andata
/
rancher-charts
mirror of https://git.rancher.io/charts
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

psp changes for pushprox

pull/2282/head
Geet Samra 2022-12-20 13:49:22 -08:00
parent d6d67f4d33
commit 9859369453
2 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
packages/rancher-monitoring/rancher-pushprox/charts/templates/pushprox-clients-rbac.yaml
View File

@ -6,10 +6,12 @@ metadata:
name: {{ template "pushProxy.client.name" . }} name: {{ template "pushProxy.client.name" . }}
labels: {{ include "pushProxy.client.labels" . | nindent 4 }} labels: {{ include "pushProxy.client.labels" . | nindent 4 }}
rules: rules:
{{- if .Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicies" }}
- apiGroups: ['policy'] - apiGroups: ['policy']
resources: ['podsecuritypolicies'] resources: ['podsecuritypolicies']
verbs: ['use'] verbs: ['use']
resourceNames: resourceNames:
{{- end }}
- {{ template "pushProxy.client.name" . }} - {{ template "pushProxy.client.name" . }}
{{- if and .Values.clients.https.enabled .Values.clients.https.useServiceAccountCredentials }} {{- if and .Values.clients.https.enabled .Values.clients.https.useServiceAccountCredentials }}
- nonResourceURLs: ["/metrics"] - nonResourceURLs: ["/metrics"]
@ -40,6 +42,7 @@ metadata:
namespace: {{ include "pushprox.namespace" . }} namespace: {{ include "pushprox.namespace" . }}
labels: {{ include "pushProxy.client.labels" . | nindent 4 }} labels: {{ include "pushProxy.client.labels" . | nindent 4 }}
--- ---
{{- if .Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicies" }}
apiVersion: policy/v1beta1 apiVersion: policy/v1beta1
kind: PodSecurityPolicy kind: PodSecurityPolicy
metadata: metadata:
@ -78,4 +81,5 @@ spec:
- pathPrefix: {{ required "Need access to volume on host with the SSL cert files to use HTTPs" .Values.clients.https.certDir }} - pathPrefix: {{ required "Need access to volume on host with the SSL cert files to use HTTPs" .Values.clients.https.certDir }}
readOnly: true readOnly: true
{{- end }} {{- end }}
{{- end }}
{{- end }}{{- end }} {{- end }}{{- end }}

4
packages/rancher-monitoring/rancher-pushprox/charts/templates/pushprox-proxy-rbac.yaml
View File

@ -6,10 +6,12 @@ metadata:
name: {{ template "pushProxy.proxy.name" . }} name: {{ template "pushProxy.proxy.name" . }}
labels: {{ include "pushProxy.proxy.labels" . | nindent 4 }} labels: {{ include "pushProxy.proxy.labels" . | nindent 4 }}
rules: rules:
{{- if .Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicies" }}
- apiGroups: ['policy'] - apiGroups: ['policy']
resources: ['podsecuritypolicies'] resources: ['podsecuritypolicies']
verbs: ['use'] verbs: ['use']
resourceNames: resourceNames:
{{- end }}
- {{ template "pushProxy.proxy.name" . }} - {{ template "pushProxy.proxy.name" . }}
--- ---
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
@ -33,6 +35,7 @@ metadata:
namespace: {{ include "pushprox.namespace" . }} namespace: {{ include "pushprox.namespace" . }}
labels: {{ include "pushProxy.proxy.labels" . | nindent 4 }} labels: {{ include "pushProxy.proxy.labels" . | nindent 4 }}
--- ---
{{- if .Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicies" }}
apiVersion: policy/v1beta1 apiVersion: policy/v1beta1
kind: PodSecurityPolicy kind: PodSecurityPolicy
metadata: metadata:
@ -62,3 +65,4 @@ spec:
volumes: volumes:
- 'secret' - 'secret'
{{- end }}{{- end }} {{- end }}{{- end }}
{{- end }}