[stable/fluent-bit] Add RBAC support (#2762)

* [stable/fluent-bit] Add RBAC support

Fixes #2323

* Make yamllint happy

stable/fluent-bit/Chart.yaml

@@ -1,5 +1,5 @@
 name: fluent-bit
-version: 0.2.3
+version: 0.2.4
 appVersion: 0.12.7
 description: Fast and Lightweight Log/Data Forwarder for Linux, BSD and OSX
 keywords:

stable/fluent-bit/templates/_helpers.tpl

@@ -14,3 +14,14 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
 {{- $name := default .Chart.Name .Values.nameOverride -}}
 {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
 {{- end -}}
+
+{{/*
+Return the appropriate apiVersion for RBAC APIs.
+*/}}
+{{- define "rbac.apiVersion" -}}
+{{- if ge .Capabilities.KubeVersion.Minor "8" -}}
+"rbac.authorization.k8s.io/v1"
+{{- else -}}
+"rbac.authorization.k8s.io/v1beta1"
+{{- end -}}
+{{- end -}}

stable/fluent-bit/templates/cluster-role.yaml

@@ -0,0 +1,18 @@
+{{- if .Values.rbac.create -}}
+apiVersion: {{ template "rbac.apiVersion" . }}
+kind: ClusterRole
+metadata:
+  labels:
+    app: {{ template "fluent-bit.name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+  name: {{ template "fluent-bit.fullname" . }}
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - get
+{{- end -}}

stable/fluent-bit/templates/cluster-rolebinding.yaml

@@ -0,0 +1,19 @@
+{{- if .Values.rbac.create -}}
+apiVersion: {{ template "rbac.apiVersion" . }}
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app: {{ template "fluent-bit.name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+  name: {{ template "fluent-bit.fullname" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "fluent-bit.fullname" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "fluent-bit.fullname" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end -}}

stable/fluent-bit/templates/daemonset.yaml

@@ -10,6 +10,7 @@ spec:
       labels:
         app: {{ template "fluent-bit.fullname" . }}
     spec:
+      serviceAccountName: {{ if .Values.rbac.create }}{{ template "fluent-bit.fullname" . }}{{ else }}"{{ .Values.rbac.serviceAccountName }}"{{ end }}
       containers:
       - name: fluent-bit
         image: "{{ .Values.image.fluent_bit.repository }}:{{ .Values.image.fluent_bit.tag }}"

stable/fluent-bit/templates/serviceaccount.yaml

@@ -0,0 +1,11 @@
+{{- if .Values.rbac.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app: {{ template "fluent-bit.name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+  name: {{ template "fluent-bit.fullname" . }}
+{{- end -}}

stable/fluent-bit/values.yaml

@@ -30,7 +30,7 @@ resources:
 ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
 ##
 tolerations: []
-#- key: "key"
+# - key: "key"
 #  operator: "Equal|Exists"
 #  value: "value"
 #  effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)"
@@ -39,3 +39,10 @@ tolerations: []
 ## Ref: https://kubernetes.io/docs/user-guide/node-selection/
 ##
 nodeSelector: {}
+
+## Install Default RBAC roles and bindings
+rbac:
+  ## If true, create & use RBAC resources
+  create: false
+  ## Ignored if rbac.create is true
+  serviceAccountName: default