From 614d3e7bfa976b6ce12aa6091fecdb889eb20cba Mon Sep 17 00:00:00 2001 From: Bort Verwilst Date: Wed, 29 Aug 2018 13:04:40 +0200 Subject: [PATCH] Nfs client provisioner (#7406) * Update version to 3.0.2 Signed-off-by: Bart Verwilst * Add PodSecurityPolicy support Signed-off-by: Bart Verwilst * update docs for psp Signed-off-by: Bart Verwilst * add serviceaccount docs Signed-off-by: Bart Verwilst --- stable/nfs-client-provisioner/Chart.yaml | 2 +- stable/nfs-client-provisioner/README.md | 26 +++++++++------- .../templates/clusterrole.yaml | 6 ++++ .../templates/podsecuritypolicy.yaml | 31 +++++++++++++++++++ stable/nfs-client-provisioner/values.yaml | 4 +++ 5 files changed, 57 insertions(+), 12 deletions(-) create mode 100644 stable/nfs-client-provisioner/templates/podsecuritypolicy.yaml diff --git a/stable/nfs-client-provisioner/Chart.yaml b/stable/nfs-client-provisioner/Chart.yaml index b5355c4172..58ac90c3a8 100644 --- a/stable/nfs-client-provisioner/Chart.yaml +++ b/stable/nfs-client-provisioner/Chart.yaml @@ -3,7 +3,7 @@ appVersion: 3.0.2 description: nfs-client is an automatic provisioner that used your *already configured* NFS server, automatically creating Persistent Volumes. name: nfs-client-provisioner home: https://github.com/kubernetes-incubator/external-storage/tree/master/nfs-client -version: 0.1.2 +version: 0.1.3 sources: - https://github.com/kubernetes-incubator/external-storage/tree/master/nfs-client maintainers: diff --git a/stable/nfs-client-provisioner/README.md b/stable/nfs-client-provisioner/README.md index e158de518b..63a319b821 100644 --- a/stable/nfs-client-provisioner/README.md +++ b/stable/nfs-client-provisioner/README.md @@ -45,17 +45,21 @@ The following tables lists the configurable parameters of this chart and their d | Parameter | Description | Default | | --------------------------------- | ------------------------------------- | --------------------------------------------------------- | -| `replicaCount` | number of provisioner instances to deployed | `1` | -| `strategyType` | specifies the strategy used to replace old Pods by new ones | `Recreate` | -| `image.repository` | provisioner image | `quay.io/external_storage/nfs-client-provisioner` | -| `image.tag` | version of provisioner image | `v3.0.2-k8s1.11` | -| `image.pullPolicy` | image pull policy | `IfNotPresent` | -| `storageclass.name` | name of the storageclass | `nfs-client` | +| `replicaCount` | Number of provisioner instances to deployed | `1` | +| `strategyType` | Specifies the strategy used to replace old Pods by new ones | `Recreate` | +| `image.repository` | Provisioner image | `quay.io/external_storage/nfs-client-provisioner` | +| `image.tag` | Version of provisioner image | `v3.0.2-k8s1.11` | +| `image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `storageclass.name` | Name of the storageclass | `nfs-client` | | `storageclass.defaultClass` | Set as the default StorageClass | `false` | | `storageclass.allowVolumeExpansion` | Allow expanding the volume | `true` | -| `storageclass.reclaimPolicy` | Method used to reclaim an obsoleted volume | `Delete` | -| `storageclass.provisionerName` | name of the provisionerName | null | -| `storageclass.archiveOnDelete` | archive pvc when deleting | `true` | -| `nfs.server` | hostname of the NFS server | null (ip or hostname) | -| `nfs.path` | basepath of the mount point to be used | `/ifs/kubernetes` | +| `storageclass.reclaimPolicy` | Method used to reclaim an obsoleted volume | `Delete` | +| `storageclass.provisionerName` | Name of the provisionerName | null | +| `storageclass.archiveOnDelete` | Archive pvc when deleting | `true` | +| `nfs.server` | Hostname of the NFS server | null (ip or hostname) | +| `nfs.path` | Basepath of the mount point to be used | `/ifs/kubernetes` | | `resources` | Resources required (e.g. CPU, memory) | `{}` | +| `rbac.create` | Use Role-based Access Control | `true` | +| `rbac.pspEnabled` | Create & use Pod Security Policy resources | `false` | +| `serviceAccount.create` | Should we create a ServiceAccount | `true` | +| `serviceAccount.name` | Name of the ServiceAccount to use | null | diff --git a/stable/nfs-client-provisioner/templates/clusterrole.yaml b/stable/nfs-client-provisioner/templates/clusterrole.yaml index ba09b3e5a6..a5b83795a5 100644 --- a/stable/nfs-client-provisioner/templates/clusterrole.yaml +++ b/stable/nfs-client-provisioner/templates/clusterrole.yaml @@ -23,3 +23,9 @@ rules: - apiGroups: [""] resources: ["endpoints"] verbs: ["get", "list", "watch", "create", "update", "patch"] +{{- if .Values.rbac.pspEnabled }} + - apiGroups: ['extensions'] + resources: ['podsecuritypolicies'] + verbs: ['use'] + resourceNames: [{{ template "nfs-client-provisioner.fullname" . }}] +{{- end }} diff --git a/stable/nfs-client-provisioner/templates/podsecuritypolicy.yaml b/stable/nfs-client-provisioner/templates/podsecuritypolicy.yaml new file mode 100644 index 0000000000..fb6d6ca821 --- /dev/null +++ b/stable/nfs-client-provisioner/templates/podsecuritypolicy.yaml @@ -0,0 +1,31 @@ +{{- if .Values.rbac.pspEnabled }} +apiVersion: extensions/v1beta1 +kind: PodSecurityPolicy +metadata: + name: {{ template "nfs-client-provisioner.fullname" . }} + labels: + app: {{ template "nfs-client-provisioner.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version }} + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} +spec: + privileged: false + allowPrivilegeEscalation: false + requiredDropCapabilities: + - ALL + volumes: + - 'secret' + - 'nfs' + hostNetwork: false + hostIPC: false + hostPID: false + runAsUser: + rule: 'RunAsAny' + seLinux: + rule: 'RunAsAny' + supplementalGroups: + rule: 'RunAsAny' + fsGroup: + rule: 'RunAsAny' + readOnlyRootFilesystem: false +{{- end }} diff --git a/stable/nfs-client-provisioner/values.yaml b/stable/nfs-client-provisioner/values.yaml index a307ba7467..95dfad414a 100644 --- a/stable/nfs-client-provisioner/values.yaml +++ b/stable/nfs-client-provisioner/values.yaml @@ -43,6 +43,10 @@ rbac: # Specifies whether RBAC resources should be created create: true + # If true, create & use Pod Security Policy resources + # https://kubernetes.io/docs/concepts/policy/pod-security-policy/ + pspEnabled: false + serviceAccount: # Specifies whether a ServiceAccount should be created create: true