c9acad238c
This updates the kubeadm and minikube Kubernetes deployments to deploy version 1.16.2 Change-Id: I324f9665a24c9383c59376fb77cdb853facd0f18 Signed-off-by: Steve Wilkerson <sw5822@att.com>
75 lines
2.4 KiB
YAML
75 lines
2.4 KiB
YAML
{{/*
|
|
Copyright 2018, AT&T Intellectual Property
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/}}
|
|
|
|
{{- if .Values.manifests.podsecuritypolicy }}
|
|
{{- $envAll := . }}
|
|
|
|
{{/* Create one ClusterRole and PSP per PSP definition in values */}}
|
|
{{- range $pspName, $pspDetails := .Values.data }}
|
|
---
|
|
apiVersion: policy/v1beta1
|
|
kind: PodSecurityPolicy
|
|
metadata:
|
|
name: {{ $pspName }}
|
|
labels:
|
|
{{ tuple $envAll "podsecuritypolicy" "policy" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }}
|
|
{{- if $pspDetails.annotations }}
|
|
annotations:
|
|
{{ toYaml $pspDetails.annotations | indent 4 }}
|
|
{{- end }}
|
|
spec:
|
|
{{ toYaml $pspDetails.spec | indent 2 }}
|
|
---
|
|
kind: ClusterRole
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: {{ $pspName }}
|
|
labels:
|
|
{{ tuple $envAll "podsecuritypolicy" "policy" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }}
|
|
rules:
|
|
- apiGroups: ['policy']
|
|
resources: ['podsecuritypolicies']
|
|
verbs: ['use']
|
|
resourceNames:
|
|
- {{ $pspName }}
|
|
{{- end }}
|
|
|
|
{{/* Configure ClusterRoles to bind to different subjects as defaults */}}
|
|
{{- range $rbacSubject, $defaultRole := .Values.conf.defaults }}
|
|
{{ if and $defaultRole (not (eq "nil" $defaultRole)) }}
|
|
---
|
|
kind: ClusterRoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
{{/* NOTE: the role name is included in the name of the binding below
|
|
for the sake of chart upgrades. The roleRef for a binding is immutable,
|
|
so if the the defaultRole changes, we need a different binding to
|
|
reflect that. This issue was only sporadic! */}}
|
|
name: psp-binding-for-{{- $rbacSubject -}}-{{- $defaultRole }}
|
|
labels:
|
|
{{ tuple $envAll "podsecuritypolicy" "policy" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }}
|
|
roleRef:
|
|
kind: ClusterRole
|
|
name: {{ $defaultRole }}
|
|
apiGroup: rbac.authorization.k8s.io
|
|
subjects:
|
|
- kind: Group
|
|
name: system:{{- $rbacSubject }}
|
|
apiGroup: rbac.authorization.k8s.io
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|