From e5ca17fce6dda0325e8f7772ea199d80af763db7 Mon Sep 17 00:00:00 2001 From: Marc Sensenich Date: Mon, 17 Dec 2018 19:52:09 +0000 Subject: [PATCH] [stable/filebeat] Creation of a PodSecurityPolicy for Filebeat (#9151) * Creation of a PodSecurityPolicy for Filebeat Signed-off-by: Marc Sensenich * Add new variables to the filebeat README Signed-off-by: Marc Sensenich * Reference correct chart in Filebeat README Signed-off-by: Marc Sensenich * Fixed README to with correct field name for podSecurityPolicy.enabled Signed-off-by: Marc Sensenich --- stable/filebeat/Chart.yaml | 2 +- stable/filebeat/README.md | 4 +- .../filebeat/templates/podsecuritypolicy.yaml | 53 +++++++++++++++++++ stable/filebeat/templates/role.yaml | 20 +++++++ stable/filebeat/templates/rolebinding.yaml | 22 ++++++++ stable/filebeat/values.yaml | 15 ++++++ 6 files changed, 114 insertions(+), 2 deletions(-) create mode 100644 stable/filebeat/templates/podsecuritypolicy.yaml create mode 100644 stable/filebeat/templates/role.yaml create mode 100644 stable/filebeat/templates/rolebinding.yaml diff --git a/stable/filebeat/Chart.yaml b/stable/filebeat/Chart.yaml index 7021c8ac30..868ca81f30 100644 --- a/stable/filebeat/Chart.yaml +++ b/stable/filebeat/Chart.yaml @@ -2,7 +2,7 @@ apiVersion: v1 description: A Helm chart to collect Kubernetes logs with filebeat icon: https://www.elastic.co/assets/blt47799dcdcf08438d/logo-elastic-beats-lt.svg name: filebeat -version: 1.0.5 +version: 1.1.0 appVersion: 6.5.1 home: https://www.elastic.co/products/beats/filebeat sources: diff --git a/stable/filebeat/README.md b/stable/filebeat/README.md index 04f5767b04..40c9016b2d 100644 --- a/stable/filebeat/README.md +++ b/stable/filebeat/README.md @@ -56,7 +56,9 @@ The following table lists the configurable parameters of the filebeat chart and | `affinity` | | `{}` | | `rbac.create` | Specifies whether RBAC resources should be created | `true` | | `serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | -| `serviceAccount.name` | he name of the ServiceAccount to use | `""` | +| `serviceAccount.name` | the name of the ServiceAccount to use | `""` | +| `podSecurityPolicy.enabled` | Should the PodSecurityPolicy be created. Depends on `rbac.create` being set to `true`. | `false` | +| `podSecurityPolicy.annotations` | Annotations to be added to the created PodSecurityPolicy: | `""` | Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. diff --git a/stable/filebeat/templates/podsecuritypolicy.yaml b/stable/filebeat/templates/podsecuritypolicy.yaml new file mode 100644 index 0000000000..3a11b38260 --- /dev/null +++ b/stable/filebeat/templates/podsecuritypolicy.yaml @@ -0,0 +1,53 @@ +{{- if .Values.rbac.create -}} +{{- if .Values.podSecurityPolicy.enabled }} +apiVersion: extensions/v1beta1 +kind: PodSecurityPolicy +metadata: + name: {{ template "filebeat.fullname" . }} + annotations: +{{- if .Values.podSecurityPolicy.annotations }} +{{ toYaml .Values.podSecurityPolicy.annotations | indent 4 }} +{{- end }} +spec: + privileged: false + allowPrivilegeEscalation: false + allowedHostPaths: + - pathPrefix: /var/log + readOnly: true + - pathPrefix: /var/lib/docker/containers + readOnly: true + - pathPrefix: /var/lib/filebeat + requiredDropCapabilities: + - ALL + volumes: + - configMap + - secret + - hostPath + hostNetwork: false + hostIPC: false + hostPID: false + runAsUser: + rule: MustRunAs + ranges: + - min: 0 + max: 0 + seLinux: + rule: RunAsAny + supplementalGroups: + rule: MustRunAs + ranges: + # Forbid adding the root group. + - min: 1 + max: 65535 + fsGroup: + rule: MustRunAs + ranges: + # Forbid adding the root group. + - min: 1 + max: 65535 + hostPorts: + - min: 1 + max: 65535 + readOnlyRootFilesystem: false +{{- end -}} +{{- end -}} diff --git a/stable/filebeat/templates/role.yaml b/stable/filebeat/templates/role.yaml new file mode 100644 index 0000000000..93cb69ab8b --- /dev/null +++ b/stable/filebeat/templates/role.yaml @@ -0,0 +1,20 @@ +{{- if .Values.rbac.create }} +{{- if .Values.podSecurityPolicy.enabled }} +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: Role +metadata: + name: {{ template "filebeat.fullname" . }} + labels: + app: {{ template "filebeat.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version }} + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} + namespace: {{ .Release.Namespace }} +rules: +- apiGroups: ['extensions'] + resources: ['podsecuritypolicies'] + verbs: ['use'] + resourceNames: + - {{ template "filebeat.fullname" . }} +{{- end }} +{{- end }} diff --git a/stable/filebeat/templates/rolebinding.yaml b/stable/filebeat/templates/rolebinding.yaml new file mode 100644 index 0000000000..4eca983f3e --- /dev/null +++ b/stable/filebeat/templates/rolebinding.yaml @@ -0,0 +1,22 @@ +{{- if .Values.rbac.create }} +{{- if .Values.podSecurityPolicy.enabled }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ template "filebeat.fullname" . }} + labels: + app: {{ template "filebeat.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version }} + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} + namespace: {{ .Release.Namespace }} +roleRef: + kind: Role + name: {{ template "filebeat.fullname" . }} + apiGroup: rbac.authorization.k8s.io +subjects: +- kind: ServiceAccount + name: {{ template "filebeat.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +{{- end }} +{{- end }} diff --git a/stable/filebeat/values.yaml b/stable/filebeat/values.yaml index f9b77b9470..97dec9c8ec 100644 --- a/stable/filebeat/values.yaml +++ b/stable/filebeat/values.yaml @@ -124,3 +124,18 @@ serviceAccount: # The name of the ServiceAccount to use. # If not set and create is true, a name is generated using the fullname template name: + +## Specify if a Pod Security Policy for filebeat must be created +## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/ +## +podSecurityPolicy: + enabled: False + annotations: {} + ## Specify pod annotations + ## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#apparmor + ## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#seccomp + ## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#sysctl + ## + # seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*' + # seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default' + # apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'