diff --git a/stable/metallb/Chart.yaml b/stable/metallb/Chart.yaml index 74cd6ff6b2..7d3154d628 100644 --- a/stable/metallb/Chart.yaml +++ b/stable/metallb/Chart.yaml @@ -1,5 +1,5 @@ apiVersion: v1 -version: 0.8.4 +version: 0.9.4 name: metallb appVersion: 0.7.3 diff --git a/stable/metallb/templates/psp.yaml b/stable/metallb/templates/psp.yaml new file mode 100644 index 0000000000..bb7d465f30 --- /dev/null +++ b/stable/metallb/templates/psp.yaml @@ -0,0 +1,33 @@ +{{- if .Values.psp.create -}} + +apiVersion: extensions/v1beta1 +kind: PodSecurityPolicy +metadata: + name: {{ template "metallb.fullname" . }}-speaker + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: {{ template "metallb.chart" . }} + app: {{ template "metallb.name" . }} +spec: + hostNetwork: true + hostPorts: + - min: 7472 + max: 7472 + privileged: true + allowPrivilegeEscalation: false + allowedCapabilities: + - 'NET_ADMIN' + - 'NET_RAW' + - 'SYS_ADMIN' + volumes: + - '*' + fsGroup: + rule: RunAsAny + runAsUser: + rule: RunAsAny + seLinux: + rule: RunAsAny + supplementalGroups: + rule: RunAsAny +{{- end -}} diff --git a/stable/metallb/values.yaml b/stable/metallb/values.yaml index 2710054a8e..f618a59009 100644 --- a/stable/metallb/values.yaml +++ b/stable/metallb/values.yaml @@ -40,6 +40,10 @@ rbac: # create specifies whether to install and use RBAC rules. create: true +psp: + # create specifies whether to install and use Pod Security Policies. + create: true + prometheus: # scrape annotations specifies whether to add Prometheus metric # auto-collection annotations to pods. See