From e732cf59e0ee68b00ffd689131759d9193ce3d64 Mon Sep 17 00:00:00 2001
From: LittleFox <littlefox@lf-net.org>
Date: Sun, 19 Apr 2020 11:47:41 +0200
Subject: [PATCH] [chart] Add PSP for logger (#1568)

Add PSP for logger

Co-authored-by: Vishal <vishal-biyani@users.noreply.github.com>
---
 charts/fission-all/templates/fluentbit.yaml | 58 +++++++++++++++++++++
 charts/fission-all/values.yaml              | 11 ++++
 2 files changed, 69 insertions(+)

diff --git a/charts/fission-all/templates/fluentbit.yaml b/charts/fission-all/templates/fluentbit.yaml
index 753eb361..cb8274c6 100644
--- a/charts/fission-all/templates/fluentbit.yaml
+++ b/charts/fission-all/templates/fluentbit.yaml
@@ -19,6 +19,64 @@ data:
 {{ else }}
 {{ fail "invalid chart" }}
 {{- end }}
+{{- if .Values.logger.podSecurityPolicy.enabled }}
+---
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: {{ .Release.Name }}-fission-logger-privileged
+  labels:
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    svc: logger
+spec:
+  privileged: true
+  seLinux:
+    rule: RunAsAny
+  supplementalGroups:
+    rule: RunAsAny
+  runAsUser:
+    rule: RunAsAny
+  fsGroup:
+    rule: RunAsAny
+  volumes:
+  - '*'
+  {{- if .Values.logger.podSecurityPolicy.additionalCapabilities }}
+  allowedCapabilities:
+  {{- range .Values.logger.podSecurityPolicy.additionalCapabilities }}
+  - {{ . }}
+  {{- end }}
+  {{- end }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: psp:{{ .Release.Name }}-fission-logger-privileged
+  labels:
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    svc: logger
+rules:
+- apiGroups: ['policy']
+  resources: ['podsecuritypolicies']
+  verbs:     ['use']
+  resourceNames:
+  - {{ .Release.Name }}-fission-logger-privileged
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: psp:{{ .Release.Name }}-fission-logger-privileged
+  labels:
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    svc: logger
+roleRef:
+  kind:     Role
+  name:     psp:{{ .Release.Name }}-fission-logger-privileged
+  apiGroup: rbac.authorization.k8s.io
+subjects:
+- kind:      ServiceAccount
+  name:      default
+  namespace: {{ .Release.Namespace }}
+{{- end }}
 ---
 apiVersion: apps/v1
 kind: DaemonSet
diff --git a/charts/fission-all/values.yaml b/charts/fission-all/values.yaml
index 3f8f61e0..ef521a16 100644
--- a/charts/fission-all/values.yaml
+++ b/charts/fission-all/values.yaml
@@ -76,6 +76,17 @@ logger:
   ## security context and set privileged to true.
   enableSecurityContext: false
 
+  ## Enable PodSecurityPolicies to allow privileged container
+  ## Only required in some clusters and when enableSecurityContext is true
+  podSecurityPolicy:
+    enabled: false
+   
+    ## Configure additional capabilities
+    additionalCapabilities:
+    # example values for linkerd
+    #- NET_RAW
+    #- NET_ADMIN
+
 executor:
   adoptExistingResources: false