From f63467f9546cf7f53a02b4908a35b1103cdc2bb8 Mon Sep 17 00:00:00 2001 From: Sam Balana Date: Fri, 13 Apr 2018 13:53:59 -0700 Subject: [PATCH] [drone] Add RBAC support (#4769) * [drone] Add RBAC support Implements feature request [#4143][1]. RBAC support is vital for using Drone for continuous delivery on a Kubernetes stack that is running in RBAC mode. [drone-kubernetes][2] is one such plugin that will not work on RBAC-enabled Kubernetes stack with the current version of this chart. These changes add RBAC support to Drone by creating a Service Account, Role, and Role Binding. Many of these templates were taken from the more popular [nginx-ingress][3] chart, which implements RBAC well. I hope this works for you as well as it worked for me. Cheers. [1]: https://github.com/kubernetes/charts/issues/4143 [2]: https://github.com/honestbee/drone-kubernetes [3]: https://github.com/kubernetes/charts/tree/master/stable/nginx-ingress * [drone] Fix ingress path for classes other than gce A change was introduced in #3949 that incorrectly used the "and" template function. It was used infix (B and C) rather than prefix (and B C). This led to a subtle bug where it using the path for gce ingress for all ingress classes (e.g. nginx). Additionally, the "and" template function does not support short circuit evaluation, so two if statements had to be introduced. This made for some mess, but it was neccessary. * [drone] Removed unused value - rbac.roleRef * [drone] Add docs for rbac values * [drone] Use RBAC best practices https://github.com/kubernetes/helm/blob/master/docs/chart_best_practices/rbac.md This also changes the default RBAC api version to v1 from v1beta1. * [drone] Fix rbac "app" label Every other template is setting the app label to drone.name, so the rbac resources should match. Thank @unguiculus for catching this --- incubator/drone/Chart.yaml | 2 +- incubator/drone/README.md | 4 ++++ incubator/drone/templates/_helpers.tpl | 11 ++++++++++ .../drone/templates/deployment-agent.yaml | 3 ++- .../drone/templates/deployment-server.yaml | 1 + incubator/drone/templates/role-binding.yaml | 19 +++++++++++++++++ incubator/drone/templates/role.yaml | 21 +++++++++++++++++++ .../drone/templates/service-account.yaml | 11 ++++++++++ incubator/drone/values.yaml | 13 ++++++++++++ 9 files changed, 83 insertions(+), 2 deletions(-) create mode 100644 incubator/drone/templates/role-binding.yaml create mode 100644 incubator/drone/templates/role.yaml create mode 100644 incubator/drone/templates/service-account.yaml diff --git a/incubator/drone/Chart.yaml b/incubator/drone/Chart.yaml index 026da27342..2289e55c14 100755 --- a/incubator/drone/Chart.yaml +++ b/incubator/drone/Chart.yaml @@ -1,7 +1,7 @@ name: drone home: https://drone.io/ icon: https://drone.io/apple-touch-icon.png -version: 0.4.3 +version: 0.5.0 appVersion: 0.8.4 description: Drone is a Continuous Delivery system built on container technology keywords: diff --git a/incubator/drone/README.md b/incubator/drone/README.md index 271065f3a5..dbae616ded 100644 --- a/incubator/drone/README.md +++ b/incubator/drone/README.md @@ -66,3 +66,7 @@ The following table lists the configurable parameters of the drone charts and th | `persistence.accessMode` | Use volume as ReadOnly or ReadWrite | `ReadWriteOnce` | | `persistence.size` | Size of data volume | `1Gi` | | `sharedSecret` | Drone server and agent shared secret (Note: The Default random value changes on every `helm upgrade` causing a rolling update of server and agents) | `(random value)` | +| `rbac.create` | Specifies whether RBAC resources should be created. | `true` | +| `rbac.apiVersion` | RBAC API version | `v1` | +| `serviceAccount.create` | Specifies whether a ServiceAccount should be created. | `true` | +| `serviceAccount.name` | The name of the ServiceAccount to use. If not set and create is true, a name is generated using the fullname template. | `(fullname template)` | diff --git a/incubator/drone/templates/_helpers.tpl b/incubator/drone/templates/_helpers.tpl index 8b4511ba09..4c0c1122d9 100644 --- a/incubator/drone/templates/_helpers.tpl +++ b/incubator/drone/templates/_helpers.tpl @@ -13,3 +13,14 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this {{- $name := default "drone" .Values.nameOverride -}} {{ printf "%s-%s" .Release.Name $name | trunc 63 -}} {{ end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "drone.serviceAccountName" -}} +{{- if .Values.serviceAccount.create -}} + {{ default (include "drone.fullname" .) .Values.serviceAccount.name }} +{{- else -}} + {{ default "default" .Values.serviceAccount.name }} +{{- end -}} +{{- end -}} diff --git a/incubator/drone/templates/deployment-agent.yaml b/incubator/drone/templates/deployment-agent.yaml index 763ce5c690..e263d233a8 100644 --- a/incubator/drone/templates/deployment-agent.yaml +++ b/incubator/drone/templates/deployment-agent.yaml @@ -23,6 +23,7 @@ spec: affinity: {{ toYaml .Values.agent.affinity | indent 8 }} {{- end }} + serviceAccountName: {{ template "drone.serviceAccountName" . }} containers: - name: {{ template "drone.fullname" . }}-agent image: "{{ .Values.images.agent.repository }}:{{ .Values.images.agent.tag }}" @@ -72,4 +73,4 @@ spec: volumes: - name: docker-graph-storage emptyDir: {} -{{- end }} \ No newline at end of file +{{- end }} diff --git a/incubator/drone/templates/deployment-server.yaml b/incubator/drone/templates/deployment-server.yaml index adac184118..0d864ad6e0 100644 --- a/incubator/drone/templates/deployment-server.yaml +++ b/incubator/drone/templates/deployment-server.yaml @@ -24,6 +24,7 @@ spec: affinity: {{ toYaml .Values.server.affinity | indent 8 }} {{- end }} + serviceAccountName: {{ template "drone.serviceAccountName" . }} containers: - name: {{ template "drone.fullname" . }}-server image: "{{ .Values.images.server.repository }}:{{ .Values.images.server.tag }}" diff --git a/incubator/drone/templates/role-binding.yaml b/incubator/drone/templates/role-binding.yaml new file mode 100644 index 0000000000..b1f654748e --- /dev/null +++ b/incubator/drone/templates/role-binding.yaml @@ -0,0 +1,19 @@ +{{ if .Values.rbac.create }} +apiVersion: rbac.authorization.k8s.io/{{ required "A valid .Values.rbac.apiVersion entry required!" .Values.rbac.apiVersion }} +kind: RoleBinding +metadata: + name: {{ template "drone.fullname" . }} + labels: + app: {{ template "drone.name" . }} + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ template "drone.fullname" . }} +subjects: +- kind: ServiceAccount + name: {{ template "drone.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +{{ end }} diff --git a/incubator/drone/templates/role.yaml b/incubator/drone/templates/role.yaml new file mode 100644 index 0000000000..f69b4a7f52 --- /dev/null +++ b/incubator/drone/templates/role.yaml @@ -0,0 +1,21 @@ +{{ if .Values.rbac.create }} +apiVersion: rbac.authorization.k8s.io/{{ required "A valid .Values.rbac.apiVersion entry required!" .Values.rbac.apiVersion }} +kind: Role +metadata: + name: {{ template "drone.fullname" . }} + labels: + app: {{ template "drone.name" . }} + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" +rules: + - apiGroups: + - extensions + resources: + - deployments + verbs: + - get + - list + - patch + - update +{{ end }} diff --git a/incubator/drone/templates/service-account.yaml b/incubator/drone/templates/service-account.yaml new file mode 100644 index 0000000000..068b0dc57d --- /dev/null +++ b/incubator/drone/templates/service-account.yaml @@ -0,0 +1,11 @@ +{{ if .Values.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "drone.serviceAccountName" . }} + labels: + app: {{ template "drone.name" . }} + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" +{{ end }} diff --git a/incubator/drone/values.yaml b/incubator/drone/values.yaml index 054633a910..abfbf9e371 100644 --- a/incubator/drone/values.yaml +++ b/incubator/drone/values.yaml @@ -178,3 +178,16 @@ persistence: ## the agents and servers, otherwise this will be auto-generated. ## # sharedSecret: supersecret + +rbac: + ## Specifies whether RBAC resources should be created + create: true + ## RBAC api version (v1, v1beta1, or v1alpha1) + apiVersion: v1 + +serviceAccount: + ## Specifies whether a ServiceAccount should be created + create: true + ## The name of the ServiceAccount to use. + ## If not set and create is true, a name is generated using the fullname template + name: