psp, roles and rbs for PodSecurityPolicy when podsecuritypolicy_enabled is true

roles/kubernetes-apps/registry/tasks/main.yml

@@ -8,15 +8,35 @@
     group: root
     mode: 0755
 
+- name: Registry | Templates list
+  set_fact:
+    registry_templates:
+      - { name: registry-ns, file: registry-ns.yml, type: ns }
+      - { name: registry-sa, file: registry-sa.yml, type: sa }
+      - { name: registry-proxy-sa, file: registry-proxy-sa.yml, type: sa }
+      - { name: registry-svc, file: registry-svc.yml, type: svc }
+      - { name: registry-rs, file: registry-rs.yml, type: rs }
+      - { name: registry-proxy-ds, file: registry-proxy-ds.yml, type: ds }
+    registry_templates_for_psp:
+      - { name: registry-psp, file: registry-psp.yml, type: psp }
+      - { name: registry-cr, file: registry-cr.yml, type: clusterrole }
+      - { name: registry-crb, file: registry-crb.yml, type: rolebinding }
+      - { name: registry-proxy-psp, file: registry-proxy-psp.yml, type: psp }
+      - { name: registry-proxy-cr, file: registry-proxy-cr.yml, type: clusterrole }
+      - { name: registry-proxy-crb, file: registry-proxy-crb.yml, type: rolebinding }
+
+- name: Registry | Append extra templates to Registry Templates list for PodSecurityPolicy
+  set_fact:
+    registry_templates: "{{ registry_templates[:3] + registry_templates_for_psp + registry_templates[4:] }}"
+  when:
+    - podsecuritypolicy_enabled
+    - registry_namespace != "kube-system"
+
 - name: Registry | Create manifests
   template:
     src: "{{ item.file }}.j2"
     dest: "{{ kube_config_dir }}/addons/registry/{{ item.file }}"
-  with_items:
-    - { name: registry-ns, file: registry-ns.yml, type: ns }
-    - { name: registry-svc, file: registry-svc.yml, type: svc }
-    - { name: registry-rs, file: registry-rs.yml, type: rs }
-    - { name: registry-proxy-ds, file: registry-proxy-ds.yml, type: ds }
+  with_items: "{{ registry_templates }}"
   register: registry_manifests
   when: inventory_hostname == groups['kube-master'][0]
 

roles/kubernetes-apps/registry/templates/registry-cr.yml.j2

@@ -0,0 +1,15 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRole
+metadata:
+  name: psp:registry
+  namespace: {{ registry_namespace }}
+rules:
+  - apiGroups:
+    - policy
+    resourceNames:
+    - registry
+    resources:
+    - podsecuritypolicies
+    verbs:
+    - use

roles/kubernetes-apps/registry/templates/registry-crb.yml.j2

@@ -0,0 +1,13 @@
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1beta1
+metadata:
+  name: psp:registry
+  namespace: {{ registry_namespace }}
+subjects:
+  - kind: ServiceAccount
+    name: registry
+    namespace: {{ registry_namespace }}
+roleRef:
+  kind: ClusterRole
+  name: psp:registry
+  apiGroup: rbac.authorization.k8s.io

roles/kubernetes-apps/registry/templates/registry-proxy-cr.yml.j2

@@ -0,0 +1,15 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRole
+metadata:
+  name: psp:registry-proxy
+  namespace: {{ registry_namespace }}
+rules:
+  - apiGroups:
+    - policy
+    resourceNames:
+    - registry-proxy
+    resources:
+    - podsecuritypolicies
+    verbs:
+    - use

roles/kubernetes-apps/registry/templates/registry-proxy-crb.yml.j2

@@ -0,0 +1,13 @@
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1beta1
+metadata:
+  name: psp:registry-proxy
+  namespace: {{ registry_namespace }}
+subjects:
+  - kind: ServiceAccount
+    name: registry-proxy
+    namespace: {{ registry_namespace }}
+roleRef:
+  kind: ClusterRole
+  name: psp:registry-proxy
+  apiGroup: rbac.authorization.k8s.io

