mirror of
https://github.com/helm/charts.git
synced 2026-08-23 22:37:45 +00:00
[stable/instana-agent] Add the ability to create a PodSecurityPolicy for the Instana Agent or use an existing one if specified (#17371)
Signed-off-by: Dahlia Bock <dlbock@gmail.com>
This commit is contained in:
Dahlia B
committed by
Kubernetes Prow Robot
Kubernetes Prow Robot
parent
fe0ac7aed5
commit
3cd5e8988e
@@ -1,6 +1,6 @@
|
||||
apiVersion: v1
|
||||
name: instana-agent
|
||||
version: 1.0.13
|
||||
version: 1.0.14
|
||||
appVersion: 1.0
|
||||
description: Instana Agent for Kubernetes
|
||||
home: https://www.instana.com/
|
||||
|
||||
@@ -8,7 +8,7 @@ This chart adds the Instana Agent to all schedulable nodes (e.g. by default, not
|
||||
|
||||
## Prerequisites
|
||||
|
||||
Kubernetes 1.8.x - 1.13.x
|
||||
Kubernetes 1.9.x - 1.14.x
|
||||
|
||||
Working `helm` and `tiller`.
|
||||
|
||||
@@ -100,8 +100,8 @@ The following table lists the configurable parameters of the Instana chart and t
|
||||
| `agent.image.tag` | The image tag to pull | `1.0.17` |
|
||||
| `agent.image.pullPolicy` | Image pull policy | `IfNotPresent` |
|
||||
| `agent.leaderElectorPort` | Instana leader elector sidecar port | `42655` |
|
||||
| `agent.endpointHost` | Instana agent backend endpoint host | `saas-us-west-2.instana.io` |
|
||||
| `agent.endpointPort` | Instana agent backend endpoint port | `443` |
|
||||
| `agent.endpointHost` | Instana Agent backend endpoint host | `saas-us-west-2.instana.io` |
|
||||
| `agent.endpointPort` | Instana Agent backend endpoint port | `443` |
|
||||
| `agent.downloadKey` | Your Instana Download key | `nil` You must provide your own download key |
|
||||
| `agent.mode` | Agent mode (Supported values are APM, INFRASTRUCTURE, AWS) | `APM` |
|
||||
| `agent.pod.annotations` | Additional annotations to apply to the pod | `{}` |
|
||||
@@ -122,6 +122,8 @@ The following table lists the configurable parameters of the Instana chart and t
|
||||
| `rbac.create` | Whether RBAC resources should be created | `true` |
|
||||
| `serviceAccount.create` | Whether a ServiceAccount should be created | `true` |
|
||||
| `serviceAccount.name` | Name of the ServiceAccount to use | `instana-agent` |
|
||||
| `podSecurityPolicy.enable` | Whether a PodSecurityPolicy should be authorized for the Instana Agent pods. Requires `rbac.create` to be `true` as well. | `false` See [PodSecurityPolicy](https://docs.instana.io/quick_start/agent_setup/container/kubernetes/#podsecuritypolicy) for more details. |
|
||||
| `podSecurityPolicy.name` | Name of an _existing_ PodSecurityPolicy to authorize for the Instana Agent pods. If not provided and `podSecurityPolicy.enable` is `true`, a PodSecurityPolicy will be created for you. | `nil` |
|
||||
|
||||
### Agent
|
||||
|
||||
@@ -130,4 +132,4 @@ To configure the agent, you can either:
|
||||
- edit the [config map](templates/configmap.yaml), or
|
||||
- provide the configuration via the `agent.configuration_yaml` parameter in [values.yaml](values.yaml)
|
||||
|
||||
This configuration will be used for all instana agents on all nodes. Visit the [agent configuration documentation](https://docs.instana.io/quick_start/agent_configuration/#configuration) for more details on configuration options.
|
||||
This configuration will be used for all Instana Agents on all nodes. Visit the [agent configuration documentation](https://docs.instana.io/quick_start/agent_configuration/#configuration) for more details on configuration options.
|
||||
|
||||
@@ -42,6 +42,15 @@ The name of the ServiceAccount used.
