psp, roles and rbs for PodSecurityPolicy when podsecuritypolicy_enabled is true

roles/kubernetes-apps/ingress_controller/ingress_nginx/tasks/main.yml

@@ -28,23 +28,34 @@
   when:
     - inventory_hostname == groups['kube-master'][0]
 
+- name: NGINX Ingress Controller | Templates list
+  set_fact:
+    ingress_nginx_templates:
+      - { name: 00-namespace, file: 00-namespace.yml, type: ns }
+      - { name: deploy-default-backend, file: deploy-default-backend.yml, type: deploy }
+      - { name: svc-default-backend, file: svc-default-backend.yml, type: svc }
+      - { name: cm-ingress-nginx, file: cm-ingress-nginx.yml, type: cm }
+      - { name: cm-tcp-services, file: cm-tcp-services.yml, type: cm }
+      - { name: cm-udp-services, file: cm-udp-services.yml, type: cm }
+      - { name: sa-ingress-nginx, file: sa-ingress-nginx.yml, type: sa }
+      - { name: clusterrole-ingress-nginx, file: clusterrole-ingress-nginx.yml, type: clusterrole }
+      - { name: clusterrolebinding-ingress-nginx, file: clusterrolebinding-ingress-nginx.yml, type: clusterrolebinding }
+      - { name: role-ingress-nginx, file: role-ingress-nginx.yml, type: role }
+      - { name: rolebinding-ingress-nginx, file: rolebinding-ingress-nginx.yml, type: rolebinding }
+      - { name: ds-ingress-nginx-controller, file: ds-ingress-nginx-controller.yml, type: ds }
+    ingress_nginx_templates_for_psp:
+      - { name: psp-ingress-nginx, file: psp-ingress-nginx.yml, type: podsecuritypolicy }
+
+- name: NGINX Ingress Controller | Append extra templates to NGINX Ingress Templates list for PodSecurityPolicy
+  set_fact:
+    ingress_nginx_templates: "{{ ingress_nginx_templates_for_psp + ingress_nginx_templates }}"
+  when: podsecuritypolicy_enabled
+
 - name: NGINX Ingress Controller | Create manifests
   template:
     src: "{{ item.file }}.j2"
     dest: "{{ kube_config_dir }}/addons/ingress_nginx/{{ item.file }}"
-  with_items:
-    - { name: 00-namespace, file: 00-namespace.yml, type: ns }
-    - { name: deploy-default-backend, file: deploy-default-backend.yml, type: deploy }
-    - { name: svc-default-backend, file: svc-default-backend.yml, type: svc }
-    - { name: cm-ingress-nginx, file: cm-ingress-nginx.yml, type: cm }
-    - { name: cm-tcp-services, file: cm-tcp-services.yml, type: cm }
-    - { name: cm-udp-services, file: cm-udp-services.yml, type: cm }
-    - { name: sa-ingress-nginx, file: sa-ingress-nginx.yml, type: sa }
-    - { name: clusterrole-ingress-nginx, file: clusterrole-ingress-nginx.yml, type: clusterrole }
-    - { name: clusterrolebinding-ingress-nginx, file: clusterrolebinding-ingress-nginx.yml, type: clusterrolebinding }
-    - { name: role-ingress-nginx, file: role-ingress-nginx.yml, type: role }
-    - { name: rolebinding-ingress-nginx, file: rolebinding-ingress-nginx.yml, type: rolebinding }
-    - { name: ds-ingress-nginx-controller, file: ds-ingress-nginx-controller.yml, type: ds }
+  with_items: "{{ ingress_nginx_templates }}"
   register: ingress_nginx_manifests
   when:
     - inventory_hostname == groups['kube-master'][0]

roles/kubernetes-apps/ingress_controller/ingress_nginx/templates/psp-ingress-nginx.yml.j2

@@ -0,0 +1,48 @@
+---
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: ingress-nginx
+  annotations:
+    seccomp.security.alpha.kubernetes.io/defaultProfileName:  'docker/default'
+    seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default'
+{% if apparmor_enabled %}
+    apparmor.security.beta.kubernetes.io/defaultProfileName:  'runtime/default'
+    apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
+{% endif %}
+  labels:
+    kubernetes.io/cluster-service: 'true'
+    addonmanager.kubernetes.io/mode: Reconcile
+spec:
+  privileged: false
+  allowPrivilegeEscalation: true
+  allowedCapabilities:
+    - NET_BIND_SERVICE
+  volumes:
+    - 'configMap'
+    - 'emptyDir'
+    - 'projected'
+    - 'secret'
+    - 'downwardAPI'
+    - 'persistentVolumeClaim'
+  hostNetwork: {{ ingress_nginx_host_network|bool }}
+  hostPorts:
+  - min: 0
+    max: 65535
+  hostIPC: false
+  hostPID: false
+  runAsUser:
+    rule: 'MustRunAsNonRoot'
+  seLinux:
+    rule: 'RunAsAny'
+  supplementalGroups:
+    rule: 'MustRunAs'
+    ranges:
+      - min: 1
+        max: 65535
+  fsGroup:
+    rule: 'MustRunAs'
+    ranges:
+      - min: 1
+        max: 65535
+  readOnlyRootFilesystem: false

roles/kubernetes-apps/ingress_controller/ingress_nginx/templates/role-ingress-nginx.yml.j2

@@ -22,3 +22,11 @@ rules:
   - apiGroups: [""]
     resources: ["endpoints"]
     verbs: ["get"]
+  - apiGroups:
+    - policy
+    resourceNames:
+    - ingress-nginx
+    resources:
+    - podsecuritypolicies
+    verbs:
+    - use