roles/kubernetes-apps/registry/templates/registry-proxy-ds.yml.j2

@@ -21,6 +21,9 @@ spec:
         kubernetes.io/cluster-service: "true"
         version: v{{ registry_proxy_image_tag }}
     spec:
+{% if rbac_enabled %}
+      serviceAccountName: registry-proxy
+{% endif %}
       containers:
         - name: registry-proxy
           image: {{ registry_proxy_image_repo }}:{{ registry_proxy_image_tag }}

roles/kubernetes-apps/registry/templates/registry-proxy-psp.yml.j2

@@ -0,0 +1,48 @@
+---
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: registry-proxy
+  annotations:
+    seccomp.security.alpha.kubernetes.io/defaultProfileName:  'docker/default'
+    seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default'
+{% if apparmor_enabled %}
+    apparmor.security.beta.kubernetes.io/defaultProfileName:  'runtime/default'
+    apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
+{% endif %}
+  labels:
+    kubernetes.io/cluster-service: 'true'
+    addonmanager.kubernetes.io/mode: Reconcile
+spec:
+  privileged: false
+  allowPrivilegeEscalation: false
+  requiredDropCapabilities:
+    - ALL
+  volumes:
+    - 'configMap'
+    - 'emptyDir'
+    - 'projected'
+    - 'secret'
+    - 'downwardAPI'
+    - 'persistentVolumeClaim'
+  hostNetwork: true
+  hostPorts:
+  - min: 5000
+    max: 5000
+  hostIPC: false
+  hostPID: false
+  runAsUser:
+    rule: 'RunAsAny'
+  seLinux:
+    rule: 'RunAsAny'
+  supplementalGroups:
+    rule: 'MustRunAs'
+    ranges:
+      - min: 1
+        max: 65535
+  fsGroup:
+    rule: 'MustRunAs'
+    ranges:
+      - min: 1
+        max: 65535
+  readOnlyRootFilesystem: false

roles/kubernetes-apps/registry/templates/registry-proxy-sa.yml.j2

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: registry-proxy
+  namespace: {{ registry_namespace }}
+  labels:
+    kubernetes.io/cluster-service: "true"

roles/kubernetes-apps/registry/templates/registry-psp.yml.j2

@@ -0,0 +1,45 @@
+---
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: registry
+  annotations:
+    seccomp.security.alpha.kubernetes.io/defaultProfileName:  'docker/default'
+    seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default'
+{% if apparmor_enabled %}
+    apparmor.security.beta.kubernetes.io/defaultProfileName:  'runtime/default'
+    apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
+{% endif %}
+  labels:
+    kubernetes.io/cluster-service: 'true'
+    addonmanager.kubernetes.io/mode: Reconcile
+spec:
+  privileged: false
+  allowPrivilegeEscalation: false
+  requiredDropCapabilities:
+    - ALL
+  volumes:
+    - 'configMap'
+    - 'emptyDir'
+    - 'projected'
+    - 'secret'
+    - 'downwardAPI'
+    - 'persistentVolumeClaim'
+  hostNetwork: false
+  hostIPC: false
+  hostPID: false
+  runAsUser:
+    rule: 'RunAsAny'
+  seLinux:
+    rule: 'RunAsAny'
+  supplementalGroups:
+    rule: 'MustRunAs'
+    ranges:
+      - min: 1
+        max: 65535
+  fsGroup:
+    rule: 'MustRunAs'
+    ranges:
+      - min: 1
+        max: 65535
+  readOnlyRootFilesystem: false

roles/kubernetes-apps/registry/templates/registry-rs.yml.j2

@@ -22,6 +22,9 @@ spec:
         version: v{{ registry_image_tag }}
         kubernetes.io/cluster-service: "true"
     spec:
+{% if rbac_enabled %}
+      serviceAccountName: registry
+{% endif %}
       containers:
         - name: registry
           image: {{ registry_image_repo }}:{{ registry_image_tag }}

roles/kubernetes-apps/registry/templates/registry-sa.yml.j2

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: registry
+  namespace: {{ registry_namespace }}
+  labels:
+    kubernetes.io/cluster-service: "true"