diff --git a/packages/rancher-monitoring/rancher-pushprox/charts/templates/pushprox-clients-rbac.yaml b/packages/rancher-monitoring/rancher-pushprox/charts/templates/pushprox-clients-rbac.yaml index 319da6ede..9cf5dd0bf 100644 --- a/packages/rancher-monitoring/rancher-pushprox/charts/templates/pushprox-clients-rbac.yaml +++ b/packages/rancher-monitoring/rancher-pushprox/charts/templates/pushprox-clients-rbac.yaml @@ -6,10 +6,12 @@ metadata: name: {{ template "pushProxy.client.name" . }} labels: {{ include "pushProxy.client.labels" . | nindent 4 }} rules: +{{- if .Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicies" }} - apiGroups: ['policy'] resources: ['podsecuritypolicies'] verbs: ['use'] resourceNames: +{{- end }} - {{ template "pushProxy.client.name" . }} {{- if and .Values.clients.https.enabled .Values.clients.https.useServiceAccountCredentials }} - nonResourceURLs: ["/metrics"] @@ -40,6 +42,7 @@ metadata: namespace: {{ include "pushprox.namespace" . }} labels: {{ include "pushProxy.client.labels" . | nindent 4 }} --- +{{- if .Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicies" }} apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: @@ -78,4 +81,5 @@ spec: - pathPrefix: {{ required "Need access to volume on host with the SSL cert files to use HTTPs" .Values.clients.https.certDir }} readOnly: true {{- end }} +{{- end }} {{- end }}{{- end }} \ No newline at end of file diff --git a/packages/rancher-monitoring/rancher-pushprox/charts/templates/pushprox-proxy-rbac.yaml b/packages/rancher-monitoring/rancher-pushprox/charts/templates/pushprox-proxy-rbac.yaml index e7eb0fd6d..e71c46c81 100644 --- a/packages/rancher-monitoring/rancher-pushprox/charts/templates/pushprox-proxy-rbac.yaml +++ b/packages/rancher-monitoring/rancher-pushprox/charts/templates/pushprox-proxy-rbac.yaml @@ -6,10 +6,12 @@ metadata: name: {{ template "pushProxy.proxy.name" . }} labels: {{ include "pushProxy.proxy.labels" . | nindent 4 }} rules: +{{- if .Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicies" }} - apiGroups: ['policy'] resources: ['podsecuritypolicies'] verbs: ['use'] resourceNames: + {{- end }} - {{ template "pushProxy.proxy.name" . }} --- apiVersion: rbac.authorization.k8s.io/v1 @@ -33,6 +35,7 @@ metadata: namespace: {{ include "pushprox.namespace" . }} labels: {{ include "pushProxy.proxy.labels" . | nindent 4 }} --- +{{- if .Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicies" }} apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: @@ -62,3 +65,4 @@ spec: volumes: - 'secret' {{- end }}{{- end }} +{{- end }}