From b1c1cd3d7c427dccece7c2504dd293b1c1de53fa Mon Sep 17 00:00:00 2001 From: Viktor Petersson Date: Thu, 21 Jun 2018 18:31:18 +0100 Subject: [PATCH] Adds support for RBAC for CloudSQL Proxy (#6249) * Adds support for RBAC * Bumps up version. * More feedback from @rimusz * Even more feedback from @rimusz --- stable/gcloud-sqlproxy/Chart.yaml | 4 ++-- stable/gcloud-sqlproxy/OWNERS | 8 +++++++ stable/gcloud-sqlproxy/README.md | 21 ++++++++++--------- .../gcloud-sqlproxy/templates/deployment.yaml | 3 +++ stable/gcloud-sqlproxy/templates/role.yaml | 16 ++++++++++++++ .../templates/rolebinding.yaml | 20 ++++++++++++++++++ .../templates/serviceaccount.yaml | 12 +++++++++++ stable/gcloud-sqlproxy/values.yaml | 4 ++++ 8 files changed, 76 insertions(+), 12 deletions(-) create mode 100644 stable/gcloud-sqlproxy/OWNERS create mode 100644 stable/gcloud-sqlproxy/templates/role.yaml create mode 100644 stable/gcloud-sqlproxy/templates/rolebinding.yaml create mode 100644 stable/gcloud-sqlproxy/templates/serviceaccount.yaml diff --git a/stable/gcloud-sqlproxy/Chart.yaml b/stable/gcloud-sqlproxy/Chart.yaml index 8070b59c74..c7958fee36 100644 --- a/stable/gcloud-sqlproxy/Chart.yaml +++ b/stable/gcloud-sqlproxy/Chart.yaml @@ -1,5 +1,5 @@ name: gcloud-sqlproxy -version: 0.3.4 +version: 0.3.5 appVersion: 1.11 description: Google Cloud SQL Proxy keywords: @@ -13,6 +13,6 @@ home: https://cloud.google.com/sql/docs/postgres/sql-proxy sources: - https://github.com/rimusz/charts maintainers: -- name: Rimas Mocevicius +- name: rimusz email: rmocius@gmail.com engine: gotpl diff --git a/stable/gcloud-sqlproxy/OWNERS b/stable/gcloud-sqlproxy/OWNERS new file mode 100644 index 0000000000..083e7b02c7 --- /dev/null +++ b/stable/gcloud-sqlproxy/OWNERS @@ -0,0 +1,8 @@ +approvers: +- rimusz +- unguiculus +- lachie83 +reviewers: +- rimusz +- unguiculus +- lachie83 diff --git a/stable/gcloud-sqlproxy/README.md b/stable/gcloud-sqlproxy/README.md index e9f21c8296..4d92b7e73e 100644 --- a/stable/gcloud-sqlproxy/README.md +++ b/stable/gcloud-sqlproxy/README.md @@ -56,16 +56,17 @@ The command removes all the Kubernetes components associated with the chart and The following table lists the configurable parameters of the Drupal chart and their default values. -| Parameter | Description | Default | -| --------------------------------- | -------------------------------------- | --------------------------------------------------------- | -| `image` | SQLProxy image | `b.gcr.io/cloudsql-docker/gce-proxy` | -| `imageTag` | SQLProxy image tag | `1.09` | -| `imagePullPolicy` | Image pull policy | `IfNotPresent` | -| `replicasCount` | Replicas count | `1` | -| `serviceAccountKey` | Service account key JSON file | Must be provided and base64 encoded | -| `cloudsql.instances` | List of PostgreSQL/MySQL instances | [{instance: `instance`, project: `project`, region: `region`, port: 5432}] must be provided | -| `resources` | CPU/Memory resource requests/limits | Memory: `100/150Mi`, CPU: `100/150m` | -| `nodeSelector` | Node Selector | | +| Parameter | Description | Default | +| --------------------------------- | -------------------------------------- | --------------------------------------------------------- | +| `image` | SQLProxy image | `b.gcr.io/cloudsql-docker/gce-proxy` | +| `imageTag` | SQLProxy image tag | `1.09` | +| `imagePullPolicy` | Image pull policy | `IfNotPresent` | +| `replicasCount` | Replicas count | `1` | +| `serviceAccountKey` | Service account key JSON file | Must be provided and base64 encoded | +| `cloudsql.instances` | List of PostgreSQL/MySQL instances | [{instance: `instance`, project: `project`, region: `region`, port: 5432}] must be provided | +| `resources` | CPU/Memory resource requests/limits | Memory: `100/150Mi`, CPU: `100/150m` | +| `nodeSelector` | Node Selector | | +| `rbac.create` | Create RBAC configuration w/ SA | `false` | Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. diff --git a/stable/gcloud-sqlproxy/templates/deployment.yaml b/stable/gcloud-sqlproxy/templates/deployment.yaml index 9dd42aa200..340271d2c0 100644 --- a/stable/gcloud-sqlproxy/templates/deployment.yaml +++ b/stable/gcloud-sqlproxy/templates/deployment.yaml @@ -15,6 +15,9 @@ spec: labels: app: {{ template "gcloud-sqlproxy.fullname" . }} spec: + {{- if .Values.rbac.create }} + serviceAccountName: {{ template "gcloud-sqlproxy.fullname" . }} + {{- end }} containers: - name: sqlproxy image: "{{ .Values.image }}:{{ .Values.imageTag }}" diff --git a/stable/gcloud-sqlproxy/templates/role.yaml b/stable/gcloud-sqlproxy/templates/role.yaml new file mode 100644 index 0000000000..ad08909771 --- /dev/null +++ b/stable/gcloud-sqlproxy/templates/role.yaml @@ -0,0 +1,16 @@ +{{- if .Values.rbac.create }} +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: Role +metadata: + namespace: {{ .Values.namespace }} + labels: + app: {{ template "gcloud-sqlproxy.fullname" . }} + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + name: {{ template "gcloud-sqlproxy.fullname" . }} +rules: +- apiGroups: [""] + resources: ["secrets"] + verbs: ["get", "watch", "list"] +{{- end }} diff --git a/stable/gcloud-sqlproxy/templates/rolebinding.yaml b/stable/gcloud-sqlproxy/templates/rolebinding.yaml new file mode 100644 index 0000000000..74181e37a7 --- /dev/null +++ b/stable/gcloud-sqlproxy/templates/rolebinding.yaml @@ -0,0 +1,20 @@ +{{- if .Values.rbac.create }} +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: RoleBinding +metadata: + namespace: {{ .Values.namespace }} + labels: + app: {{ template "gcloud-sqlproxy.fullname" . }} + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + name: {{ .Release.Name }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ template "gcloud-sqlproxy.fullname" . }} +subjects: + - kind: ServiceAccount + name: {{ template "gcloud-sqlproxy.fullname" . }} + namespace: {{ .Release.Namespace }} +{{- end }} diff --git a/stable/gcloud-sqlproxy/templates/serviceaccount.yaml b/stable/gcloud-sqlproxy/templates/serviceaccount.yaml new file mode 100644 index 0000000000..fad5284888 --- /dev/null +++ b/stable/gcloud-sqlproxy/templates/serviceaccount.yaml @@ -0,0 +1,12 @@ +{{- if .Values.rbac.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + namespace: {{ .Values.namespace }} + labels: + app: {{ template "gcloud-sqlproxy.fullname" . }} + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + name: {{ template "gcloud-sqlproxy.fullname" . }} +{{- end }} diff --git a/stable/gcloud-sqlproxy/values.yaml b/stable/gcloud-sqlproxy/values.yaml index 030dae4f4c..b8e48b0058 100644 --- a/stable/gcloud-sqlproxy/values.yaml +++ b/stable/gcloud-sqlproxy/values.yaml @@ -45,6 +45,10 @@ cloudsql: ## Configure resource requests and limits ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ ## + +rbac: + create: false + resources: requests: cpu: 100m