updated chart to allow creation of resources in a monitoring namespace and support rbac. (#1393)

updated namespacing changes

review changes 1.

further pr changes.

updated version to 0.3, minor change due to rbac updates.

stable/sysdig/Chart.yaml

@@ -1,5 +1,5 @@
 name: sysdig
-version: 0.2.0
+version: 0.3.0
 description: Sysdig Monitor Agent.
 keywords:
   - monitoring

stable/sysdig/templates/daemonset.yaml

@@ -1,4 +1,5 @@
 {{- if .Values.sysdig.AccessKey }}
+---
 apiVersion: extensions/v1beta1
 kind: DaemonSet
 metadata:
@@ -38,6 +39,9 @@ spec:
       hostPID: true
       tolerations:
 {{ toYaml .Values.tolerations | indent 8 }}
+      {{- if .Values.rbac.install }}
+      serviceAccountName: {{ .Values.sysdig.serviceAccountName }}
+      {{- end }}
       containers:
       - name: {{ .Chart.Name }}
         image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
@@ -76,4 +80,4 @@ spec:
         - mountPath: /host/usr
           name: usr-vol
           readOnly: true
-{{ end }}
+{{- end }}

stable/sysdig/templates/rbac-resources.yaml

@@ -0,0 +1,33 @@
+{{- if and .Values.sysdig.AccessKey .Values.rbac.install }}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Values.sysdig.serviceAccountName }}
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/{{ .Values.rbac.apiVersion }}
+metadata:
+  name: sysdig-cluster-role
+rules:
+  - apiGroups: ["*"]
+    resources: ["*"]
+    verbs: ["*"]
+  - nonResourceURLs: ["*"]
+    verbs: ["*"]
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/{{ .Values.rbac.apiVersion }}
+metadata:
+  name: sysdig-cluster-role-binding
+  namespace: {{ .Release.Namespace }} # required
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Values.sysdig.serviceAccountName }}
+    namespace: {{ .Release.Namespace }} # required
+roleRef:
+  kind: ClusterRole
+  name: sysdig-cluster-role
+  apiGroup: rbac.authorization.k8s.io
+---
+{{- end }}

stable/sysdig/values.yaml

@@ -1,5 +1,11 @@
 # Default values for Sysdig Monitor Helm package.
 
+rbac:
+    # true here enables creation of rbac resources
+    install: false
+    # rbac version
+    apiVersion: v1beta1
+    
 image:
     repository: "sysdig/agent"
     tag: "latest"
@@ -12,6 +18,8 @@ sysdig:
     # Optional: Key-value agent tags following the format "key:val,key2:val2".
     AgentTags: ""
 
+    serviceAccountName: "sysdig-account"
+
 resources:
   requests:
     cpu: 100m