dfb32ccf60
- braces - brackets - colons - commas - comments - comments-indentation - document-start - hyphens - indentation With corresponding code changes. Also idempotency fix for lint script. Change-Id: Ibe5281cbb4ad7970e92f3d1f921abb1efc89dc3b
107 lines
3.7 KiB
YAML
107 lines
3.7 KiB
YAML
{{- /*
|
|
Copyright 2018, AT&T Intellectual Property
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/}}
|
|
|
|
{{- if .Values.manifests.podsecuritypolicy }}
|
|
{{- $envAll := . }}
|
|
|
|
{{- /* Create one ClusterRole and PSP per PSP definition in values */}}
|
|
{{- range $pspName, $pspDetails := .Values.data }}
|
|
{{- if and $pspName $pspDetails }}
|
|
---
|
|
apiVersion: policy/v1beta1
|
|
kind: PodSecurityPolicy
|
|
metadata:
|
|
name: {{ $pspName }}
|
|
labels:
|
|
{{ tuple $envAll "podsecuritypolicy" "policy" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }}
|
|
{{- if $pspDetails.annotations }}
|
|
annotations:
|
|
{{ toYaml $pspDetails.annotations | indent 4 }}
|
|
{{- end }}
|
|
spec:
|
|
{{ toYaml $pspDetails.spec | indent 2 }}
|
|
---
|
|
kind: ClusterRole
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: {{ $pspName }}
|
|
labels:
|
|
{{ tuple $envAll "podsecuritypolicy" "policy" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }}
|
|
rules:
|
|
- apiGroups: ['policy']
|
|
resources: ['podsecuritypolicies']
|
|
verbs: ['use']
|
|
resourceNames:
|
|
- {{ $pspName }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- /* Configure ClusterRoles to bind to different subjects as defaults */}}
|
|
{{- if .Values.conf.defaults }}
|
|
{{- range $rbacSubject, $defaultRole := .Values.conf.defaults }}
|
|
{{- if and $defaultRole (not (eq "nil" $defaultRole)) }}
|
|
---
|
|
kind: ClusterRoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
{{- /* NOTE: the role name is included in the name of the binding below
|
|
for the sake of chart upgrades. The roleRef for a binding is immutable,
|
|
so if the the defaultRole changes, we need a different binding to
|
|
reflect that. This issue was only sporadic! */}}
|
|
name: psp-binding-for-{{- $rbacSubject | replace ":" "-" -}}-{{- $defaultRole }}
|
|
labels:
|
|
{{ tuple $envAll "podsecuritypolicy" "policy" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }}
|
|
roleRef:
|
|
kind: ClusterRole
|
|
name: {{ $defaultRole }}
|
|
apiGroup: rbac.authorization.k8s.io
|
|
subjects:
|
|
- kind: Group
|
|
name: system:{{- $rbacSubject }}
|
|
apiGroup: rbac.authorization.k8s.io
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- /* Configure ClusterRoles to bind to non-default subjects */}}
|
|
{{- if .Values.conf.serviceaccounts }}
|
|
{{- range $rbacSubject, $rbacRole := .Values.conf.serviceaccounts }}
|
|
{{- if and $rbacSubject (not (eq "nil" $rbacRole)) }}
|
|
{{- $subjectName := ( $rbacSubject | split ":" )._1 | default "default" }}
|
|
{{- $subjectNamespace := ($rbacSubject | split ":" )._0 }}
|
|
---
|
|
apiVersion: "rbac.authorization.k8s.io/v1"
|
|
kind: "ClusterRoleBinding"
|
|
metadata:
|
|
{{- /* NOTE: the role name is included in the name of the binding below
|
|
for the sake of chart upgrades. The roleRef for a binding is immutable,
|
|
so if the the defaultRole changes, we need a different binding to
|
|
reflect that. This issue was only sporadic! */}}
|
|
name: psp-binding-for-{{- $subjectNamespace -}}-{{- $subjectName -}}-{{- $rbacRole }}
|
|
labels:
|
|
{{ tuple $envAll "podsecuritypolicy" "policy" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }}
|
|
roleRef:
|
|
kind: "ClusterRole"
|
|
name: {{ $rbacRole | quote }}
|
|
apiGroup: "rbac.authorization.k8s.io"
|
|
subjects:
|
|
- kind: "ServiceAccount"
|
|
name: {{ $subjectName | quote }}
|
|
namespace: {{ $subjectNamespace| quote }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|