Skip to content

Commit aea9e9b

Browse files
FxKuFxKu
authored
postgres-pod clusterrole (#832)
* define postgres-pod clusterrole and align rbac in chart * align UI chart rbac with operator and update doc * operator RBAC needs podsecuritypolicy to grant it to postgres-pod
1 parent 4b440e5 commit aea9e9b

23 files changed

+333
-180
lines changed

‎charts/postgres-operator-ui/templates/_helpers.tpl

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,13 @@ If release name contains chart name it will be used as a full name.
2424
{{- end -}}
2525
{{- end -}}
2626

27+
{{/*
28+
Create a service account name.
29+
*/}}
30+
{{- define "postgres-operator-ui.serviceAccountName" -}}
31+
{{ default (include "postgres-operator-ui.fullname" .) .Values.serviceAccount.name }}
32+
{{- end -}}
33+
2734
{{/*
2835
Create chart name and version as used by the chart label.
2936
*/}}

‎charts/postgres-operator-ui/templates/clusterrole.yaml

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{{ if .Values.rbac.create }}
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: ClusterRole
4+
metadata:
5+
name: {{ include "postgres-operator-ui.serviceAccountName" . }}
6+
labels:
7+
app.kubernetes.io/name: {{ template "postgres-operator-ui.name" . }}
8+
helm.sh/chart: {{ template "postgres-operator-ui.chart" . }}
9+
app.kubernetes.io/managed-by: {{ .Release.Service }}
10+
app.kubernetes.io/instance: {{ .Release.Name }}
11+
rules:
12+
- apiGroups:
13+
- acid.zalan.do
14+
resources:
15+
- postgresqls
16+
verbs:
17+
- create
18+
- delete
19+
- get
20+
- list
21+
- patch
22+
- update
23+
- apiGroups:
24+
- ""
25+
resources:
26+
- pods
27+
verbs:
28+
- get
29+
- list
30+
- watch
31+
- apiGroups:
32+
- ""
33+
resources:
34+
- services
35+
verbs:
36+
- get
37+
- list
38+
- apiGroups:
39+
- apps
40+
resources:
41+
- statefulsets
42+
verbs:
43+
- get
44+
- list
45+
- apiGroups:
46+
- ""
47+
resources:
48+
- namespaces
49+
verbs:
50+
- get
51+
- list
52+
{{ end }}

‎charts/postgres-operator-ui/templates/clusterrolebinding.yaml

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{{ if .Values.rbac.create }}
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: ClusterRoleBinding
4+
metadata:
5+
name: {{ include "postgres-operator-ui.serviceAccountName" . }}
6+
labels:
7+
app.kubernetes.io/name: {{ template "postgres-operator-ui.name" . }}
8+
helm.sh/chart: {{ template "postgres-operator-ui.chart" . }}
9+
app.kubernetes.io/managed-by: {{ .Release.Service }}
10+
app.kubernetes.io/instance: {{ .Release.Name }}
11+
roleRef:
12+
apiGroup: rbac.authorization.k8s.io
13+
kind: ClusterRole
14+
name: {{ include "postgres-operator-ui.serviceAccountName" . }}
15+
subjects:
16+
- kind: ServiceAccount
17+
name: {{ include "postgres-operator-ui.serviceAccountName" . }}
18+
namespace: {{ .Release.Namespace }}
19+
{{ end }}

‎charts/postgres-operator-ui/templates/deployment.yaml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ spec:
2020
app.kubernetes.io/instance: {{ .Release.Name }}
2121
team: "acid" # Parameterize?
2222
spec:
23-
serviceAccountName: {{ template "postgres-operator-ui.name" . }}
23+
serviceAccountName: {{ include "postgres-operator-ui.serviceAccountName" . }}
2424
containers:
2525
- name: "service"
2626
image: "{{ .Values.image.registry }}/{{ .Values.image.repository }}:{{ .Values.image.tag }}"
@@ -45,8 +45,8 @@ spec:
4545
value: {{ .Values.envs.targetNamespace }}
4646
- name: "TEAMS"
4747
value: |-
48-
[
49-
"acid"
48+
[
49+
"acid"
5050
]
5151
- name: "OPERATOR_UI_CONFIG"
5252
value: |-
@@ -66,4 +66,4 @@ spec:
6666
"9.6",
6767
"9.5"
6868
]
69-
}
69+
}

