[incubator/kafka] If RBAC is enabled in the cluster, the init container needs permissions (#5298)

* If RBAC is enabled in the cluster, the init container needs permissions

* increment minor version

incubator/kafka/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v1
 description: Apache Kafka is publish-subscribe messaging rethought as a distributed
   commit log.
 name: kafka
-version: 0.6.1
+version: 0.7.0
 appVersion: 4.0.1
 keywords:
 - kafka

incubator/kafka/README.md

@@ -71,6 +71,7 @@ following configurable parameters:
 | `external.firstListenerPort`   | TCP port which is added pod index number to arrive at the port used for NodePort and external listener port.    | '31090'                                                    |
 | `external.domain`              | Domain in which to advertise Kafka external listeners.                                                          | `cluster.local`                                            |
 | `external.init`                | External init container settings.                                                                               | (see `values.yaml`)                                        |
+| `rbac.enabled`                 | Enable a service account and role for the init container to use in an RBAC enabled cluster                      | `false`                                                    |
 | `configurationOverrides`       | `Kafka ` [configuration setting][brokerconfigs] overrides in the dictionary format                              | `{ offsets.topic.replication.factor: 3 }`                  |
 | `additionalPorts`              | Additional ports to expose on brokers.  Useful when the image exposes metrics (like prometheus, etc.) through a javaagent instead of a sidecar   | `{}`                                 |
 | `readinessProbe.initialDelaySeconds` | Number of seconds before probe is initiated.                                                              | `30`                                                       |

incubator/kafka/templates/rbac.yaml

@@ -0,0 +1,36 @@
+{{- if  .Values.rbac.enabled  }}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Release.Name }}
+  namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: Role
+metadata:
+  name: {{ .Release.Name }}
+  namespace: {{ .Release.Namespace }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - patch
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1beta1
+metadata:
+  name: {{ .Release.Name }}
+roleRef:
+  kind: Role
+  name: {{ .Release.Name }}
+  apiGroup: rbac.authorization.k8s.io
+subjects:
+- kind: ServiceAccount
+  name: {{ .Release.Name }}
+  namespace: {{ .Release.Namespace }}
+{{- end }}

incubator/kafka/templates/service-brokers-external.yaml

@@ -19,6 +19,7 @@ metadata:
     chart: "{{ $root.Chart.Name }}-{{ $root.Chart.Version }}"
     release: {{ $root.Release.Name | quote }}
     heritage: {{ $root.Release.Service | quote }}
+    pod: {{ $responsiblePod | quote }}
 spec:
   type: NodePort
   ports:

incubator/kafka/templates/statefulset.yaml

@@ -27,6 +27,9 @@ spec:
     spec:
 {{- if .Values.schedulerName }}
       schedulerName: "{{ .Values.schedulerName }}"
+{{- end }}
+{{- if .Values.rbac.enabled }}
+      serviceAccountName: {{ .Release.Name }}
 {{- end }}
     {{- if .Values.external.enabled }}
       ## ref: https://github.com/Yolean/kubernetes-kafka/blob/master/kafka/50kafka.yml

incubator/kafka/values.yaml

@@ -35,6 +35,11 @@ updateStrategy:
 ## ref: https://kubernetes.io/docs/tutorials/stateful-application/basic-stateful-set/#pod-management-policy
 podManagementPolicy: OrderedReady
 
+## If RBAC is enabled on the cluster, the Kafka init container needs a service account
+## with permissisions sufficient to apply pod labels
+rbac:
+  enabled: false
+
 ## The name of the storage class which the cluster should use.
 # storageClass: default