From 8db0c744a8a1186da4e1c3befbde3a1e570d44a7 Mon Sep 17 00:00:00 2001 From: Hidde Beydals Date: Thu, 1 Mar 2018 06:54:55 +0100 Subject: [PATCH] [incubator/patroni] RBAC role and rolebinding (#3899) * RBAC role and rolebinding creation for Kubernetes 1.8+ * Lowercase RBAC and default to true * Chart specific serviceaccount * Updated README --- incubator/patroni/Chart.yaml | 4 ++-- incubator/patroni/README.md | 3 +++ incubator/patroni/templates/_helpers.tpl | 11 +++++++++++ incubator/patroni/templates/role-patroni.yaml | 15 +++++++++++++++ .../patroni/templates/rolebinding-patroni.yaml | 18 ++++++++++++++++++ .../templates/serviceaccount-patroni.yaml | 11 +++++++++++ .../patroni/templates/statefulset-patroni.yaml | 1 + incubator/patroni/values.yaml | 13 ++++++++++++- 8 files changed, 73 insertions(+), 3 deletions(-) create mode 100644 incubator/patroni/templates/role-patroni.yaml create mode 100644 incubator/patroni/templates/rolebinding-patroni.yaml create mode 100644 incubator/patroni/templates/serviceaccount-patroni.yaml diff --git a/incubator/patroni/Chart.yaml b/incubator/patroni/Chart.yaml index bc27ff29c9..7f3fdc71a5 100644 --- a/incubator/patroni/Chart.yaml +++ b/incubator/patroni/Chart.yaml @@ -1,7 +1,7 @@ name: patroni description: 'Highly available elephant herd: HA PostgreSQL cluster.' -version: 0.5.1 -appVersion: 1.2-p17 +version: 0.6 +appVersion: 1.3-p4 home: https://github.com/zalando/patroni sources: - https://github.com/zalando/patroni diff --git a/incubator/patroni/README.md b/incubator/patroni/README.md index 4b3a4e2e37..0c8f5e7463 100644 --- a/incubator/patroni/README.md +++ b/incubator/patroni/README.md @@ -86,6 +86,9 @@ The following tables lists the configurable parameters of the patroni chart and | `persistentVolume.size` | Persistent Volume size | `2Gi` | | `persistentVolume.storageClass` | Persistent Volume Storage Class | `volume.alpha.kubernetes.io/storage-class: default` | | `persistentVolume.subPath` | Subdirectory of Persistent Volume to mount | `""` | +| `rbac.create` | create required role and rolebindings | `true` | +| `serviceAccount.create` | If true, create a new service account | `true` +| `serviceAccount.name` | Service account to be used. If not set and serviceAccount.create is `true`, a name is generated using the fullname template | `` Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. diff --git a/incubator/patroni/templates/_helpers.tpl b/incubator/patroni/templates/_helpers.tpl index 03319951e2..5dc18ed65a 100644 --- a/incubator/patroni/templates/_helpers.tpl +++ b/incubator/patroni/templates/_helpers.tpl @@ -7,3 +7,14 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this {{- define "patroni.fullname" -}} {{- printf "%s-%s" .Release.Name .Values.Name | trunc 63 -}} {{- end -}} + +{{/* +Create the name of the service account to use. +*/}} +{{- define "patroni.serviceAccountName" -}} +{{- if .Values.serviceAccount.create -}} + {{ default (include "patroni.fullname" .) .Values.serviceAccount.name }} +{{- else -}} + {{ default "default" .Values.serviceAccount.name }} +{{- end -}} +{{- end -}} diff --git a/incubator/patroni/templates/role-patroni.yaml b/incubator/patroni/templates/role-patroni.yaml new file mode 100644 index 0000000000..9786146d28 --- /dev/null +++ b/incubator/patroni/templates/role-patroni.yaml @@ -0,0 +1,15 @@ +{{- if .Values.rbac.create }} +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: Role +metadata: + name: {{ template "patroni.fullname" . }} + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + component: "{{ .Release.Name }}-{{ .Values.Component }}" +rules: + - apiGroups: [""] + resources: ["endpoints", "pods"] + verbs: ["patch"] +{{- end }} diff --git a/incubator/patroni/templates/rolebinding-patroni.yaml b/incubator/patroni/templates/rolebinding-patroni.yaml new file mode 100644 index 0000000000..5c8dcc6aba --- /dev/null +++ b/incubator/patroni/templates/rolebinding-patroni.yaml @@ -0,0 +1,18 @@ +{{- if .Values.rbac.create }} +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: RoleBinding +metadata: + name: {{ template "patroni.fullname" . }} + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + component: "{{ .Release.Name }}-{{ .Values.Component }}" +subjects: + - kind: ServiceAccount + name: {{ template "patroni.serviceAccountName" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ template "patroni.fullname" . }} +{{- end }} diff --git a/incubator/patroni/templates/serviceaccount-patroni.yaml b/incubator/patroni/templates/serviceaccount-patroni.yaml new file mode 100644 index 0000000000..ff9e062c9a --- /dev/null +++ b/incubator/patroni/templates/serviceaccount-patroni.yaml @@ -0,0 +1,11 @@ +{{- if .Values.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "patroni.serviceAccountName" . }} + labels: + heritage: {{ .Release.Service | quote }} + release: {{ .Release.Name | quote }} + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + component: "{{.Release.Name}}-{{.Values.Component}}" +{{- end }} diff --git a/incubator/patroni/templates/statefulset-patroni.yaml b/incubator/patroni/templates/statefulset-patroni.yaml index 0402379f06..4e6a259a52 100644 --- a/incubator/patroni/templates/statefulset-patroni.yaml +++ b/incubator/patroni/templates/statefulset-patroni.yaml @@ -25,6 +25,7 @@ spec: {{ $key }}: {{ $value | quote }} {{ end }} {{ end }} + serviceAccountName: {{ template "patroni.serviceAccountName" . }} containers: - name: spilo image: "{{ .Values.Spilo.Image }}:{{ .Values.Spilo.Version }}" diff --git a/incubator/patroni/values.yaml b/incubator/patroni/values.yaml index 09d6b36220..31a5b2ac36 100644 --- a/incubator/patroni/values.yaml +++ b/incubator/patroni/values.yaml @@ -7,7 +7,7 @@ ImagePullPolicy: IfNotPresent Spilo: # this image was built from https://github.com/zalando/spilo/tree/master/postgres-appliance Image: registry.opensource.zalan.do/acid/spilo-9.6 - Version: 1.2-p17 + Version: 1.3-p4 # How many postgres containers to spawn Replicas: 5 @@ -60,3 +60,14 @@ persistentVolume: annotations: {} accessModes: - ReadWriteOnce + +rbac: + # Specifies whether RBAC resources should be created + create: true + +serviceAccount: + # Specifies whether a ServiceAccount should be created + create: true + # The name of the ServiceAccount to use. + # If not set and create is true, a name is generated using the fullname template + name: