[drone] Add RBAC support (#4769)

* [drone] Add RBAC support

Implements feature request [#4143][1].

RBAC support is vital for using Drone for continuous delivery on a
Kubernetes stack that is running in RBAC mode. [drone-kubernetes][2]
is one such plugin that will not work on RBAC-enabled Kubernetes
stack with the current version of this chart.

These changes add RBAC support to Drone by creating a Service
Account, Role, and Role Binding. Many of these templates were taken
from the more popular [nginx-ingress][3] chart, which implements
RBAC well.

I hope this works for you as well as it worked for me. Cheers.

[1]: https://github.com/kubernetes/charts/issues/4143
[2]: https://github.com/honestbee/drone-kubernetes
[3]: https://github.com/kubernetes/charts/tree/master/stable/nginx-ingress

* [drone] Fix ingress path for classes other than gce

A change was introduced in #3949 that incorrectly used the "and"
template function. It was used infix (B and C) rather than prefix
(and B C). This led to a subtle bug where it using the path for gce
ingress for all ingress classes (e.g. nginx).

Additionally, the "and" template function does not support short
circuit evaluation, so two if statements had to be introduced. This
made for some mess, but it was neccessary.

* [drone] Removed unused value - rbac.roleRef

* [drone] Add docs for rbac values

* [drone] Use RBAC best practices

https://github.com/kubernetes/helm/blob/master/docs/chart_best_practices/rbac.md

This also changes the default RBAC api version to v1
from v1beta1.

* [drone] Fix rbac "app" label

Every other template is setting the app label to
drone.name, so the rbac resources should match.

Thank @unguiculus for catching this

incubator/drone/Chart.yaml

@@ -1,7 +1,7 @@
 name: drone
 home: https://drone.io/
 icon: https://drone.io/apple-touch-icon.png
-version: 0.4.3
+version: 0.5.0
 appVersion: 0.8.4
 description: Drone is a Continuous Delivery system built on container technology
 keywords:

incubator/drone/README.md

@@ -66,3 +66,7 @@ The following table lists the configurable parameters of the drone charts and th
 | `persistence.accessMode`    | Use volume as ReadOnly or ReadWrite                                                           | `ReadWriteOnce`             |
 | `persistence.size`          | Size of data volume                                                                           | `1Gi`                       |
 | `sharedSecret`              | Drone server and agent shared secret (Note: The Default random value changes on every `helm upgrade` causing a rolling update of server and agents) | `(random value)`            |
+| `rbac.create`               | Specifies whether RBAC resources should be created.                                           | `true`                      |
+| `rbac.apiVersion`           | RBAC API version                                                                              | `v1`                        |
+| `serviceAccount.create`     | Specifies whether a ServiceAccount should be created.                                         | `true`                      |
+| `serviceAccount.name`       | The name of the ServiceAccount to use. If not set and create is true, a name is generated using the fullname template. | `(fullname template)` |

incubator/drone/templates/_helpers.tpl

@@ -13,3 +13,14 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
 {{- $name := default "drone" .Values.nameOverride -}}
 {{ printf "%s-%s" .Release.Name $name | trunc 63 -}}
 {{ end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "drone.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create -}}
+    {{ default (include "drone.fullname" .) .Values.serviceAccount.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccount.name }}
+{{- end -}}
+{{- end -}}

incubator/drone/templates/deployment-agent.yaml

@@ -23,6 +23,7 @@ spec:
       affinity:
 {{ toYaml .Values.agent.affinity | indent 8 }}
 {{- end }}
+      serviceAccountName: {{ template "drone.serviceAccountName" . }}
       containers:
       - name: {{ template "drone.fullname" . }}-agent
         image: "{{ .Values.images.agent.repository }}:{{ .Values.images.agent.tag }}"
@@ -72,4 +73,4 @@ spec:
       volumes:
       - name: docker-graph-storage
         emptyDir: {}
-{{- end }}
+{{- end }}

incubator/drone/templates/deployment-server.yaml

@@ -24,6 +24,7 @@ spec:
       affinity:
 {{ toYaml .Values.server.affinity | indent 8 }}
 {{- end }}
+      serviceAccountName: {{ template "drone.serviceAccountName" . }}
       containers:
       - name: {{ template "drone.fullname" . }}-server
         image: "{{ .Values.images.server.repository }}:{{ .Values.images.server.tag }}"

incubator/drone/templates/role-binding.yaml

@@ -0,0 +1,19 @@
+{{ if .Values.rbac.create }}
+apiVersion: rbac.authorization.k8s.io/{{ required "A valid .Values.rbac.apiVersion entry required!" .Values.rbac.apiVersion }}
+kind: RoleBinding
+metadata:
+  name: {{ template "drone.fullname" . }}
+  labels:
+    app: {{ template "drone.name" . }}
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "drone.fullname" . }}
+subjects:
+- kind: ServiceAccount
+  name: {{ template "drone.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+{{ end }}

incubator/drone/templates/role.yaml

@@ -0,0 +1,21 @@
+{{ if .Values.rbac.create }}
+apiVersion: rbac.authorization.k8s.io/{{ required "A valid .Values.rbac.apiVersion entry required!" .Values.rbac.apiVersion }}
+kind: Role
+metadata:
+  name: {{ template "drone.fullname" . }}
+  labels:
+    app: {{ template "drone.name" . }}
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+rules:
+  - apiGroups:
+      - extensions
+    resources:
+      - deployments
+    verbs:
+      - get
+      - list
+      - patch
+      - update
+{{ end }}

incubator/drone/templates/service-account.yaml

@@ -0,0 +1,11 @@
+{{ if .Values.serviceAccount.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "drone.serviceAccountName" . }}
+  labels:
+    app: {{ template "drone.name" . }}
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+{{ end }}

incubator/drone/values.yaml

@@ -178,3 +178,16 @@ persistence:
 ## the agents and servers, otherwise this will be auto-generated.
 ##
 # sharedSecret: supersecret
+
+rbac:
+  ## Specifies whether RBAC resources should be created
+  create: true
+  ## RBAC api version (v1, v1beta1, or v1alpha1)
+  apiVersion: v1
+
+serviceAccount:
+  ## Specifies whether a ServiceAccount should be created
+  create: true
+  ## The name of the ServiceAccount to use.
+  ## If not set and create is true, a name is generated using the fullname template
+  name: