From f85bc9ea3abdfa286edd08120de7863e9ac2571f Mon Sep 17 00:00:00 2001
From: Bort Verwilst <bart@intux.be>
Date: Sat, 30 Mar 2019 21:31:08 +0100
Subject: [PATCH] [stable/nfs-client-provisioner] Revert running as nobody
 (#12580)

* Revert "stable/nfs-client-provisioner: run as nobody (#12180)"

This reverts commit c390904bcc7ef9fc651bb32b7c8b968731bcb8aa.

Signed-off-by: Bart Verwilst <bart@verwilst.be>

* update version

Signed-off-by: Bart Verwilst <bart@verwilst.be>
---
 stable/nfs-client-provisioner/Chart.yaml      |  2 +-
 .../templates/clusterrole.yaml                |  6 ++++
 .../templates/deployment.yaml                 |  3 --
 .../templates/podsecuritypolicy.yaml          | 31 +++++++++++++++++++
 .../templates/role.yaml                       |  6 ++++
 stable/nfs-client-provisioner/values.yaml     |  5 +++
 6 files changed, 49 insertions(+), 4 deletions(-)
 create mode 100644 stable/nfs-client-provisioner/templates/podsecuritypolicy.yaml

diff --git a/stable/nfs-client-provisioner/Chart.yaml b/stable/nfs-client-provisioner/Chart.yaml
index 8bb5c05620..5214471e03 100644
--- a/stable/nfs-client-provisioner/Chart.yaml
+++ b/stable/nfs-client-provisioner/Chart.yaml
@@ -3,7 +3,7 @@ appVersion: 3.1.0
 description: nfs-client is an automatic provisioner that used your *already configured* NFS server, automatically creating Persistent Volumes.
 name: nfs-client-provisioner
 home: https://github.com/kubernetes-incubator/external-storage/tree/master/nfs-client
-version: 1.2.4
+version: 1.2.5
 sources:
 - https://github.com/kubernetes-incubator/external-storage/tree/master/nfs-client
 maintainers:
diff --git a/stable/nfs-client-provisioner/templates/clusterrole.yaml b/stable/nfs-client-provisioner/templates/clusterrole.yaml
index cf4cb872ce..fa43e0d42b 100644
--- a/stable/nfs-client-provisioner/templates/clusterrole.yaml
+++ b/stable/nfs-client-provisioner/templates/clusterrole.yaml
@@ -21,4 +21,10 @@ rules:
   - apiGroups: [""]
     resources: ["events"]
     verbs: ["create", "update", "patch"]
+{{- if .Values.podSecurityPolicy.enabled }}
+  - apiGroups:      ['extensions']
+    resources:      ['podsecuritypolicies']
+    verbs:          ['use']
+    resourceNames:  [{{ template "nfs-client-provisioner.fullname" . }}]
+{{- end }}
 {{- end }}
diff --git a/stable/nfs-client-provisioner/templates/deployment.yaml b/stable/nfs-client-provisioner/templates/deployment.yaml
index 16c36207ad..7fc8113996 100644
--- a/stable/nfs-client-provisioner/templates/deployment.yaml
+++ b/stable/nfs-client-provisioner/templates/deployment.yaml
@@ -34,9 +34,6 @@ spec:
       affinity:
 {{ toYaml .Values.affinity | indent 8 }}
       {{- end }}
-      securityContext:
-        runAsUser: 65534
-        fsGroup: 65534
       containers:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
diff --git a/stable/nfs-client-provisioner/templates/podsecuritypolicy.yaml b/stable/nfs-client-provisioner/templates/podsecuritypolicy.yaml
new file mode 100644
index 0000000000..290fbcd72c
--- /dev/null
+++ b/stable/nfs-client-provisioner/templates/podsecuritypolicy.yaml
@@ -0,0 +1,31 @@
+{{- if .Values.podSecurityPolicy.enabled }}
+apiVersion: extensions/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: {{ template "nfs-client-provisioner.fullname" . }}
+  labels:
+    app: {{ template "nfs-client-provisioner.name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+spec:
+  privileged: false
+  allowPrivilegeEscalation: false
+  requiredDropCapabilities:
+    - ALL
+  volumes:
+    - 'secret'
+    - 'nfs'
+  hostNetwork: false
+  hostIPC: false
+  hostPID: false
+  runAsUser:
+    rule: 'RunAsAny'
+  seLinux:
+    rule: 'RunAsAny'
+  supplementalGroups:
+    rule: 'RunAsAny'
+  fsGroup:
+    rule: 'RunAsAny'
+  readOnlyRootFilesystem: false
+{{- end }}
diff --git a/stable/nfs-client-provisioner/templates/role.yaml b/stable/nfs-client-provisioner/templates/role.yaml
index 46dd984b7a..0cccdcbd5e 100644
--- a/stable/nfs-client-provisioner/templates/role.yaml
+++ b/stable/nfs-client-provisioner/templates/role.yaml
@@ -12,4 +12,10 @@ rules:
   - apiGroups: [""]
     resources: ["endpoints"]
     verbs: ["get", "list", "watch", "create", "update", "patch"]
+{{- if .Values.podSecurityPolicy.enabled }}
+  - apiGroups:      ['extensions']
+    resources:      ['podsecuritypolicies']
+    verbs:          ['use']
+    resourceNames:  [{{ template "nfs-client-provisioner.fullname" . }}]
+{{- end }}
 {{- end }}
diff --git a/stable/nfs-client-provisioner/values.yaml b/stable/nfs-client-provisioner/values.yaml
index 3312118442..dac4ea6e5d 100644
--- a/stable/nfs-client-provisioner/values.yaml
+++ b/stable/nfs-client-provisioner/values.yaml
@@ -44,6 +44,11 @@ rbac:
   # Specifies whether RBAC resources should be created
   create: true
 
+# If true, create & use Pod Security Policy resources
+# https://kubernetes.io/docs/concepts/policy/pod-security-policy/
+podSecurityPolicy:
+  enabled: false
+
 serviceAccount:
   # Specifies whether a ServiceAccount should be created
   create: true