From cfee1c46d648fe4ec7aa131909317313ecadce74 Mon Sep 17 00:00:00 2001 From: Waldemar Biller Date: Thu, 9 May 2019 00:10:49 +0200 Subject: [PATCH] [stable/weave-scope] Add readOnly flag (#12062) This new flag adds the --probe.no-controls flag to the list of args in the weave-scope-agent. Signed-off-by: Waldemar Biller --- stable/weave-scope/Chart.yaml | 2 +- stable/weave-scope/README.md | 3 ++- .../charts/weave-scope-agent/templates/daemonset.yaml | 3 +++ stable/weave-scope/values.yaml | 2 ++ 4 files changed, 8 insertions(+), 2 deletions(-) diff --git a/stable/weave-scope/Chart.yaml b/stable/weave-scope/Chart.yaml index 4792bbc923..900a5e611c 100644 --- a/stable/weave-scope/Chart.yaml +++ b/stable/weave-scope/Chart.yaml @@ -1,5 +1,5 @@ name: weave-scope -version: 0.11.0 +version: 0.11.1 appVersion: 1.10.1 description: A Helm chart for the Weave Scope cluster visualizer. keywords: diff --git a/stable/weave-scope/README.md b/stable/weave-scope/README.md index a29039a345..1e4702e6bd 100644 --- a/stable/weave-scope/README.md +++ b/stable/weave-scope/README.md @@ -81,7 +81,8 @@ The **agent** section controls how the Weave Scope node agent pods are installed | **scopeFrontendAddr** | the host:port of a Scope frontend to send data to -- this is only needed in cases where the frontend is deployed separately from the agent (e.g. an install outside the cluster or a pre-existing install inside it) | | | **probeToken** | the token used to connect to Weave Cloud -- this is not needed for connecting to non-cloud Scope frontends | | | **rbac.*** | controls RBAC resource creation/use | | -| **rbac.create** | whether RBAC resources should be created (required) -- this **must** be set to false if RBAC is not enabled in the cluster; it *may* be set to false in an RBAC-enabled cluster to allow for external management of RBAC | true | +| **rbac.create** | whether RBAC resources should be created (required) -- this **must** be set to false if RBAC is not enabled in the cluster; it *may* be set to false in an RBAC-enabled cluster to allow for external management of RBAC | `true` | +| **readOnly** | disables all controls (e.g. start/stop, terminal, logs, etc.) | `false` | | **serviceAccount.create** | whether a new service account name that the agent will use should be created. | `true` | | **serviceAccount.name** | service account to be used. If not set and serviceAccount.create is `true` a name is generated using the fullname template. | | | **resources.*** | controls requests/limits for the agent (these values are all optional) | | diff --git a/stable/weave-scope/charts/weave-scope-agent/templates/daemonset.yaml b/stable/weave-scope/charts/weave-scope-agent/templates/daemonset.yaml index b7983b342d..ffd7c8643f 100644 --- a/stable/weave-scope/charts/weave-scope-agent/templates/daemonset.yaml +++ b/stable/weave-scope/charts/weave-scope-agent/templates/daemonset.yaml @@ -34,6 +34,9 @@ spec: - '--probe.docker.bridge={{ .Values.dockerBridge }}' - '--probe.docker=true' - '--probe.kubernetes=true' + {{if .Values.readOnly}} + - "--probe.no-controls" + {{end}} {{- if .Values.global.probeToken }} - '--probe-token={{ .Values.global.probeToken }}' {{- else if .Values.global.scopeFrontendAddr }} diff --git a/stable/weave-scope/values.yaml b/stable/weave-scope/values.yaml index 8935123a98..1de2f09a66 100644 --- a/stable/weave-scope/values.yaml +++ b/stable/weave-scope/values.yaml @@ -54,6 +54,8 @@ weave-scope-agent: # weave-scope-agent.rbac.create *must* be set to false if RBAC is not enabled in the cluster # weave-scope-agent.rbac.create *may* be set to false in an RBAC-enabled cluster to allow for external management of RBAC create: true + # Enabling readOnly adds --probe.no-controls to args list. + readOnly: false serviceAccount: # Specifies whether a ServiceAccount should be created create: true