‎charts/postgres-operator-ui/templates/serviceaccount.yaml

Lines changed: 3 additions & 73 deletions
Original file line numberDiff line numberDiff line change
@@ -1,81 +1,11 @@
1+
{{ if .Values.serviceAccount.create }}
12
apiVersion: v1
23
kind: ServiceAccount
34
metadata:
4-
name: {{ template "postgres-operator-ui.name" . }}
5+
name: {{ include "postgres-operator-ui.serviceAccountName" . }}
56
labels:
67
app.kubernetes.io/name: {{ template "postgres-operator-ui.name" . }}
78
helm.sh/chart: {{ template "postgres-operator-ui.chart" . }}
89
app.kubernetes.io/managed-by: {{ .Release.Service }}
910
app.kubernetes.io/instance: {{ .Release.Name }}
10-
11-
---
12-
apiVersion: rbac.authorization.k8s.io/v1
13-
kind: ClusterRole
14-
metadata:
15-
name: {{ template "postgres-operator-ui.name" . }}
16-
labels:
17-
app.kubernetes.io/name: {{ template "postgres-operator-ui.name" . }}
18-
helm.sh/chart: {{ template "postgres-operator-ui.chart" . }}
19-
app.kubernetes.io/managed-by: {{ .Release.Service }}
20-
app.kubernetes.io/instance: {{ .Release.Name }}
21-
rules:
22-
- apiGroups:
23-
- acid.zalan.do
24-
resources:
25-
- postgresqls
26-
verbs:
27-
- create
28-
- delete
29-
- get
30-
- list
31-
- patch
32-
- update
33-
- apiGroups:
34-
- ""
35-
resources:
36-
- pods
37-
verbs:
38-
- get
39-
- list
40-
- watch
41-
- apiGroups:
42-
- ""
43-
resources:
44-
- services
45-
verbs:
46-
- get
47-
- list
48-
- apiGroups:
49-
- apps
50-
resources:
51-
- statefulsets
52-
verbs:
53-
- get
54-
- list
55-
- apiGroups:
56-
- ""
57-
resources:
58-
- namespaces
59-
verbs:
60-
- get
61-
- list
62-
---
63-
apiVersion: rbac.authorization.k8s.io/v1
64-
kind: ClusterRoleBinding
65-
metadata:
66-
name: {{ template "postgres-operator-ui.name" . }}
67-
labels:
68-
app.kubernetes.io/name: {{ template "postgres-operator-ui.name" . }}
69-
helm.sh/chart: {{ template "postgres-operator-ui.chart" . }}
70-
app.kubernetes.io/managed-by: {{ .Release.Service }}
71-
app.kubernetes.io/instance: {{ .Release.Name }}
72-
roleRef:
73-
apiGroup: rbac.authorization.k8s.io
74-
kind: ClusterRole
75-
name: {{ template "postgres-operator-ui.name" . }}
76-
subjects:
77-
- kind: ServiceAccount
78-
# note: the cluster role binding needs to be defined
79-
# for every namespace the operator-ui service account lives in.
80-
name: {{ template "postgres-operator-ui.name" . }}
81-
namespace: {{ .Release.Namespace }}
11+
{{ end }}

‎charts/postgres-operator-ui/values.yaml

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,17 @@ image:
1111
tag: v1.2.0
1212
pullPolicy: "IfNotPresent"
1313

14+
rbac:
15+
# Specifies whether RBAC resources should be created
16+
create: true
17+
18+
serviceAccount:
19+
# Specifies whether a ServiceAccount should be created
20+
create: true
21+
# The name of the ServiceAccount to use.
22+
# If not set and create is true, a name is generated using the fullname template
23+
name:
24+
1425
# configure UI pod resources
1526
resources:
1627
limits:
@@ -22,7 +33,7 @@ resources:
2233

2334
# configure UI ENVs
2435
envs:
25-
# IMPORTANT: While operator chart and UI chart are idendependent, this is the interface between
36+
# IMPORTANT: While operator chart and UI chart are idendependent, this is the interface between
2637
# UI and operator API. Insert the service name of the operator API here!
2738
operatorApiUrl: "http://postgres-operator:8080"
2839
targetNamespace: "default"
@@ -44,4 +55,4 @@ ingress:
4455
tls: []
4556
# - secretName: ui-tls
4657
# hosts:
47-
# - ui.exmaple.org
58+
# - ui.exmaple.org

‎charts/postgres-operator/templates/clusterrole-postgres-pod.yaml

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
{{ if .Values.rbac.create }}
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: ClusterRole
4+
metadata:
5+
name: postgres-pod
6+
labels:
7+
app.kubernetes.io/name: {{ template "postgres-operator.name" . }}
8+
helm.sh/chart: {{ template "postgres-operator.chart" . }}
9+
app.kubernetes.io/managed-by: {{ .Release.Service }}
10+
app.kubernetes.io/instance: {{ .Release.Name }}
11+
rules:
12+
# Patroni needs to watch and manage endpoints
13+
- apiGroups:
14+
- ""
15+
resources:
16+
- endpoints
17+
verbs:
18+
- create
19+
- delete
20+
- deletecollection
21+
- get
22+
- list
23+
- patch
24+
- update
25+
- watch
26+
# Patroni needs to watch pods
27+
- apiGroups:
28+
- ""
29+
resources:
30+
- pods
31+
verbs:
32+
- get
33+
- list
34+
- patch
35+
- update
36+
- watch
37+
# to let Patroni create a headless service
38+
- apiGroups:
39+
- ""
40+
resources:
41+
- services
42+
verbs:
43+
- create
44+
# to run privileged pods
45+
- apiGroups:
46+
- extensions
47+
resources:
48+
- podsecuritypolicies
49+
resourceNames:
50+
- privileged
51+
verbs:
52+
- use
53+
{{ end }}

0 commit comments

Comments
 (0)