epostnikof/kubespray
1
0
Fork 0
mirror of https://github.com/kubernetes-sigs/kubespray.git synced 2026-02-28 09:39:12 +03:00
Code Issues Packages Projects Releases Wiki Activity

psp, roles and rbs for PodSecurityPolicy when podsecuritypolicy_enabled is true

Browse Source
This commit is contained in:
Erwan Miran
2018-08-22 18:16:13 +02:00
parent 4eea7f7eb9
commit 80cfeea957
48 changed files with 851 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
roles/kubernetes-apps/registry/tasks/main.yml
View File

@@ -8,15 +8,35 @@
group: root
mode: 0755
- name: Registry | Templates list
set_fact:
registry_templates:
- { name: registry-ns, file: registry-ns.yml, type: ns }
- { name: registry-sa, file: registry-sa.yml, type: sa }
- { name: registry-proxy-sa, file: registry-proxy-sa.yml, type: sa }
- { name: registry-svc, file: registry-svc.yml, type: svc }
- { name: registry-rs, file: registry-rs.yml, type: rs }
- { name: registry-proxy-ds, file: registry-proxy-ds.yml, type: ds }
registry_templates_for_psp:
- { name: registry-psp, file: registry-psp.yml, type: psp }
- { name: registry-cr, file: registry-cr.yml, type: clusterrole }
- { name: registry-crb, file: registry-crb.yml, type: rolebinding }
- { name: registry-proxy-psp, file: registry-proxy-psp.yml, type: psp }
- { name: registry-proxy-cr, file: registry-proxy-cr.yml, type: clusterrole }
- { name: registry-proxy-crb, file: registry-proxy-crb.yml, type: rolebinding }
- name: Registry | Append extra templates to Registry Templates list for PodSecurityPolicy
set_fact:
registry_templates: "{{ registry_templates[:3] + registry_templates_for_psp + registry_templates[4:] }}"
when:
- podsecuritypolicy_enabled
- registry_namespace != "kube-system"
- name: Registry | Create manifests
template:
src: "{{ item.file }}.j2"
dest: "{{ kube_config_dir }}/addons/registry/{{ item.file }}"
with_items:
- { name: registry-ns, file: registry-ns.yml, type: ns }
- { name: registry-svc, file: registry-svc.yml, type: svc }
- { name: registry-rs, file: registry-rs.yml, type: rs }
- { name: registry-proxy-ds, file: registry-proxy-ds.yml, type: ds }
with_items: "{{ registry_templates }}"
register: registry_manifests
when: inventory_hostname == groups['kube-master'][0]