From 4bf69283dcf9cbd914b7d696a8e7cc7d89ca65b8 Mon Sep 17 00:00:00 2001
From: Alejandro Escobar <jaescobar.cell@gmail.com>
Date: Wed, 19 Jul 2017 08:44:03 -0700
Subject: [PATCH] updated chart to allow creation of resources in a monitoring
 namespace and support rbac. (#1393)

updated namespacing changes

review changes 1.

further pr changes.

updated version to 0.3, minor change due to rbac updates.
---
 stable/sysdig/Chart.yaml                    |  2 +-
 stable/sysdig/templates/daemonset.yaml      |  6 +++-
 stable/sysdig/templates/rbac-resources.yaml | 33 +++++++++++++++++++++
 stable/sysdig/values.yaml                   |  8 +++++
 4 files changed, 47 insertions(+), 2 deletions(-)
 create mode 100644 stable/sysdig/templates/rbac-resources.yaml

diff --git a/stable/sysdig/Chart.yaml b/stable/sysdig/Chart.yaml
index 9c67229901..e070a11640 100755
--- a/stable/sysdig/Chart.yaml
+++ b/stable/sysdig/Chart.yaml
@@ -1,5 +1,5 @@
 name: sysdig
-version: 0.2.0
+version: 0.3.0
 description: Sysdig Monitor Agent.
 keywords:
   - monitoring
diff --git a/stable/sysdig/templates/daemonset.yaml b/stable/sysdig/templates/daemonset.yaml
index 6e7a32b980..a8d804c401 100644
--- a/stable/sysdig/templates/daemonset.yaml
+++ b/stable/sysdig/templates/daemonset.yaml
@@ -1,4 +1,5 @@
 {{- if .Values.sysdig.AccessKey }}
+---
 apiVersion: extensions/v1beta1
 kind: DaemonSet
 metadata:
@@ -38,6 +39,9 @@ spec:
       hostPID: true
       tolerations:
 {{ toYaml .Values.tolerations | indent 8 }}
+      {{- if .Values.rbac.install }}
+      serviceAccountName: {{ .Values.sysdig.serviceAccountName }}
+      {{- end }}
       containers:
       - name: {{ .Chart.Name }}
         image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
@@ -76,4 +80,4 @@ spec:
         - mountPath: /host/usr
           name: usr-vol
           readOnly: true
-{{ end }}
+{{- end }}
diff --git a/stable/sysdig/templates/rbac-resources.yaml b/stable/sysdig/templates/rbac-resources.yaml
new file mode 100644
index 0000000000..55efc2a357
--- /dev/null
+++ b/stable/sysdig/templates/rbac-resources.yaml
@@ -0,0 +1,33 @@
+{{- if and .Values.sysdig.AccessKey .Values.rbac.install }}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Values.sysdig.serviceAccountName }}
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/{{ .Values.rbac.apiVersion }}
+metadata:
+  name: sysdig-cluster-role
+rules:
+  - apiGroups: ["*"]
+    resources: ["*"]
+    verbs: ["*"]
+  - nonResourceURLs: ["*"]
+    verbs: ["*"]
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/{{ .Values.rbac.apiVersion }}
+metadata:
+  name: sysdig-cluster-role-binding
+  namespace: {{ .Release.Namespace }} # required
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Values.sysdig.serviceAccountName }}
+    namespace: {{ .Release.Namespace }} # required
+roleRef:
+  kind: ClusterRole
+  name: sysdig-cluster-role
+  apiGroup: rbac.authorization.k8s.io
+---
+{{- end }}
diff --git a/stable/sysdig/values.yaml b/stable/sysdig/values.yaml
index 763c089884..74c453c161 100644
--- a/stable/sysdig/values.yaml
+++ b/stable/sysdig/values.yaml
@@ -1,5 +1,11 @@
 # Default values for Sysdig Monitor Helm package.
 
+rbac:
+    # true here enables creation of rbac resources
+    install: false
+    # rbac version
+    apiVersion: v1beta1
+    
 image:
     repository: "sysdig/agent"
     tag: "latest"
@@ -12,6 +18,8 @@ sysdig:
     # Optional: Key-value agent tags following the format "key:val,key2:val2".
     AgentTags: ""
 
+    serviceAccountName: "sysdig-account"
+
 resources:
   requests:
     cpu: 100m