epostnikof/kubespray
1
0
Fork 0
mirror of https://github.com/kubernetes-sigs/kubespray.git synced 2026-02-28 09:39:12 +03:00
Code Issues Packages Projects Releases Wiki Activity

psp, roles and rbs for PodSecurityPolicy when podsecuritypolicy_enabled is true

Browse Source
This commit is contained in:
Erwan Miran
2018-08-22 18:16:13 +02:00
parent 4eea7f7eb9
commit 80cfeea957
48 changed files with 851 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
roles/kubernetes-apps/registry/templates/registry-cr.yml.j2 Normal file
View File

@@ -0,0 +1,15 @@
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
name: psp:registry
namespace: {{ registry_namespace }}
rules:
- apiGroups:
- policy
resourceNames:
- registry
resources:
- podsecuritypolicies
verbs:
- use

13
roles/kubernetes-apps/registry/templates/registry-crb.yml.j2 Normal file
View File

@@ -0,0 +1,13 @@
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: psp:registry
namespace: {{ registry_namespace }}
subjects:
- kind: ServiceAccount
name: registry
namespace: {{ registry_namespace }}
roleRef:
kind: ClusterRole
name: psp:registry
apiGroup: rbac.authorization.k8s.io

15
roles/kubernetes-apps/registry/templates/registry-proxy-cr.yml.j2 Normal file
View File

@@ -0,0 +1,15 @@
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
name: psp:registry-proxy
namespace: {{ registry_namespace }}
rules:
- apiGroups:
- policy
resourceNames:
- registry-proxy
resources:
- podsecuritypolicies
verbs:
- use

13
roles/kubernetes-apps/registry/templates/registry-proxy-crb.yml.j2 Normal file
View File

@@ -0,0 +1,13 @@
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: psp:registry-proxy
namespace: {{ registry_namespace }}
subjects:
- kind: ServiceAccount
name: registry-proxy
namespace: {{ registry_namespace }}
roleRef:
kind: ClusterRole
name: psp:registry-proxy
apiGroup: rbac.authorization.k8s.io

3
roles/kubernetes-apps/registry/templates/registry-proxy-ds.yml.j2
View File

@@ -21,6 +21,9 @@ spec:
kubernetes.io/cluster-service: "true"
version: v{{ registry_proxy_image_tag }}
spec:
{% if rbac_enabled %}
serviceAccountName: registry-proxy
{% endif %}
containers:
- name: registry-proxy
image: {{ registry_proxy_image_repo }}:{{ registry_proxy_image_tag }}

48
roles/kubernetes-apps/registry/templates/registry-proxy-psp.yml.j2 Normal file
View File

@@ -0,0 +1,48 @@
---
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: registry-proxy
annotations:
seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default'
seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default'
{% if apparmor_enabled %}
apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
{% endif %}
labels:
kubernetes.io/cluster-service: 'true'
addonmanager.kubernetes.io/mode: Reconcile
spec:
privileged: false
allowPrivilegeEscalation: false
requiredDropCapabilities:
- ALL
volumes:
- 'configMap'
- 'emptyDir'
- 'projected'
- 'secret'
- 'downwardAPI'
- 'persistentVolumeClaim'
hostNetwork: true
hostPorts:
- min: 5000
max: 5000
hostIPC: false
hostPID: false
runAsUser:
rule: 'RunAsAny'
seLinux:
rule: 'RunAsAny'
supplementalGroups:
rule: 'MustRunAs'
ranges:
- min: 1
max: 65535
fsGroup:
rule: 'MustRunAs'
ranges:
- min: 1
max: 65535
readOnlyRootFilesystem: false

7
roles/kubernetes-apps/registry/templates/registry-proxy-sa.yml.j2 Normal file
View File

@@ -0,0 +1,7 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: registry-proxy
namespace: {{ registry_namespace }}
labels:
kubernetes.io/cluster-service: "true"

45
roles/kubernetes-apps/registry/templates/registry-psp.yml.j2 Normal file
View File

@@ -0,0 +1,45 @@
---
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: registry
annotations:
seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default'
seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default'
{% if apparmor_enabled %}
apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
{% endif %}
labels:
kubernetes.io/cluster-service: 'true'
addonmanager.kubernetes.io/mode: Reconcile
spec:
privileged: false
allowPrivilegeEscalation: false
requiredDropCapabilities:
- ALL
volumes:
- 'configMap'
- 'emptyDir'
- 'projected'
- 'secret'
- 'downwardAPI'
- 'persistentVolumeClaim'
hostNetwork: false
hostIPC: false
hostPID: false
runAsUser:
rule: 'RunAsAny'
seLinux:
rule: 'RunAsAny'
supplementalGroups:
rule: 'MustRunAs'
ranges:
- min: 1
max: 65535
fsGroup:
rule: 'MustRunAs'
ranges:
- min: 1
max: 65535
readOnlyRootFilesystem: false

3
roles/kubernetes-apps/registry/templates/registry-rs.yml.j2
View File

@@ -22,6 +22,9 @@ spec:
version: v{{ registry_image_tag }}
kubernetes.io/cluster-service: "true"
spec:
{% if rbac_enabled %}
serviceAccountName: registry
{% endif %}
containers:
- name: registry
image: {{ registry_image_repo }}:{{ registry_image_tag }}

7
roles/kubernetes-apps/registry/templates/registry-sa.yml.j2 Normal file
View File

@@ -0,0 +1,7 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: registry
namespace: {{ registry_namespace }}
labels:
kubernetes.io/cluster-service: "true"