71 lines
2.3 KiB
YAML
71 lines
2.3 KiB
YAML
{{/*
|
|
Copyright 2018, AT&T Intellectual Property
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/}}
|
|
|
|
{{- if .Values.manifests.podsecuritypolicy }}
|
|
{{- $envAll := . }}
|
|
|
|
{{/* Create one ClusterRole and PSP per PSP definition in values */}}
|
|
{{- range $pspName, $pspDetails := .Values.data }}
|
|
---
|
|
apiVersion: extensions/v1beta1
|
|
kind: PodSecurityPolicy
|
|
metadata:
|
|
name: {{ $pspName }}
|
|
labels:
|
|
{{ tuple $envAll "podsecuritypolicy" "policy" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }}
|
|
spec:
|
|
{{ toYaml $pspDetails | indent 2 }}
|
|
---
|
|
kind: ClusterRole
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: {{ $pspName }}
|
|
labels:
|
|
{{ tuple $envAll "podsecuritypolicy" "policy" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }}
|
|
rules:
|
|
- apiGroups: ['policy']
|
|
resources: ['podsecuritypolicies']
|
|
verbs: ['use']
|
|
resourceNames:
|
|
- {{ $pspName }}
|
|
{{- end }}
|
|
|
|
{{/* Configure ClusterRoles to bind to different subjects as defaults */}}
|
|
{{- range $rbacSubject, $defaultRole := .Values.conf.defaults }}
|
|
{{ if and $defaultRole (not (eq "nil" $defaultRole)) }}
|
|
---
|
|
kind: ClusterRoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
{{/* NOTE: the role name is included in the name of the binding below
|
|
for the sake of chart upgrades. The roleRef for a binding is immutable,
|
|
so if the the defaultRole changes, we need a different binding to
|
|
reflect that. This issue was only sporadic! */}}
|
|
name: psp-binding-for-{{- $rbacSubject -}}-{{- $defaultRole }}
|
|
labels:
|
|
{{ tuple $envAll "podsecuritypolicy" "policy" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }}
|
|
roleRef:
|
|
kind: ClusterRole
|
|
name: {{ $defaultRole }}
|
|
apiGroup: rbac.authorization.k8s.io
|
|
subjects:
|
|
- kind: Group
|
|
name: system:{{- $rbacSubject }}
|
|
apiGroup: rbac.authorization.k8s.io
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|