Merge pull request hashicorp#301 from hashicorp/psp-external

Update PodSecurityPolicy for exposeGossipPorts
duckhan · Dec 5, 2019 · f589822 · f589822
2 parents 1f8a357 + 96639c2
commit f589822
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 0 deletions.
diff --git a/templates/client-podsecuritypolicy.yaml b/templates/client-podsecuritypolicy.yaml
@@ -25,8 +25,16 @@ spec:
     - 'downwardAPI'
   hostNetwork: false
   hostPorts:
+  # HTTP Port
   - min: 8500
+    max: 8500
+  # gRPC Port
+  - min: 8502
     max: 8502
+  {{- if .Values.client.exposeGossipPorts }}
+  - min: 8301
+    max: 8301
+  {{- end }}
   hostIPC: false
   hostPID: false
   runAsUser:

diff --git a/test/unit/client-podsecuritypolicy.bats b/test/unit/client-podsecuritypolicy.bats
@@ -31,3 +31,17 @@ load _helpers
       yq -s 'length > 0' | tee /dev/stderr)
   [ "${actual}" = "true" ]
 }
+
+#--------------------------------------------------------------------
+# client.exposeGossipPorts
+
+@test "client/PodSecurityPolicy: hostPort 8301 allowed when exposeGossipPorts=true" {
+  cd `chart_dir`
+  local actual=$(helm template \
+      -x templates/client-podsecuritypolicy.yaml  \
+      --set 'global.enablePodSecurityPolicies=true' \
+      --set 'client.exposeGossipPorts=true' \
+      . | tee /dev/stderr |
+      yq -c '.spec.hostPorts' | tee /dev/stderr)
+  [ "${actual}" = '[{"min":8500,"max":8500},{"min":8502,"max":8502},{"min":8301,"max":8301}]' ]
+}