From ccc6707e47472bd3bea9d2d8afdf8e164f33b7db Mon Sep 17 00:00:00 2001 From: ptran32 Date: Wed, 9 Oct 2019 14:19:50 -0400 Subject: [PATCH] Add support for PodSecurityPolicies, ServiceAccounts (#16361) Signed-off-by: Patrice Tran --- stable/elasticsearch-exporter/Chart.yaml | 2 +- stable/elasticsearch-exporter/README.md | 3 ++ .../templates/deployment.yaml | 5 +++ .../templates/podsecuritypolicies.yaml | 39 +++++++++++++++++++ .../templates/role.yaml | 17 ++++++++ .../templates/rolebinding.yaml | 23 +++++++++++ .../templates/serviceaccount.yaml | 11 ++++++ stable/elasticsearch-exporter/values.yaml | 12 ++++++ 8 files changed, 111 insertions(+), 1 deletion(-) create mode 100644 stable/elasticsearch-exporter/templates/podsecuritypolicies.yaml create mode 100644 stable/elasticsearch-exporter/templates/role.yaml create mode 100644 stable/elasticsearch-exporter/templates/rolebinding.yaml create mode 100644 stable/elasticsearch-exporter/templates/serviceaccount.yaml diff --git a/stable/elasticsearch-exporter/Chart.yaml b/stable/elasticsearch-exporter/Chart.yaml index 08a31e40ae..1db954871f 100644 --- a/stable/elasticsearch-exporter/Chart.yaml +++ b/stable/elasticsearch-exporter/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 description: Elasticsearch stats exporter for Prometheus name: elasticsearch-exporter -version: 1.10.1 +version: 1.11.0 appVersion: 1.1.0 home: https://github.com/justwatchcom/elasticsearch_exporter sources: diff --git a/stable/elasticsearch-exporter/README.md b/stable/elasticsearch-exporter/README.md index a1ad12506d..f254eb6a9f 100644 --- a/stable/elasticsearch-exporter/README.md +++ b/stable/elasticsearch-exporter/README.md @@ -55,6 +55,9 @@ Parameter | Description | Default `nodeSelector` | Node labels for pod assignment | `{}` `tolerations` | Node tolerations for pod assignment | `{}` `podAnnotations` | Pod annotations | `{}` | +`podSecurityPolicies.enabled` | Enable/disable PodSecurityPolicy and associated Role/Rolebinding creation | `false` +`serviceAccount.create` | Create a ServiceAccount for the pod | `false` +`serviceAccount.name` | Name of a ServiceAccount to use that is not handled by this chart | `default` `service.type` | type of service to create | `ClusterIP` `service.httpPort` | port for the http service | `9108` `service.metricsPort.name` | name for the http service | `http` diff --git a/stable/elasticsearch-exporter/templates/deployment.yaml b/stable/elasticsearch-exporter/templates/deployment.yaml index dc598b13ca..65602dec6c 100644 --- a/stable/elasticsearch-exporter/templates/deployment.yaml +++ b/stable/elasticsearch-exporter/templates/deployment.yaml @@ -28,6 +28,11 @@ spec: {{ toYaml .Values.podAnnotations | indent 8 }} {{- end }} spec: + {{- if .Values.serviceAccount.create }} + serviceAccountName: {{ template "elasticsearch-exporter.fullname" . }} + {{- else }} + serviceAccountName: {{ .Values.serviceAccount.name }} + {{- end }} {{- if .Values.priorityClassName }} priorityClassName: "{{ .Values.priorityClassName }}" {{- end }} diff --git a/stable/elasticsearch-exporter/templates/podsecuritypolicies.yaml b/stable/elasticsearch-exporter/templates/podsecuritypolicies.yaml new file mode 100644 index 0000000000..fc7c2b6325 --- /dev/null +++ b/stable/elasticsearch-exporter/templates/podsecuritypolicies.yaml @@ -0,0 +1,39 @@ +{{- if .Values.podSecurityPolicies.enabled -}} +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + name: {{ template "elasticsearch-exporter.fullname" . }} + labels: + chart: {{ template "elasticsearch-exporter.chart" . }} + app: {{ template "elasticsearch-exporter.name" . }} + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" +spec: + privileged: false + allowPrivilegeEscalation: false + requiredDropCapabilities: + - ALL + volumes: + - 'secret' + hostNetwork: false + hostIPC: false + hostPID: false + runAsUser: + rule: 'MustRunAs' + ranges: + - min: 1 + max: 65535 + seLinux: + rule: 'RunAsAny' + supplementalGroups: + rule: 'MustRunAs' + ranges: + - min: 1 + max: 65535 + fsGroup: + rule: 'MustRunAs' + ranges: + - min: 1 + max: 65535 + readOnlyRootFilesystem: true +{{- end }} diff --git a/stable/elasticsearch-exporter/templates/role.yaml b/stable/elasticsearch-exporter/templates/role.yaml new file mode 100644 index 0000000000..9c45a107f8 --- /dev/null +++ b/stable/elasticsearch-exporter/templates/role.yaml @@ -0,0 +1,17 @@ +{{- if .Values.podSecurityPolicies.enabled -}} +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: Role +metadata: + name: {{ template "elasticsearch-exporter.fullname" . }} + labels: + chart: {{ template "elasticsearch-exporter.chart" . }} + app: {{ template "elasticsearch-exporter.name" . }} + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" +rules: +- apiGroups: ['extensions'] + resources: ['podsecuritypolicies'] + verbs: ['use'] + resourceNames: + - {{ template "elasticsearch-exporter.fullname" . }} +{{- end }} diff --git a/stable/elasticsearch-exporter/templates/rolebinding.yaml b/stable/elasticsearch-exporter/templates/rolebinding.yaml new file mode 100644 index 0000000000..cebb8506cf --- /dev/null +++ b/stable/elasticsearch-exporter/templates/rolebinding.yaml @@ -0,0 +1,23 @@ +{{- if .Values.podSecurityPolicies.enabled }} +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: RoleBinding +metadata: + name: {{ template "elasticsearch-exporter.fullname" . }} + labels: + chart: {{ template "elasticsearch-exporter.chart" . }} + app: {{ template "elasticsearch-exporter.name" . }} + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ template "elasticsearch-exporter.fullname" . }} +subjects: +- kind: ServiceAccount + {{- if .Values.serviceAccount.create }} + name: {{ template "elasticsearch-exporter.fullname" . }} + {{- else }} + name: {{ .Values.serviceAccount.name }} + {{- end }} + namespace: {{ .Release.Namespace }} +{{- end }} diff --git a/stable/elasticsearch-exporter/templates/serviceaccount.yaml b/stable/elasticsearch-exporter/templates/serviceaccount.yaml new file mode 100644 index 0000000000..aaf68b79ca --- /dev/null +++ b/stable/elasticsearch-exporter/templates/serviceaccount.yaml @@ -0,0 +1,11 @@ +{{- if .Values.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "elasticsearch-exporter.fullname" . }} + labels: + chart: {{ template "elasticsearch-exporter.chart" . }} + app: {{ template "elasticsearch-exporter.name" . }} + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" +{{- end }} diff --git a/stable/elasticsearch-exporter/values.yaml b/stable/elasticsearch-exporter/values.yaml index 1afdf51c3d..69bca7f209 100644 --- a/stable/elasticsearch-exporter/values.yaml +++ b/stable/elasticsearch-exporter/values.yaml @@ -177,3 +177,15 @@ prometheusRule: # annotations: # description: The heap usage is over 90% for 15m # summary: ElasticSearch node {{$labels.node}} heap usage is high + +# Create a service account +# To use a service account not handled by the chart, set the name here +# and set create to false +serviceAccount: + create: false + name: default + +# Creates a PodSecurityPolicy and the role/rolebinding +# allowing the serviceaccount to use it +podSecurityPolicies: + enabled: false