Added RBAC support and updated Pachyderm version to 1.7.0 (#4520)

stable/pachyderm/Chart.yaml

@@ -10,8 +10,8 @@ keywords:
   - reproducibility
   - distributed
   - processing
-version: 0.1.5
-appVersion: 1.6.7
+version: 0.1.6
+appVersion: 1.7.0
 home: "https://pachyderm.io"
 sources:
   - "https://github.com/pachyderm/pachyderm"

stable/pachyderm/README.md

@@ -19,6 +19,7 @@ The following table lists the configurable parameters of `pachd` and their defau
 
 | Parameter                | Description           | Default           |
 |--------------------------|-----------------------|-------------------|
+| `rbac.create`            | Enable RBAC           | `true`            |
 | `pachd.image.repository` | Container image name  | `pachyderm/pachd` |
 | `pachd.pfsCache`         | File System cache size| `0G`              |
 | `*.image.tag`            | Container image tag   | `<latest version>`|
@@ -100,7 +101,7 @@ Based on the storage credentials used, fill in the corresponding parameters for
 How to install the chart
 ------------------------
 
-We strongly suggest that the installation of Pachyderm should be performed in its own namespace. The default installation will deploy Pachyderm on your local Kubernetes cluster:
+We strongly suggest that the installation of Pachyderm should be performed in its own namespace. Note that you should have RBAC enabled in your cluster to make the installation work with the default settings. The default installation will deploy Pachyderm on your local Kubernetes cluster:
 
 ```console
 $ helm install --namespace pachyderm --name my-release stable/pachyderm
@@ -130,7 +131,7 @@ In order to use Pachyderm, please login through ssh to the master node and insta
 $ curl -o /tmp/pachctl.deb -L https://github.com/pachyderm/pachyderm/releases/download/v1.6.7/pachctl_1.6.7_amd64.deb && sudo dpkg -i /tmp/pachctl.deb
 ```
 
-Please note that the client version should correspond with the pachd service version. For more information please consult: http://pachyderm.readthedocs.io/en/latest/index.html. Also, if you have your kubernetes client properly configured to talk with your remote cluster, you can simply install `pachctl` on your local machine and execute: `pachctl -k '-n=<namespace>' port-forward &`.
+Please note that the client version should correspond with the pachd service version. For more information please consult: http://pachyderm.readthedocs.io/en/latest/index.html. Also, if you have your kubernetes client properly configured to talk with your remote cluster, you can simply install `pachctl` on your local machine and execute: `pachctl --namespace <namespace> port-forward &`.
 
 Clean-up
 -------

stable/pachyderm/templates/NOTES.txt

@@ -6,13 +6,13 @@ $ curl -o /tmp/pachctl.deb -L https://github.com/pachyderm/pachyderm/releases/do
 
 And on Mac:
 
-$ brew tap pachyderm/tap && brew install pachyderm/tap/pachctl@1.6
+$ brew tap pachyderm/tap && brew install pachyderm/tap/pachctl@1.7
 
 To check that installation was successful, you can try running pachctl help, which should return a list of Pachyderm commands.  
 
 If you install the client on your master node, you should already be able to interact with the service. Also, if you have your kubernetes client properly configured to talk with your remote cluster, you can simply install pachctl on your local machine and execute: 
 
-$ pachctl -k '-n={{ .Release.Namespace }}' port-forward & .
+$ pachctl --namespace={{ .Release.Namespace }} port-forward &
 
 To check if port forwarding was successfully completed, try:
 

stable/pachyderm/templates/pachd_role.yaml

@@ -0,0 +1,48 @@
+---
+{{- if .Values.rbac.create }}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: Role
+metadata:
+  name: pachyderm
+  creationTimestamp: 
+  labels:
+    app: ''
+    suite: pachyderm
+rules:
+- verbs:
+  - get
+  - list
+  - watch
+  apiGroups:
+  - ''
+  resources:
+  - nodes
+  - pods
+  - pods/log
+  - endpoints
+- verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - delete
+  apiGroups:
+  - ''
+  resources:
+  - replicationcontrollers
+  - services
+- verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - delete
+  apiGroups:
+  - ''
+  resources:
+  - secrets
+  resourceNames:
+  - pachyderm-storage-secret
+{{- end }}

stable/pachyderm/templates/pachd_rolebinding.yaml

@@ -0,0 +1,15 @@
+---
+{{- if .Values.rbac.create }}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: RoleBinding
+metadata:
+  name: pachyderm
+roleRef:
+  apiGroup: ''
+  kind: Role
+  name: pachyderm
+subjects:
+  - kind: ServiceAccount
+    name: pachyderm
+    namespace: {{ .Release.Namespace }}
+{{- end }}

stable/pachyderm/values.yaml

@@ -1,4 +1,8 @@
 ---
+rbac:
+ # Specifies whether RBAC resources should be created
+ create: true
+
 ## Set default credentials for object store
 credentials: "local"
 
@@ -42,11 +46,11 @@ pachd:
  ## For available images please check: https://hub.docker.com/r/pachyderm/pachd/tags/
  image:
   repository: pachyderm/pachd
-  tag: 1.6.7
+  tag: 1.7.0
   pullPolicy: Always
  worker:
   repository: pachyderm/worker
-  tag: 1.6.7
+  tag: 1.7.0
  resources:
   ## For non-local deployments, 1 cpu and 2G of memory requests are recommended
   requests: