[stable/concourse] Add rbac to concourse worker (#2922)

* Add rbac to concourse worker

* Switch to rbac.authorization.k8s.io/v1

* Enable rbac per default

See: https://github.com/kubernetes/helm/blob/master/docs/chart_best_practices/rbac.md

* Set default rbac version to v1beta1

* Update Chart.yml

stable/concourse/Chart.yaml

@@ -1,5 +1,5 @@
 name: concourse
-version: 0.10.3
+version: 0.10.4
 appVersion: 3.6.0
 description: Concourse is a simple and scalable CI system.
 icon: https://avatars1.githubusercontent.com/u/7809479
@@ -18,4 +18,6 @@ maintainers:
   email: viglesias@google.com
 - name: william-tran
   email: will@autonomic.ai
+- name: nexeck
+  email: marcel@beck.im
 engine: gotpl

stable/concourse/templates/worker-role.yaml

@@ -0,0 +1,20 @@
+{{- if .Values.rbac.create -}}
+apiVersion: rbac.authorization.k8s.io/{{ .Values.rbac.apiVersion }}
+kind: Role
+metadata:
+  name: {{ template "concourse.worker.fullname" . }}
+  labels:
+    app: {{ template "concourse.worker.fullname" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+rules:
+- apiGroups:
+  - extensions
+  resources:
+  - podsecuritypolicies
+  resourceNames:
+  - privileged
+  verbs:
+  - use
+{{- end -}}

stable/concourse/templates/worker-rolebinding.yaml

@@ -0,0 +1,18 @@
+{{- if .Values.rbac.create -}}
+apiVersion: rbac.authorization.k8s.io/{{ .Values.rbac.apiVersion }}
+kind: RoleBinding
+metadata:
+  name: {{ template "concourse.worker.fullname" . }}
+  labels:
+    app: {{ template "concourse.worker.fullname" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "concourse.worker.fullname" . }}
+subjects:
+- kind: ServiceAccount
+  name: {{ template "concourse.worker.fullname" . }}
+{{- end -}}

stable/concourse/templates/worker-serviceaccount.yaml

@@ -0,0 +1,11 @@
+{{- if .Values.rbac.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "concourse.worker.fullname" . }}
+  labels:
+    app: {{ template "concourse.worker.fullname" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+{{- end -}}

stable/concourse/templates/worker-statefulset.yaml

@@ -20,6 +20,7 @@ spec:
         {{ $key }}: {{ $value | quote }}
         {{- end }}
     spec:
+      serviceAccountName: {{ if .Values.rbac.create }}{{ template "concourse.worker.fullname" . }}{{ else }}{{ .Values.rbac.serviceAccountName }}{{ end }}
       tolerations:
 {{ toYaml .Values.worker.tolerations | indent 8 }}
       terminationGracePeriodSeconds: {{ .Values.worker.terminationGracePeriodSeconds }}

stable/concourse/values.yaml

@@ -585,3 +585,15 @@ credentialManager:
     ## the value will be written to /concourse-vault/client.key
     ## make sure to also set authBackend to `cert`
     # clientKey: |-
+
+## For RBAC support:
+rbac:
+  # true here enables creation of rbac resources
+  create: true
+
+  # rbac version
+  apiVersion: v1beta1
+
+  ## Ignored if rbac.create is true
+  ##
+  serviceAccountName: default