Add support for PodSecurityPolicies, ServiceAccounts (#16361)

Signed-off-by: Patrice Tran <ptran@mailjet.com>

stable/elasticsearch-exporter/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 description: Elasticsearch stats exporter for Prometheus
 name: elasticsearch-exporter
-version: 1.10.1
+version: 1.11.0
 appVersion: 1.1.0
 home: https://github.com/justwatchcom/elasticsearch_exporter
 sources:

stable/elasticsearch-exporter/README.md

@@ -55,6 +55,9 @@ Parameter | Description | Default
 `nodeSelector` | Node labels for pod assignment | `{}`
 `tolerations` | Node tolerations for pod assignment | `{}`
 `podAnnotations` | Pod annotations | `{}` |
+`podSecurityPolicies.enabled` | Enable/disable PodSecurityPolicy and associated Role/Rolebinding creation | `false`
+`serviceAccount.create` | Create a ServiceAccount for the pod | `false`
+`serviceAccount.name` | Name of a ServiceAccount to use that is not handled by this chart | `default`
 `service.type` | type of service to create | `ClusterIP`
 `service.httpPort` | port for the http service | `9108`
 `service.metricsPort.name` | name for the http service | `http`

stable/elasticsearch-exporter/templates/deployment.yaml

@@ -28,6 +28,11 @@ spec:
 {{ toYaml .Values.podAnnotations | indent 8 }}
       {{- end }}
     spec:
+      {{- if .Values.serviceAccount.create  }}
+      serviceAccountName: {{ template "elasticsearch-exporter.fullname" . }}
+      {{- else }}
+      serviceAccountName: {{ .Values.serviceAccount.name }}
+      {{- end }}
 {{- if .Values.priorityClassName }}
       priorityClassName: "{{ .Values.priorityClassName }}"
 {{- end }}

stable/elasticsearch-exporter/templates/podsecuritypolicies.yaml

@@ -0,0 +1,39 @@
+{{- if .Values.podSecurityPolicies.enabled -}}
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: {{ template "elasticsearch-exporter.fullname" . }}
+  labels:
+    chart: {{ template "elasticsearch-exporter.chart" . }}
+    app: {{ template "elasticsearch-exporter.name" . }}
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+spec:
+  privileged: false
+  allowPrivilegeEscalation: false
+  requiredDropCapabilities:
+   - ALL
+  volumes:
+    - 'secret'
+  hostNetwork: false
+  hostIPC: false
+  hostPID: false
+  runAsUser:
+    rule: 'MustRunAs'
+    ranges:
+      - min: 1
+        max: 65535
+  seLinux:
+    rule: 'RunAsAny'
+  supplementalGroups:
+    rule: 'MustRunAs'
+    ranges:
+      - min: 1
+        max: 65535
+  fsGroup:
+    rule: 'MustRunAs'
+    ranges:
+      - min: 1
+        max: 65535
+  readOnlyRootFilesystem: true
+{{- end }}

stable/elasticsearch-exporter/templates/role.yaml

@@ -0,0 +1,17 @@
+{{- if .Values.podSecurityPolicies.enabled -}}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: Role
+metadata:
+  name: {{ template "elasticsearch-exporter.fullname" . }}
+  labels:
+    chart: {{ template "elasticsearch-exporter.chart" . }}
+    app: {{ template "elasticsearch-exporter.name" . }}
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+rules:
+- apiGroups: ['extensions']
+  resources: ['podsecuritypolicies']
+  verbs:     ['use']
+  resourceNames:
+  - {{ template "elasticsearch-exporter.fullname" . }}
+{{- end }}

stable/elasticsearch-exporter/templates/rolebinding.yaml

@@ -0,0 +1,23 @@
+{{- if .Values.podSecurityPolicies.enabled }}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: RoleBinding
+metadata:
+  name: {{ template "elasticsearch-exporter.fullname" . }}
+  labels:
+    chart: {{ template "elasticsearch-exporter.chart" . }}
+    app: {{ template "elasticsearch-exporter.name" . }}
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "elasticsearch-exporter.fullname" . }}
+subjects:
+- kind: ServiceAccount
+  {{- if .Values.serviceAccount.create  }}
+  name: {{ template "elasticsearch-exporter.fullname" . }}
+  {{- else }}
+  name: {{ .Values.serviceAccount.name }}
+  {{- end }}
+  namespace: {{ .Release.Namespace }}
+{{- end }}

stable/elasticsearch-exporter/templates/serviceaccount.yaml

@@ -0,0 +1,11 @@
+{{- if .Values.serviceAccount.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "elasticsearch-exporter.fullname" . }}
+  labels:
+    chart: {{ template "elasticsearch-exporter.chart" . }}
+    app: {{ template "elasticsearch-exporter.name" . }}
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+{{- end }}

stable/elasticsearch-exporter/values.yaml

@@ -177,3 +177,15 @@ prometheusRule:
     #   annotations:
     #     description: The heap usage is over 90% for 15m
     #     summary: ElasticSearch node {{$labels.node}} heap usage is high
+
+# Create a service account
+# To use a service account not handled by the chart, set the name here
+# and set create to false
+serviceAccount:
+  create: false
+  name: default
+
+# Creates a PodSecurityPolicy and the role/rolebinding
+# allowing the serviceaccount to use it
+podSecurityPolicies:
+  enabled: false