From c2dd67d5a71d9440a65582e47f6f06f9a979b287 Mon Sep 17 00:00:00 2001
From: Richard Maynard <richard.maynard@gmail.com>
Date: Mon, 30 Apr 2018 10:10:16 -0500
Subject: [PATCH] [incubator/kafka] If RBAC is enabled in the cluster, the init
 container needs permissions (#5298)

* If RBAC is enabled in the cluster, the init container needs permissions

* increment minor version
---
 incubator/kafka/Chart.yaml                    |  2 +-
 incubator/kafka/README.md                     |  1 +
 incubator/kafka/templates/rbac.yaml           | 36 +++++++++++++++++++
 .../templates/service-brokers-external.yaml   |  1 +
 incubator/kafka/templates/statefulset.yaml    |  3 ++
 incubator/kafka/values.yaml                   |  5 +++
 6 files changed, 47 insertions(+), 1 deletion(-)
 create mode 100644 incubator/kafka/templates/rbac.yaml

diff --git a/incubator/kafka/Chart.yaml b/incubator/kafka/Chart.yaml
index a52d8dead0..5d1c4edcbc 100755
--- a/incubator/kafka/Chart.yaml
+++ b/incubator/kafka/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v1
 description: Apache Kafka is publish-subscribe messaging rethought as a distributed
   commit log.
 name: kafka
-version: 0.6.1
+version: 0.7.0
 appVersion: 4.0.1
 keywords:
 - kafka
diff --git a/incubator/kafka/README.md b/incubator/kafka/README.md
index 7267a41c8d..115d2440e5 100644
--- a/incubator/kafka/README.md
+++ b/incubator/kafka/README.md
@@ -71,6 +71,7 @@ following configurable parameters:
 | `external.firstListenerPort`   | TCP port which is added pod index number to arrive at the port used for NodePort and external listener port.    | '31090'                                                    |
 | `external.domain`              | Domain in which to advertise Kafka external listeners.                                                          | `cluster.local`                                            |
 | `external.init`                | External init container settings.                                                                               | (see `values.yaml`)                                        |
+| `rbac.enabled`                 | Enable a service account and role for the init container to use in an RBAC enabled cluster                      | `false`                                                    |
 | `configurationOverrides`       | `Kafka ` [configuration setting][brokerconfigs] overrides in the dictionary format                              | `{ offsets.topic.replication.factor: 3 }`                  |
 | `additionalPorts`              | Additional ports to expose on brokers.  Useful when the image exposes metrics (like prometheus, etc.) through a javaagent instead of a sidecar   | `{}`                                 |
 | `readinessProbe.initialDelaySeconds` | Number of seconds before probe is initiated.                                                              | `30`                                                       |
diff --git a/incubator/kafka/templates/rbac.yaml b/incubator/kafka/templates/rbac.yaml
new file mode 100644
index 0000000000..0173ab66b4
--- /dev/null
+++ b/incubator/kafka/templates/rbac.yaml
@@ -0,0 +1,36 @@
+{{- if  .Values.rbac.enabled  }}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Release.Name }}
+  namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: Role
+metadata:
+  name: {{ .Release.Name }}
+  namespace: {{ .Release.Namespace }}
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - patch
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1beta1
+metadata:
+  name: {{ .Release.Name }}
+roleRef:
+  kind: Role
+  name: {{ .Release.Name }}
+  apiGroup: rbac.authorization.k8s.io
+subjects:
+- kind: ServiceAccount
+  name: {{ .Release.Name }}
+  namespace: {{ .Release.Namespace }}
+{{- end }}
diff --git a/incubator/kafka/templates/service-brokers-external.yaml b/incubator/kafka/templates/service-brokers-external.yaml
index cb2704f813..8c36aea842 100644
--- a/incubator/kafka/templates/service-brokers-external.yaml
+++ b/incubator/kafka/templates/service-brokers-external.yaml
@@ -19,6 +19,7 @@ metadata:
     chart: "{{ $root.Chart.Name }}-{{ $root.Chart.Version }}"
     release: {{ $root.Release.Name | quote }}
     heritage: {{ $root.Release.Service | quote }}
+    pod: {{ $responsiblePod | quote }}
 spec:
   type: NodePort
   ports:
diff --git a/incubator/kafka/templates/statefulset.yaml b/incubator/kafka/templates/statefulset.yaml
index 263f21d795..24675f6909 100644
--- a/incubator/kafka/templates/statefulset.yaml
+++ b/incubator/kafka/templates/statefulset.yaml
@@ -27,6 +27,9 @@ spec:
     spec:
 {{- if .Values.schedulerName }}
       schedulerName: "{{ .Values.schedulerName }}"
+{{- end }}
+{{- if .Values.rbac.enabled }}
+      serviceAccountName: {{ .Release.Name }}
 {{- end }}
     {{- if .Values.external.enabled }}
       ## ref: https://github.com/Yolean/kubernetes-kafka/blob/master/kafka/50kafka.yml
diff --git a/incubator/kafka/values.yaml b/incubator/kafka/values.yaml
index 4296243328..439b8113e7 100644
--- a/incubator/kafka/values.yaml
+++ b/incubator/kafka/values.yaml
@@ -35,6 +35,11 @@ updateStrategy:
 ## ref: https://kubernetes.io/docs/tutorials/stateful-application/basic-stateful-set/#pod-management-policy
 podManagementPolicy: OrderedReady
 
+## If RBAC is enabled on the cluster, the Kafka init container needs a service account
+## with permissisions sufficient to apply pod labels
+rbac:
+  enabled: false
+
 ## The name of the storage class which the cluster should use.
 # storageClass: default