define PodSecurityPolicy to fluentd and fluentbit

DoNnMyTh · May 24, 2019 · c083af0 · c083af0
1 parent da3d2ed
commit c083af0
Show file tree

Hide file tree

Showing 5 changed files with 132 additions and 2 deletions.
diff --git a/logging-operator-fluent/Chart.yaml b/logging-operator-fluent/Chart.yaml
@@ -1,7 +1,7 @@
 apiVersion: v1
 description: Logging operator CR for Fluentd and Fluent-bit.
 name: logging-operator-fluent
-version: 0.1.0
+version: 0.1.1
 home: https://github.com/banzaicloud/logging-operator
 icon: https://banzaicloud.com/img/banzai-cloud-logo.png
 keywords:

diff --git a/logging-operator-fluent/README.md b/logging-operator-fluent/README.md
@@ -44,3 +44,4 @@ This chart applies Fluentd and Fluent-bit custom resources to [Logging Operator]
 | `fluentd.configReloaderImage.pullPolicy`            | Fluentd configReloaderImage container pull policy      | `IfNotPresent`                 |
 | `fluentd.fluentdPvcSpec.accessModes`                | Fluentd persistence volume access modes                | `[ReadWriteOnce]`              |
 | `fluentd.fluentdPvcSpec.resources.requests.storage` | Fluentd persistence volume size                        | `21Gi`                         |
+| `psp.enabled`                                       | Install PodSecurityPolicy                              | `fales`                        |
diff --git a/logging-operator-fluent/templates/psp.yaml b/logging-operator-fluent/templates/psp.yaml
@@ -0,0 +1,55 @@
+{{ if .Values.psp.enabled }}
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  creationTimestamp: null
+  name: psp.fluent-bit
+  annotations:
+    seccomp.security.alpha.kubernetes.io/defaultProfileName:  'docker/default'
+    seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default' 
+spec:
+  allowedHostPaths:
+  - pathPrefix: /var/lib/docker/containers
+    readOnly: true
+  - pathPrefix: /var/log
+    readOnly: true
+  fsGroup:
+    rule: RunAsAny
+  readOnlyRootFilesystem: true
+  allowPrivilegeEscalation: false
+  runAsUser:
+    rule: RunAsAny
+  seLinux:
+    rule: RunAsAny
+  supplementalGroups:
+    rule: RunAsAny
+  volumes:
+  - configMap
+  - emptyDir
+  - secret
+  - hostPath
+---
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  creationTimestamp: null
+  name: psp.fluentd
+  annotations:
+    seccomp.security.alpha.kubernetes.io/defaultProfileName:  'docker/default'
+    seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default' 
+spec:
+  fsGroup:
+    rule: RunAsAny
+  allowPrivilegeEscalation: false
+  runAsUser:
+    rule: RunAsAny
+  seLinux:
+    rule: RunAsAny
+  supplementalGroups:
+    rule: RunAsAny
+  volumes:
+  - configMap
+  - emptyDir
+  - secret
+  - persistentVolumeClaim
+{{ end }}
diff --git a/logging-operator-fluent/templates/rbac.yaml b/logging-operator-fluent/templates/rbac.yaml
@@ -0,0 +1,71 @@
+{{ if .Values.psp.enabled }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ template "logging-operator-fluent.fullname" . }}-fluent-bit
+  namespace: {{ .Release.Namespace }}
+  labels:
+    kubernetes.io/cluster-service: "true"
+    addonmanager.kubernetes.io/mode: Reconcile
+rules:
+- apiGroups:
+  - policy
+  resourceNames:
+  - psp.fluent-bit
+  resources:
+  - podsecuritypolicies
+  verbs:
+  - use
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ template "logging-operator-fluent.fullname" . }}-fluentd
+  namespace: {{ .Release.Namespace }}
+  labels:
+    kubernetes.io/cluster-service: "true"
+    addonmanager.kubernetes.io/mode: Reconcile
+rules:
+- apiGroups:
+  - policy
+  resourceNames:
+  - psp.fluentd
+  resources:
+  - podsecuritypolicies
+  verbs:
+  - use
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "logging-operator-fluent.fullname" . }}-fluent-bit
+  namespace: {{ .Release.Namespace }}
+  labels:
+    addonmanager.kubernetes.io/mode: Reconcile
+    kubernetes.io/cluster-service: 'true'
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "logging-operator-fluent.fullname" . }}-fluent-bit
+subjects:
+  - kind: ServiceAccount
+    name: logging
+    namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "logging-operator-fluent.fullname" . }}-fluentd
+  namespace: {{ .Release.Namespace }}
+  labels:
+    addonmanager.kubernetes.io/mode: Reconcile
+    kubernetes.io/cluster-service: 'true'
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "logging-operator-fluent.fullname" . }}-fluentd
+subjects:
+  - kind: ServiceAccount
+    name: logging-fluentd
+    namespace: {{ .Release.Namespace }}
+{{ end }}
diff --git a/logging-operator-fluent/values.yaml b/logging-operator-fluent/values.yaml
@@ -35,4 +35,7 @@ fluentd:
       - ReadWriteOnce
     resources:
       requests:
-        storage: 21Gi
+        storage: 21Gi
+
+psp:
+  enabled: false