From a07667bbe39eed6366ce73dfa1cb53bb8ef9d015 Mon Sep 17 00:00:00 2001 From: Michael Raimondi Date: Sun, 17 Jun 2018 15:33:29 -0400 Subject: [PATCH] [stable/prometheus-postgres-exporter] add RBAC resources (#6008) * add RBAC resources for clusters with the PodSecurityPolicy admission controller, every pod must have an associated PodSecurityPolicy * remove unneeded PVC permission * re-bump version --- .../prometheus-postgres-exporter/Chart.yaml | 2 +- stable/prometheus-postgres-exporter/README.md | 6 ++- .../templates/podsecuritypolicy.yaml | 39 +++++++++++++++++++ .../templates/role.yaml | 18 +++++++++ .../templates/rolebinding.yaml | 18 +++++++++ .../prometheus-postgres-exporter/values.yaml | 5 +++ 6 files changed, 85 insertions(+), 3 deletions(-) create mode 100644 stable/prometheus-postgres-exporter/templates/podsecuritypolicy.yaml create mode 100644 stable/prometheus-postgres-exporter/templates/role.yaml create mode 100644 stable/prometheus-postgres-exporter/templates/rolebinding.yaml diff --git a/stable/prometheus-postgres-exporter/Chart.yaml b/stable/prometheus-postgres-exporter/Chart.yaml index de696618c2..f5d1065a0d 100644 --- a/stable/prometheus-postgres-exporter/Chart.yaml +++ b/stable/prometheus-postgres-exporter/Chart.yaml @@ -2,7 +2,7 @@ apiVersion: v1 appVersion: "0.4.6" description: A Helm chart for prometheus postgres-exporter name: prometheus-postgres-exporter -version: 0.2.0 +version: 0.3.0 home: https://github.com/wrouesnel/postgres_exporter sources: - https://github.com/wrouesnel/postgres_exporter diff --git a/stable/prometheus-postgres-exporter/README.md b/stable/prometheus-postgres-exporter/README.md index 5a69f3859b..bc25f1bec3 100644 --- a/stable/prometheus-postgres-exporter/README.md +++ b/stable/prometheus-postgres-exporter/README.md @@ -41,12 +41,14 @@ The following table lists the configurable parameters of the postgres Exporter c | `image` | Image | `wrouesnel/postgres_exporter` | | `imageTag` | Image tag | `v0.4.6` | | `imagePullPolicy` | Image pull policy | `IfNotPresent` | -| `service.type` | Service type | `ClusterIP` | +| `service.type` | Service type | `ClusterIP` | | `service.port` | The service port | `80` | | `service.targetPort` | The target port of the container | `9187` | | `resources` | | `{}` | | `config.datasource` | Postgresql datasource configuration | | -| `config.queries` | SQL queries that the exporter will run | [postgres exporter defaults](https://github.com/wrouesnel/postgres_exporter/blob/master/queries.yaml) | +| `config.queries` | SQL queries that the exporter will run | [postgres exporter defaults](https://github.com/wrouesnel/postgres_exporter/blob/master/queries.yaml) | +| `rbac.create` | Specifies whether RBAC resources should be created.| `true` | +| `rbac.pspEnabled` | Specifies whether a PodSecurityPolicy should be created.| `true` | | `serviceAccount.create` | Specifies whether a service account should be created.| `true` | | `serviceAccount.name` | Name of the service account.| | | `tolerations` | Add tolerations | `[]` | diff --git a/stable/prometheus-postgres-exporter/templates/podsecuritypolicy.yaml b/stable/prometheus-postgres-exporter/templates/podsecuritypolicy.yaml new file mode 100644 index 0000000000..dce21e815f --- /dev/null +++ b/stable/prometheus-postgres-exporter/templates/podsecuritypolicy.yaml @@ -0,0 +1,39 @@ +{{- if .Values.rbac.pspEnabled }} +apiVersion: extensions/v1beta1 +kind: PodSecurityPolicy +metadata: + name: {{ template "prometheus-postgres-exporter.fullname" . }} + labels: + app: {{ template "prometheus-postgres-exporter.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version }} + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} + annotations: + seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default' + apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default' + seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default' + apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default' +spec: + privileged: false + allowPrivilegeEscalation: false + requiredDropCapabilities: + - ALL + volumes: + - 'configMap' + - 'emptyDir' + - 'projected' + - 'secret' + - 'downwardAPI' + hostNetwork: false + hostIPC: false + hostPID: false + runAsUser: + rule: 'RunAsAny' + seLinux: + rule: 'RunAsAny' + supplementalGroups: + rule: 'RunAsAny' + fsGroup: + rule: 'RunAsAny' + readOnlyRootFilesystem: false +{{- end }} diff --git a/stable/prometheus-postgres-exporter/templates/role.yaml b/stable/prometheus-postgres-exporter/templates/role.yaml new file mode 100644 index 0000000000..57b88d8d8b --- /dev/null +++ b/stable/prometheus-postgres-exporter/templates/role.yaml @@ -0,0 +1,18 @@ +{{- if .Values.rbac.create }} +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: Role +metadata: + name: {{ template "prometheus-postgres-exporter.fullname" . }} + labels: + app: {{ template "prometheus-postgres-exporter.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version }} + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} +{{- if .Values.rbac.pspEnabled }} +rules: +- apiGroups: ['extensions'] + resources: ['podsecuritypolicies'] + verbs: ['use'] + resourceNames: [{{ template "prometheus-postgres-exporter.fullname" . }}] +{{- end }} +{{- end }} diff --git a/stable/prometheus-postgres-exporter/templates/rolebinding.yaml b/stable/prometheus-postgres-exporter/templates/rolebinding.yaml new file mode 100644 index 0000000000..df9edaf5f2 --- /dev/null +++ b/stable/prometheus-postgres-exporter/templates/rolebinding.yaml @@ -0,0 +1,18 @@ +{{- if .Values.rbac.create -}} +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: RoleBinding +metadata: + name: {{ template "prometheus-postgres-exporter.fullname" . }} + labels: + app: {{ template "prometheus-postgres-exporter.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version }} + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ template "prometheus-postgres-exporter.fullname" . }} +subjects: +- kind: ServiceAccount + name: {{ template "prometheus-postgres-exporter.serviceAccountName" . }} +{{- end -}} diff --git a/stable/prometheus-postgres-exporter/values.yaml b/stable/prometheus-postgres-exporter/values.yaml index c84faa4b0b..885153d7ed 100644 --- a/stable/prometheus-postgres-exporter/values.yaml +++ b/stable/prometheus-postgres-exporter/values.yaml @@ -26,6 +26,11 @@ resources: {} # cpu: 100m # memory: 128Mi +rbac: + # Specifies whether RBAC resources should be created + create: true + # Specifies whether a PodSecurityPolicy should be created + pspEnabled: true serviceAccount: # Specifies whether a ServiceAccount should be created create: true