[incubator/keycloak] Add rbac support (#3812)

* add default rbac role, rolebinding & serviceaccount

* set default rbac.create to true. Fixes #3661.

because pods-list is not available in the default role anymore since k8s 1.8

* tidy whitespace

* Change RBAC implementation based on best-practices

https://github.com/kubernetes/helm/blob/master/docs/chart_best_practices/rbac.md

* update README.md accordingly to new RBAC related values

incubator/keycloak/Chart.yaml

@@ -1,5 +1,5 @@
 name: keycloak
-version: 0.2.0
+version: 0.2.1
 appVersion: 3.4.0.Final
 description: Open Source Identity and Access Management For Modern Applications and Services
 keywords:

incubator/keycloak/README.md

@@ -86,6 +86,9 @@ Parameter | Description | Default
 `postgresql.postgresUser` | The PostgreSQL user (if `keycloak.persistence.deployPostgres=true`) | `keycloak`
 `postgresql.postgresPassword` | The PostgreSQL password (if `keycloak.persistence.deployPostgres=true`) | `""`
 `postgresql.postgresDatabase` | The PostgreSQL database (if `keycloak.persistence.deployPostgres=true`) | `keycloak`
+`rbac.create` | Specifies whether RBAC resources should be created | `true`
+`serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true`
+`serviceAccount.name` | The name of the ServiceAccount to use. If not set and create is true, a name is generated using the fullname template | `""`
 `test.image.repository` | Test image repository | `unguiculus/docker-python3-phantomjs-selenium`
 `test.image.tag` | Test image tag | `v1`
 `test.image.pullPolicy` | Test image pull policy | `IfNotPresent`

incubator/keycloak/templates/_helpers.tpl

@@ -95,3 +95,14 @@ Create environment variables for database configuration.
   value: {{ .Values.keycloak.persistence.dbName | quote }}
 {{- end }}
 {{- end -}}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "keycloak.serviceAccountName" -}}
+  {{- if .Values.serviceAccount.create -}}
+      {{ default (include "keycloak.fullname" .) .Values.serviceAccount.name }}
+  {{- else -}}
+      {{ default "default" .Values.serviceAccount.name }}
+  {{- end -}}
+{{- end -}}

incubator/keycloak/templates/rbac.yaml

@@ -0,0 +1,32 @@
+{{- if .Values.rbac.create -}}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: Role
+metadata:
+  name: {{ template "keycloak.fullname" . }}
+  labels:
+    app: {{ template "keycloak.fullname" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+rules:
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: RoleBinding
+metadata:
+  name: {{ template "keycloak.fullname" . }}
+  labels:
+    app: {{ template "keycloak.fullname" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "keycloak.fullname" . }}
+subjects:
+- kind: ServiceAccount
+  name: {{ template "keycloak.serviceAccountName" . }}
+{{- end -}}

incubator/keycloak/templates/serviceaccount.yaml

@@ -0,0 +1,11 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "keycloak.serviceAccountName" . }}
+  labels:
+    app: {{ template "keycloak.fullname" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+{{- end -}}

incubator/keycloak/templates/statefulset.yaml

@@ -21,6 +21,7 @@ spec:
         app: {{ template "keycloak.name" . }}
         release: "{{ .Release.Name }}"
     spec:
+      serviceAccountName: {{ template "keycloak.serviceAccountName" . }}
     {{- if .Values.keycloak.persistence.deployPostgres }}
       initContainers:
         - name: wait-for-postgresql

incubator/keycloak/values.yaml

@@ -183,6 +183,17 @@ postgresql:
     ##
     enabled: true
 
+rbac:
+  # Specifies whether RBAC resources should be created
+  create: true
+
+serviceAccount:
+  # Specifies whether a ServiceAccount should be created
+  create: true
+  # The name of the ServiceAccount to use.
+  # If not set and create is true, a name is generated using the fullname template
+  name: ""
+
 test:
   image:
     repository: unguiculus/docker-python3-phantomjs-selenium