[stable/metallb] Add PSP (#12369)

Signed-off-by: Maxime Guyot <maxime@root314.com>

stable/metallb/Chart.yaml

@@ -1,5 +1,5 @@
 apiVersion: v1
-version: 0.8.4
+version: 0.9.4
 
 name: metallb
 appVersion: 0.7.3

stable/metallb/templates/psp.yaml

@@ -0,0 +1,33 @@
+{{- if .Values.psp.create -}}
+
+apiVersion: extensions/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: {{ template "metallb.fullname" . }}-speaker
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: {{ template "metallb.chart" . }}
+    app: {{ template "metallb.name" . }}
+spec:
+  hostNetwork: true
+  hostPorts:
+  - min: 7472
+    max: 7472
+  privileged: true
+  allowPrivilegeEscalation: false
+  allowedCapabilities:
+  - 'NET_ADMIN'
+  - 'NET_RAW'
+  - 'SYS_ADMIN'
+  volumes:
+  - '*'
+  fsGroup:
+    rule: RunAsAny
+  runAsUser:
+    rule: RunAsAny
+  seLinux:
+    rule: RunAsAny
+  supplementalGroups:
+    rule: RunAsAny
+{{- end -}}

stable/metallb/values.yaml

@@ -40,6 +40,10 @@ rbac:
   # create specifies whether to install and use RBAC rules.
   create: true
 
+psp:
+  # create specifies whether to install and use Pod Security Policies.
+  create: true
+
 prometheus:
   # scrape annotations specifies whether to add Prometheus metric
   # auto-collection annotations to pods. See