From a431bb9555e5634292b3cba167f0f4ee95d86f89 Mon Sep 17 00:00:00 2001
From: Kevin Lefevre <lefevre.kevin@gmail.com>
Date: Tue, 9 Jul 2019 11:58:03 +0200
Subject: [PATCH] [stable/sealed-secrets] Support PSP (#15254)

Support PSP with sensible default.

Signed-off-by: Kevin Lefevre <lefevre.kevin@gmail.com>
---
 stable/sealed-secrets/Chart.yaml              |  2 +-
 stable/sealed-secrets/README.md               |  1 +
 .../templates/psp-clusterrole.yaml            | 18 ++++++++++
 .../templates/psp-clusterrolebinding.yaml     | 20 +++++++++++
 stable/sealed-secrets/templates/psp.yaml      | 34 +++++++++++++++++++
 stable/sealed-secrets/values.yaml             |  1 +
 6 files changed, 75 insertions(+), 1 deletion(-)
 create mode 100644 stable/sealed-secrets/templates/psp-clusterrole.yaml
 create mode 100644 stable/sealed-secrets/templates/psp-clusterrolebinding.yaml
 create mode 100644 stable/sealed-secrets/templates/psp.yaml

diff --git a/stable/sealed-secrets/Chart.yaml b/stable/sealed-secrets/Chart.yaml
index eb1fedec62..cdcf4341b0 100644
--- a/stable/sealed-secrets/Chart.yaml
+++ b/stable/sealed-secrets/Chart.yaml
@@ -1,6 +1,6 @@
 name: sealed-secrets
 description: A Helm chart for Sealed Secrets
-version: 1.1.0
+version: 1.2.0
 appVersion: 0.7.0
 kubeVersion: ">=1.9.0-0"
 home: https://github.com/bitnami-labs/sealed-secrets
diff --git a/stable/sealed-secrets/README.md b/stable/sealed-secrets/README.md
index 94641ef9d7..458915bcdb 100644
--- a/stable/sealed-secrets/README.md
+++ b/stable/sealed-secrets/README.md
@@ -32,6 +32,7 @@ The command removes all the Kubernetes components associated with the chart and
 | Parameter | Description | Default |
 |----------:|:------------|:--------|
 | **rbac.create** | `true` if rbac resources should be created | `true` |
+| **rbac.pspEnabled** | `true` if psp resources should be created | `false` |
 | **serviceAccount.create** | Whether to create a service account or not | `true` |
 | **serviceAccount.name** | The name of the service account to create or use | `"sealed-secrets-controller"` |
 | **secretName** | The name of the TLS secret containing the key used to encrypt secrets | `"sealed-secrets-key"` |
diff --git a/stable/sealed-secrets/templates/psp-clusterrole.yaml b/stable/sealed-secrets/templates/psp-clusterrole.yaml
new file mode 100644
index 0000000000..051c830424
--- /dev/null
+++ b/stable/sealed-secrets/templates/psp-clusterrole.yaml
@@ -0,0 +1,18 @@
+{{- if .Values.rbac.pspEnabled }}
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ template "sealed-secrets.fullname" . }}-psp
+  labels:
+    app.kubernetes.io/name: {{ template "sealed-secrets.name" . }}
+    helm.sh/chart: {{ template "sealed-secrets.chart" . }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+rules:
+- apiGroups: ['extensions']
+  resources: ['podsecuritypolicies']
+  verbs:     ['use']
+  resourceNames:
+  - {{ template "sealed-secrets.fullname" . }}
+{{- end }}
diff --git a/stable/sealed-secrets/templates/psp-clusterrolebinding.yaml b/stable/sealed-secrets/templates/psp-clusterrolebinding.yaml
new file mode 100644
index 0000000000..b1a586af2e
--- /dev/null
+++ b/stable/sealed-secrets/templates/psp-clusterrolebinding.yaml
@@ -0,0 +1,20 @@
+{{- if .Values.rbac.pspEnabled }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "sealed-secrets.fullname" . }}-psp
+  labels:
+    app.kubernetes.io/name: {{ template "sealed-secrets.name" . }}
+    helm.sh/chart: {{ template "sealed-secrets.chart" . }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "sealed-secrets.fullname" . }}-psp
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "sealed-secrets.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end }}
diff --git a/stable/sealed-secrets/templates/psp.yaml b/stable/sealed-secrets/templates/psp.yaml
new file mode 100644
index 0000000000..df9d6e45b8
--- /dev/null
+++ b/stable/sealed-secrets/templates/psp.yaml
@@ -0,0 +1,34 @@
+{{- if .Values.rbac.pspEnabled }}
+apiVersion: extensions/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: {{ template "sealed-secrets.fullname" . }}
+  labels:
+    app.kubernetes.io/name: {{ template "sealed-secrets.name" . }}
+    helm.sh/chart: {{ template "sealed-secrets.chart" . }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+spec:
+  privileged: false
+  allowPrivilegeEscalation: false
+  allowedCapabilities: []
+  volumes:
+  - 'configMap'
+  - 'emptyDir'
+  - 'projected'
+  - 'secret'
+  - 'downwardAPI'
+  - 'persistentVolumeClaim'
+  hostNetwork: false
+  hostIPC: false
+  hostPID: false
+  runAsUser:
+    rule: 'RunAsAny'
+  seLinux:
+    rule: 'RunAsAny'
+  supplementalGroups:
+    rule: 'RunAsAny'
+  fsGroup:
+    rule: 'RunAsAny'
+{{- end }}
diff --git a/stable/sealed-secrets/values.yaml b/stable/sealed-secrets/values.yaml
index fcf5ef80f2..ee906e06e0 100644
--- a/stable/sealed-secrets/values.yaml
+++ b/stable/sealed-secrets/values.yaml
@@ -17,6 +17,7 @@ serviceAccount:
 rbac:
   # rbac.create: `true` if rbac resources should be created
   create: true
+  pspEnabled: false
 
 # secretName: The name of the TLS secret containing the key used to encrypt secrets
 secretName: "sealed-secrets-key"