Allow projected volumes in elasticsearch, logstash and metricbeat

Allow specification of PodSecurityPolicy in metricbeat/values.yml Signed-off-by: Karl-Philipp Richter <krichter@posteo.de>
elastic · May 21, 2020 · c68b80e · c68b80e
1 parent fe52a62
commit c68b80e
Show file tree

Hide file tree

Showing 4 changed files with 35 additions and 0 deletions.
diff --git a/elasticsearch/values.yaml b/elasticsearch/values.yaml
@@ -114,6 +114,7 @@ podSecurityPolicy:
       - secret
       - configMap
       - persistentVolumeClaim
+      - projected
 
 persistence:
   enabled: true

diff --git a/logstash/values.yaml b/logstash/values.yaml
@@ -89,6 +89,7 @@ podSecurityPolicy:
       - secret
       - configMap
       - persistentVolumeClaim
+      - projected
 
 persistence:
   enabled: false

diff --git a/metricbeat/templates/podsecuritypolicy.yaml b/metricbeat/templates/podsecuritypolicy.yaml
@@ -0,0 +1,14 @@
+{{- if .Values.podSecurityPolicy.create -}}
+{{- $fullName := include "metricbeat.fullname" . -}}
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: {{ default $fullName .Values.podSecurityPolicy.name | quote }}
+  labels:
+    app: "{{ template "metricbeat.fullname" . }}"
+    chart: "{{ .Chart.Name }}"
+    heritage: {{ .Release.Service | quote }}
+    release: {{ .Release.Name | quote }}
+spec:
+{{ toYaml .Values.podSecurityPolicy.spec | indent 2 }}
+{{- end -}}
diff --git a/metricbeat/values.yaml b/metricbeat/values.yaml
@@ -218,6 +218,25 @@ clusterRoleRules:
   - nodes/stats
   verbs: ["get"]
 
+podSecurityPolicy:
+  create: false
+  name: ""
+  spec:
+    privileged: true
+    fsGroup:
+      rule: RunAsAny
+    runAsUser:
+      rule: RunAsAny
+    seLinux:
+      rule: RunAsAny
+    supplementalGroups:
+      rule: RunAsAny
+    volumes:
+      - secret
+      - configMap
+      - persistentVolumeClaim
+      - projected
+
 podAnnotations: {}
   # iam.amazonaws.com/role: es-cluster