[incubator/patroni] RBAC role and rolebinding (#3899)

* RBAC role and rolebinding creation for Kubernetes 1.8+

* Lowercase RBAC and default to true

* Chart specific serviceaccount

* Updated README

incubator/patroni/Chart.yaml

@@ -1,7 +1,7 @@
 name: patroni
 description: 'Highly available elephant herd: HA PostgreSQL cluster.'
-version: 0.5.1
-appVersion: 1.2-p17
+version: 0.6
+appVersion: 1.3-p4
 home: https://github.com/zalando/patroni
 sources:
 - https://github.com/zalando/patroni

incubator/patroni/README.md

@@ -86,6 +86,9 @@ The following tables lists the configurable parameters of the patroni chart and
 | `persistentVolume.size` | Persistent Volume size | `2Gi` |
 | `persistentVolume.storageClass` | Persistent Volume Storage Class | `volume.alpha.kubernetes.io/storage-class: default` |
 | `persistentVolume.subPath` | Subdirectory of Persistent Volume to mount | `""` |
+| `rbac.create` | create required role and rolebindings | `true` |
+| `serviceAccount.create` | If true, create a new service account	| `true`
+| `serviceAccount.name` | Service account to be used. If not set and serviceAccount.create is `true`, a name is generated using the fullname template | ``  
 
 Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`.
 

incubator/patroni/templates/_helpers.tpl

@@ -7,3 +7,14 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
 {{- define "patroni.fullname" -}}
 {{- printf "%s-%s" .Release.Name .Values.Name | trunc 63 -}}
 {{- end -}}
+
+{{/*
+Create the name of the service account to use.
+*/}}
+{{- define "patroni.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create -}}
+    {{ default (include "patroni.fullname" .) .Values.serviceAccount.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccount.name }}
+{{- end -}}
+{{- end -}}

incubator/patroni/templates/role-patroni.yaml

@@ -0,0 +1,15 @@
+{{- if .Values.rbac.create }}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: Role
+metadata:
+  name: {{ template "patroni.fullname" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    component: "{{ .Release.Name }}-{{ .Values.Component }}"
+rules:
+  - apiGroups: [""]
+    resources: ["endpoints", "pods"]
+    verbs: ["patch"]
+{{- end }}

incubator/patroni/templates/rolebinding-patroni.yaml

@@ -0,0 +1,18 @@
+{{- if .Values.rbac.create }}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: RoleBinding
+metadata:
+  name: {{ template "patroni.fullname" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    component: "{{ .Release.Name }}-{{ .Values.Component }}"
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "patroni.serviceAccountName" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "patroni.fullname" . }}
+{{- end }}

incubator/patroni/templates/serviceaccount-patroni.yaml

@@ -0,0 +1,11 @@
+{{- if .Values.serviceAccount.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "patroni.serviceAccountName" . }}
+  labels:
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    component: "{{.Release.Name}}-{{.Values.Component}}"
+{{- end }}

incubator/patroni/templates/statefulset-patroni.yaml

@@ -25,6 +25,7 @@ spec:
           {{ $key }}: {{ $value | quote }}
         {{ end }}
       {{ end }}
+      serviceAccountName: {{ template "patroni.serviceAccountName" . }}
       containers:
       - name: spilo
         image: "{{ .Values.Spilo.Image }}:{{ .Values.Spilo.Version }}"

incubator/patroni/values.yaml

@@ -7,7 +7,7 @@ ImagePullPolicy: IfNotPresent
 Spilo:
   # this image was built from https://github.com/zalando/spilo/tree/master/postgres-appliance
   Image: registry.opensource.zalan.do/acid/spilo-9.6
-  Version: 1.2-p17
+  Version: 1.3-p4
 
 # How many postgres containers to spawn
 Replicas: 5
@@ -60,3 +60,14 @@ persistentVolume:
   annotations: {}
   accessModes:
     - ReadWriteOnce
+
+rbac:
+  # Specifies whether RBAC resources should be created
+  create: true
+
+serviceAccount:
+  # Specifies whether a ServiceAccount should be created
+  create: true
+  # The name of the ServiceAccount to use.
+  # If not set and create is true, a name is generated using the fullname template
+  name: