[stable/fluentd-elasticsearch] Add PodSecurityPolicy support (#9270)

Signed-off-by: Ludovic Cavajani <lcavajani@suse.com>
(cherry picked from commit 53a4d18f9f)

stable/fluentd-elasticsearch/Chart.yaml

@@ -1,5 +1,5 @@
 name: fluentd-elasticsearch
-version: 1.1.1
+version: 1.2.0
 appVersion: 2.3.1
 home: https://www.fluentd.org/
 description: A Fluentd Helm chart for Kubernetes with Elasticsearch output

stable/fluentd-elasticsearch/README.md

@@ -56,6 +56,10 @@ The following table lists the configurable parameters of the Fluentd elasticsear
 | `image.repository`                 | Image                                      | `gcr.io/google-containers/fluentd-elasticsearch`           |
 | `image.tag`                        | Image tag                                  | `v2.3.1`                                                   |
 | `image.pullPolicy`                 | Image pull policy                          | `IfNotPresent`                                             |
+| `livenessProbe.enabled`            | Whether to enable livenessProbe            | `true`                                                     |
+| `nodeSelector`                     | Optional daemonset nodeSelector            | `{}`                                                       |
+| `podSecurityPolicy.annotations`    | Specify pod annotations in the pod security policy | `{}`                                               |
+| `podSecurityPolicy.enabled`        | Specify if a pod security policy must be created   | `false`                                            |
 | `rbac.create`                      | RBAC                                       | `true`                                                     |
 | `resources.limits.cpu`             | CPU limit                                  | `100m`                                                     |
 | `resources.limits.memory`          | Memory limit                               | `500Mi`                                                    |
@@ -70,9 +74,7 @@ The following table lists the configurable parameters of the Fluentd elasticsear
 | `service.ports[].protocol`         | Service protocol(optional, can be TCP/UDP) | Not Set                                                    |
 | `serviceAccount.create`            | Specifies whether a service account should be created.| `true`                                          |
 | `serviceAccount.name`              | Name of the service account.               |                                                            |
-| `livenessProbe.enabled`            | Whether to enable livenessProbe            | `true`                                                     |
 | `tolerations`                      | Optional daemonset tolerations             | `{}`                                                       |
-| `nodeSelector`                     | Optional daemonset nodeSelector            | `{}`                                                       |
 
 
 Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example,

stable/fluentd-elasticsearch/templates/pod-security-policy.yaml

@@ -0,0 +1,52 @@
+{{- if .Values.podSecurityPolicy.enabled }}
+apiVersion: extensions/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: {{ template "fluentd-elasticsearch.fullname" . }}
+  labels:
+    app: {{ template "fluentd-elasticsearch.name" . }}
+    kubernetes.io/cluster-service: "true"
+    addonmanager.kubernetes.io/mode: Reconcile
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+  annotations:
+{{- if .Values.podSecurityPolicy.annotations }}
+{{ toYaml .Values.podSecurityPolicy.annotations | indent 4 }}
+{{- end }}
+spec:
+  privileged: false
+  allowPrivilegeEscalation: true
+  volumes:
+    - 'configMap'
+    - 'emptyDir'
+    - 'hostPath'
+    - 'secret'
+  allowedHostPaths:
+    - pathPrefix: /var/log
+      readOnly: false
+    - pathPrefix: /var/lib/docker/containers
+      readOnly: true
+    - pathPrefix: /usr/lib64
+      readOnly: true
+  hostNetwork: false
+  hostPID: false
+  hostIPC: false
+  runAsUser:
+    rule: 'RunAsAny'
+  runAsGroup:
+    rule: 'RunAsAny'
+  seLinux:
+    rule: 'RunAsAny'
+  supplementalGroups:
+    rule: 'RunAsAny'
+  fsGroup:
+    rule: 'MustRunAs'
+    ranges:
+      - min: 1
+        max: 65535
+  readOnlyRootFilesystem: false
+  hostPorts:
+    - min: 1
+      max: 65535
+{{- end }}

stable/fluentd-elasticsearch/templates/role.yaml

@@ -0,0 +1,19 @@
+{{- if .Values.podSecurityPolicy.enabled }}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: Role
+metadata:
+  name: {{ template "fluentd-elasticsearch.fullname" . }}
+  labels:
+    app: {{ template "fluentd-elasticsearch.name" . }}
+    kubernetes.io/cluster-service: "true"
+    addonmanager.kubernetes.io/mode: Reconcile
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+rules:
+- apiGroups: ['extensions']
+  resources: ['podsecuritypolicies']
+  verbs:     ['use']
+  resourceNames:
+  - {{ template "fluentd-elasticsearch.fullname" . }}
+{{- end }}

stable/fluentd-elasticsearch/templates/rolebinding.yaml

@@ -0,0 +1,22 @@
+
+{{- if .Values.podSecurityPolicy.enabled }}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: RoleBinding
+metadata:
+  name: {{ template "fluentd-elasticsearch.fullname" . }}
+  labels:
+    app: {{ template "fluentd-elasticsearch.name" . }}
+    kubernetes.io/cluster-service: "true"
+    addonmanager.kubernetes.io/mode: Reconcile
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+roleRef:
+  kind: Role
+  name: {{ template "fluentd-elasticsearch.fullname" . }}
+  apiGroup: rbac.authorization.k8s.io
+subjects:
+- kind: ServiceAccount
+  name: {{ template "fluentd-elasticsearch.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+{{- end }}

stable/fluentd-elasticsearch/values.yaml

@@ -33,6 +33,21 @@ serviceAccount:
   # If not set and create is true, a name is generated using the fullname template
   name:
 
+## Specify if a Pod Security Policy for node-exporter must be created
+## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/
+##
+podSecurityPolicy:
+  enabled: false
+  annotations: {}
+    ## Specify pod annotations
+    ## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#apparmor
+    ## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#seccomp
+    ## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#sysctl
+    ##
+    # seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'
+    # seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default'
+    # apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
+
 livenessProbe:
   enabled: true