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
The name of the PodSecurityPolicy used.
|
||||
*/}}
|
||||
{{- define "instana-agent.podSecurityPolicyName" -}}
|
||||
{{- if .Values.podSecurityPolicy.enable -}}
|
||||
{{ default (include "instana-agent.fullname" .) .Values.podSecurityPolicy.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Add Helm metadata to resource labels.
|
||||
*/}}
|
||||
|
||||
@@ -41,4 +41,11 @@ rules:
|
||||
resources:
|
||||
- "endpoints"
|
||||
verbs: ["create", "update", "patch"]
|
||||
{{- if .Values.podSecurityPolicy.enable}}
|
||||
- apiGroups: ["extensions"]
|
||||
resources: ["podsecuritypolicies"]
|
||||
verbs: ["use"]
|
||||
resourceNames:
|
||||
- {{ template "instana-agent.podSecurityPolicyName" . }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
@@ -0,0 +1,48 @@
|
||||
{{- if .Values.rbac.create -}}
|
||||
{{- if (and .Values.podSecurityPolicy.enable (not .Values.podSecurityPolicy.name)) -}}
|
||||
kind: PodSecurityPolicy
|
||||
apiVersion: extensions/v1beta1
|
||||
metadata:
|
||||
name: {{ template "instana-agent.podSecurityPolicyName" . }}
|
||||
labels:
|
||||
{{- include "instana-agent.commonLabels" . | nindent 4 }}
|
||||
spec:
|
||||
privileged: true
|
||||
allowPrivilegeEscalation: true
|
||||
volumes:
|
||||
- configMap
|
||||
- downwardAPI
|
||||
- emptyDir
|
||||
- persistentVolumeClaim
|
||||
- secret
|
||||
- projected
|
||||
- hostPath
|
||||
allowedHostPaths:
|
||||
- pathPrefix: "/dev"
|
||||
readOnly: false
|
||||
- pathPrefix: "/run"
|
||||
readOnly: false
|
||||
- pathPrefix: "/var/run"
|
||||
readOnly: false
|
||||
- pathPrefix: "/sys"
|
||||
readOnly: false
|
||||
- pathPrefix: "/var/log"
|
||||
readOnly: false
|
||||
- pathPrefix: "/etc/machine-id"
|
||||
readOnly: false
|
||||
hostNetwork: true
|
||||
hostPorts:
|
||||
- min: 0
|
||||
max: 65535
|
||||
hostIPC: true
|
||||
hostPID: true
|
||||
runAsUser:
|
||||
rule: "RunAsAny"
|
||||
seLinux:
|
||||
rule: "RunAsAny"
|
||||
supplementalGroups:
|
||||
rule: "RunAsAny"
|
||||
fsGroup:
|
||||
rule: "RunAsAny"
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -76,9 +76,17 @@ serviceAccount:
|
||||
# Specifies whether a ServiceAccount should be created
|
||||
create: true
|
||||
# The name of the ServiceAccount to use.
|
||||
# If not set and create is true, a name is generated using the fullname template
|
||||
# If not set and `create` is true, a name is generated using the fullname template
|
||||
# name: instana-agent
|
||||
|
||||
podSecurityPolicy:
|
||||
# Specifies whether a PodSecurityPolicy should be authorized for the Instana Agent pods.
|
||||
# Requires `rbac.create` to be `true` as well.
|
||||
enable: false
|
||||
# The name of an existing PodSecurityPolicy you would like to authorize for the Instana Agent pods.
|
||||
# If not set and `enable` is true, a PodSecurityPolicy will be created with a name generated using the fullname template.
|
||||
name: null
|
||||
|
||||
cluster:
|
||||
# cluster.name represents the name that will be assigned to this cluster in Instana
|
||||
name: null
|
||||
|
||||
Reference in New Issue
Block a user