From b05e749688f2c53f76cc5cdcdc06c02acdf24aaf Mon Sep 17 00:00:00 2001 From: Cees-Jan Kiewiet Date: Thu, 26 Dec 2019 16:47:38 +0100 Subject: [PATCH] [stable/telegraf] Configurable service account (#19456) * [stable/telegraf] Configurable service account By default the telegraf service runs with the default RBAC permissions this PR adds the option to create a service account with configurable rules. Signed-off-by: Cees-Jan Kiewiet * [stable/telegraf] Move RBAD flag one level up Co-Authored-By: Naseem Signed-off-by: Cees-Jan Kiewiet * [stable/telegraf] Align templates with charts Signed-off-by: Cees-Jan Kiewiet * [stable/telegraf] Update RBAC deployment conditional Signed-off-by: Cees-Jan Kiewiet * [stable/telegraf] Make role and binding kind configurable Signed-off-by: Cees-Jan Kiewiet * [stable/telegraf] Move comments about values Signed-off-by: Cees-Jan Kiewiet * [stable/telegraf] Simplify (cluster)role values Signed-off-by: Cees-Jan Kiewiet * [stable/telegraf] prometheus input rules example Signed-off-by: Cees-Jan Kiewiet * [stable/telegraf] Applied @naseemkullah suggestions Signed-off-by: Cees-Jan Kiewiet * [stable/telegraf] Corrected bad copy pasta Signed-off-by: Cees-Jan Kiewiet Co-authored-by: Naseem --- stable/telegraf/Chart.yaml | 2 +- stable/telegraf/templates/_helpers.tpl | 11 +++++ stable/telegraf/templates/deployment.yaml | 3 +- stable/telegraf/templates/role.yaml | 13 ++++++ stable/telegraf/templates/rolebinding.yaml | 22 +++++++++ stable/telegraf/templates/serviceaccount.yaml | 11 +++++ stable/telegraf/values.yaml | 46 +++++++++++++++++++ 7 files changed, 106 insertions(+), 2 deletions(-) create mode 100644 stable/telegraf/templates/role.yaml create mode 100644 stable/telegraf/templates/rolebinding.yaml create mode 100644 stable/telegraf/templates/serviceaccount.yaml diff --git a/stable/telegraf/Chart.yaml b/stable/telegraf/Chart.yaml index 261dbfee01..e132073e84 100755 --- a/stable/telegraf/Chart.yaml +++ b/stable/telegraf/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: telegraf -version: 1.4.0 +version: 1.5.0 appVersion: 1.12 deprecated: false description: Telegraf is an agent written in Go for collecting, processing, aggregating, and writing metrics. diff --git a/stable/telegraf/templates/_helpers.tpl b/stable/telegraf/templates/_helpers.tpl index 804b26660d..cf9db81186 100644 --- a/stable/telegraf/templates/_helpers.tpl +++ b/stable/telegraf/templates/_helpers.tpl @@ -334,3 +334,14 @@ Create chart name and version as used by the chart label. {{ end }} {{- end }} {{- end -}} + +{{/* +Create the name of the service account to use +*/}} +{{- define "telegraf.serviceAccountName" -}} +{{- if .Values.serviceAccount.create -}} + {{ default (include "telegraf.fullname" .) .Values.serviceAccount.name }} +{{- else -}} + {{ default "default" .Values.serviceAccount.name }} +{{- end -}} +{{- end -}} diff --git a/stable/telegraf/templates/deployment.yaml b/stable/telegraf/templates/deployment.yaml index 5b48a1b559..3094ebfe59 100644 --- a/stable/telegraf/templates/deployment.yaml +++ b/stable/telegraf/templates/deployment.yaml @@ -23,6 +23,7 @@ spec: {{ toYaml .Values.podAnnotations | indent 8 }} {{- end }} spec: + serviceAccountName: {{ template "telegraf.serviceAccountName" . }} containers: - name: {{ .Chart.Name }} image: "{{ .Values.image.repo }}:{{ .Values.image.tag }}" @@ -30,7 +31,7 @@ spec: resources: {{ toYaml .Values.resources | indent 10 }} env: -{{ toYaml .Values.env | indent 8 }} +{{ toYaml .Values.env | indent 8 }} volumeMounts: - name: config mountPath: /etc/telegraf diff --git a/stable/telegraf/templates/role.yaml b/stable/telegraf/templates/role.yaml new file mode 100644 index 0000000000..08c69ef263 --- /dev/null +++ b/stable/telegraf/templates/role.yaml @@ -0,0 +1,13 @@ +{{- if .Values.rbac.create }} +apiVersion: rbac.authorization.k8s.io/v1beta1 +{{- if .Values.rbac.clusterWide }} +kind: ClusterRole +{{- else }} +kind: Role +{{- end }} +metadata: + name: {{ template "telegraf.fullname" . }} + namespace: {{ .Release.Namespace }} +rules: +{{ toYaml .Values.rbac.rules | indent 2 }} +{{- end }} \ No newline at end of file diff --git a/stable/telegraf/templates/rolebinding.yaml b/stable/telegraf/templates/rolebinding.yaml new file mode 100644 index 0000000000..49dcd66031 --- /dev/null +++ b/stable/telegraf/templates/rolebinding.yaml @@ -0,0 +1,22 @@ +{{- if .Values.rbac.create }} +apiVersion: rbac.authorization.k8s.io/v1beta1 +{{- if .Values.rbac.clusterWide }} +kind: ClusterRoleBinding +{{- else }} +kind: RoleBinding +{{- end }} +metadata: + name: {{ template "telegraf.fullname" . }} +subjects: + - kind: ServiceAccount + name: {{ template "telegraf.fullname" . }} + namespace: {{ .Release.Namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + {{- if .Values.rbac.clusterWide }} + kind: ClusterRole + {{- else }} + kind: Role + {{- end }} + name: {{ template "telegraf.fullname" . }} +{{- end }} \ No newline at end of file diff --git a/stable/telegraf/templates/serviceaccount.yaml b/stable/telegraf/templates/serviceaccount.yaml new file mode 100644 index 0000000000..83175f68b5 --- /dev/null +++ b/stable/telegraf/templates/serviceaccount.yaml @@ -0,0 +1,11 @@ +{{- if .Values.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "telegraf.serviceAccountName" . }} + labels: + app: {{ template "telegraf.name" . }} + chart: {{ template "telegraf.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +{{- end }} diff --git a/stable/telegraf/values.yaml b/stable/telegraf/values.yaml index 7e9446d232..72d60d4f24 100644 --- a/stable/telegraf/values.yaml +++ b/stable/telegraf/values.yaml @@ -32,6 +32,52 @@ service: type: ClusterIP annotations: {} +rbac: + # Specifies whether RBAC resources should be created + create: true + # Create only for the release namespace or cluster wide (Role vs ClusterRole) + clusterWide: false + # Rules for the created rule + rules: [] +# When using the prometheus input to scrape all pods you need extra rules set to the ClusterRole to be +# able to scan the pods for scraping labels. The following rules have been taken from: +# https://github.com/helm/charts/blob/master/stable/prometheus/templates/server-clusterrole.yaml#L8-L46 +# - apiGroups: +# - "" +# resources: +# - nodes +# - nodes/proxy +# - nodes/metrics +# - services +# - endpoints +# - pods +# - ingresses +# - configmaps +# verbs: +# - get +# - list +# - watch +# - apiGroups: +# - "extensions" +# resources: +# - ingresses/status +# - ingresses +# verbs: +# - get +# - list +# - watch +# - nonResourceURLs: +# - "/metrics" +# verbs: +# - get + +serviceAccount: + # Specifies whether a ServiceAccount should be created + create: true + # The name of the ServiceAccount to use. + # If not set and create is true, a name is generated using the fullname template + name: + ## Exposed telegraf configuration ## For full list of possible values see `/docs/all-config-values.yaml` and `/docs/all-config-values.toml` ## ref: https://docs.influxdata.com/telegraf/v1.1/administration/configuration/