rolebinding.yaml
new file mode 100644
index 0000000000..88f4dbc78e
--- /dev/null
+++ b/stable/grafana/templates/tests/test-rolebinding.yaml
@@ -0,0 +1,19 @@
+{{- if .Values.rbac.pspEnabled -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "grafana.fullname" . }}-test
+  labels:
+    app: {{ template "grafana.name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "grafana.fullname" . }}-test
+subjects:
+- kind: ServiceAccount
+  name: {{ template "grafana.serviceAccountName" . }}-test
+  namespace: {{ .Release.Namespace }}
+{{- end }}
diff --git a/stable/grafana/templates/tests/test-serviceaccount.yaml b/stable/grafana/templates/tests/test-serviceaccount.yaml
new file mode 100644
index 0000000000..8f56d23a9c
--- /dev/null
+++ b/stable/grafana/templates/tests/test-serviceaccount.yaml
@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app: {{ template "grafana.name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+  name: {{ template "grafana.serviceAccountName" . }}-test
diff --git a/stable/grafana/templates/tests/test.yaml b/stable/grafana/templates/tests/test.yaml
index f50bf29c12..47d3f14f50 100644
--- a/stable/grafana/templates/tests/test.yaml
+++ b/stable/grafana/templates/tests/test.yaml
@@ -10,6 +10,7 @@ metadata:
   annotations:
     "helm.sh/hook": test-success
 spec:
+  serviceAccountName: {{ template "grafana.serviceAccountName" . }}-test
   initContainers:
     - name: test-framework
       image: "{{ .Values.testFramework.image}}:{{ .Values.testFramework.tag }}"