mirror of
https://github.com/helm/charts.git
synced 2026-08-23 22:37:45 +00:00
[stable/filebeat] Creation of a PodSecurityPolicy for Filebeat (#9151)
* Creation of a PodSecurityPolicy for Filebeat Signed-off-by: Marc Sensenich <sensenichm91@gmail.com> * Add new variables to the filebeat README Signed-off-by: Marc Sensenich <sensenichm91@gmail.com> * Reference correct chart in Filebeat README Signed-off-by: Marc Sensenich <sensenichm91@gmail.com> * Fixed README to with correct field name for podSecurityPolicy.enabled Signed-off-by: Marc Sensenich <sensenichm91@gmail.com>
This commit is contained in:
Marc Sensenich
committed by
Kubernetes Prow Robot
Kubernetes Prow Robot
parent
ff5d6f8d38
commit
e5ca17fce6
@@ -2,7 +2,7 @@ apiVersion: v1
|
||||
description: A Helm chart to collect Kubernetes logs with filebeat
|
||||
icon: https://www.elastic.co/assets/blt47799dcdcf08438d/logo-elastic-beats-lt.svg
|
||||
name: filebeat
|
||||
version: 1.0.5
|
||||
version: 1.1.0
|
||||
appVersion: 6.5.1
|
||||
home: https://www.elastic.co/products/beats/filebeat
|
||||
sources:
|
||||
|
||||
@@ -56,7 +56,9 @@ The following table lists the configurable parameters of the filebeat chart and
|
||||
| `affinity` | | `{}` |
|
||||
| `rbac.create` | Specifies whether RBAC resources should be created | `true` |
|
||||
| `serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
|
||||
| `serviceAccount.name` | he name of the ServiceAccount to use | `""` |
|
||||
| `serviceAccount.name` | the name of the ServiceAccount to use | `""` |
|
||||
| `podSecurityPolicy.enabled` | Should the PodSecurityPolicy be created. Depends on `rbac.create` being set to `true`. | `false` |
|
||||
| `podSecurityPolicy.annotations` | Annotations to be added to the created PodSecurityPolicy: | `""` |
|
||||
|
||||
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`.
|
||||
|
||||
|
||||
@@ -0,0 +1,53 @@
|
||||
{{- if .Values.rbac.create -}}
|
||||
{{- if .Values.podSecurityPolicy.enabled }}
|
||||
apiVersion: extensions/v1beta1
|
||||
kind: PodSecurityPolicy
|
||||
metadata:
|
||||
name: {{ template "filebeat.fullname" . }}
|
||||
annotations:
|
||||
{{- if .Values.podSecurityPolicy.annotations }}
|
||||
{{ toYaml .Values.podSecurityPolicy.annotations | indent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
privileged: false
|
||||
allowPrivilegeEscalation: false
|
||||
allowedHostPaths:
|
||||
- pathPrefix: /var/log
|
||||
readOnly: true
|
||||
- pathPrefix: /var/lib/docker/containers
|
||||
readOnly: true
|
||||
- pathPrefix: /var/lib/filebeat
|
||||
requiredDropCapabilities:
|
||||
- ALL
|
||||
volumes:
|
||||
- configMap
|
||||
- secret
|
||||
- hostPath
|
||||
hostNetwork: false
|
||||
hostIPC: false
|
||||
hostPID: false
|
||||
runAsUser:
|
||||
rule: MustRunAs
|
||||
ranges:
|
||||
- min: 0
|
||||
max: 0
|
||||
seLinux:
|
||||
rule: RunAsAny
|
||||
supplementalGroups:
|
||||
rule: MustRunAs
|
||||
ranges:
|
||||
# Forbid adding the root group.
|
||||
- min: 1
|
||||
max: 65535
|
||||
fsGroup:
|
||||
rule: MustRunAs
|
||||
ranges:
|
||||
# Forbid adding the root group.
|
||||
- min: 1
|
||||
max: 65535
|
||||
hostPorts:
|
||||
- min: 1
|
||||
max: 65535
|
||||
readOnlyRootFilesystem: false
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,20 @@
|
||||
{{- if .Values.rbac.create }}
|
||||
{{- if .Values.podSecurityPolicy.enabled }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ template "filebeat.fullname" . }}
|
||||
labels:
|
||||
app: {{ template "filebeat.name" . }}
|
||||
chart: {{ .Chart.Name }}-{{ .Chart.Version }}
|
||||
heritage: {{ .Release.Service }}
|
||||
release: {{ .Release.Name }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
rules:
|
||||
- apiGroups: ['extensions']
|
||||
resources: ['podsecuritypolicies']
|
||||
verbs: ['use']
|
||||
resourceNames:
|
||||
- {{ template "filebeat.fullname" . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,22 @@
|
||||
{{- if .Values.rbac.create }}
|
||||
{{- if .Values.podSecurityPolicy.enabled }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ template "filebeat.fullname" . }}
|
||||
labels:
|
||||
app: {{ template "filebeat.name" . }}
|
||||
chart: {{ .Chart.Name }}-{{ .Chart.Version }}
|
||||
heritage: {{ .Release.Service }}
|
||||
release: {{ .Release.Name }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: {{ template "filebeat.fullname" . }}
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "filebeat.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -124,3 +124,18 @@ serviceAccount:
|
||||
# The name of the ServiceAccount to use.
|
||||
# If not set and create is true, a name is generated using the fullname template
|
||||
name:
|
||||
|
||||
## Specify if a Pod Security Policy for filebeat must be created
|
||||
## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/
|
||||
##
|
||||
podSecurityPolicy:
|
||||
enabled: False
|
||||
annotations: {}
|
||||
## Specify pod annotations
|
||||
## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#apparmor
|
||||
## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#seccomp
|
||||
## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#sysctl
|
||||
##
|
||||
# seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'
|
||||
# seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default'
|
||||
# apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
|
||||
|
||||
Reference in New Issue
Block a user