public_git
/
postgres-operator
mirror of https://github.com/zalando/postgres-operator.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Allow extra customisations of pod security policies in the chart

This commit is contained in:
wilsonge 2022-02-26 11:35:00 +00:00
parent 95301c102e
commit 3d47849eed
No known key found for this signature in database
GPG Key ID: EF81319318FC9D04
3 changed files with 9 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
charts/postgres-operator/templates/clusterrole-postgres-pod.yaml
View File

@ -63,14 +63,14 @@ rules:
- services - services
verbs: verbs:
- create - create
{{- if toString .Values.configKubernetes.spilo_privileged | eq "true" }} {{- if or (toString .Values.configKubernetes.spilo_privileged | eq "true") (.Values.rbac.spiloRunWithPsp) }}
# to run privileged pods # to run privileged pods
- apiGroups: - apiGroups:
- extensions - extensions
resources: resources:
- podsecuritypolicies - podsecuritypolicies
resourceNames: resourceNames:
- privileged - {{ .Values.rbac.spiloPrivilegedPodSecurityPolicy }}
verbs: verbs:
- use - use
{{- end }} {{- end }}

4
charts/postgres-operator/templates/clusterrole.yaml
View File

@ -230,14 +230,14 @@ rules:
verbs: verbs:
- get - get
- create - create
{{- if toString .Values.configKubernetes.spilo_privileged | eq "true" }} {{- if or (toString .Values.configKubernetes.spilo_privileged | eq "true") (.Values.rbac.operatorRunWithPsp) }}
# to run privileged pods # to run privileged pods
- apiGroups: - apiGroups:
- extensions - extensions
resources: resources:
- podsecuritypolicies - podsecuritypolicies
resourceNames: resourceNames:
- privileged - {{ .Values.rbac.operatorPrivilegedPodSecurityPolicy }}
verbs: verbs:
- use - use
{{- end }} {{- end }}

5
charts/postgres-operator/values.yaml
View File

@ -372,6 +372,11 @@ rbac:
create: true create: true
# Specifies whether ClusterRoles that are aggregated into the K8s default roles should be created. (https://kubernetes.io/docs/reference/access-authn-authz/rbac/#default-roles-and-role-bindings) # Specifies whether ClusterRoles that are aggregated into the K8s default roles should be created. (https://kubernetes.io/docs/reference/access-authn-authz/rbac/#default-roles-and-role-bindings)
createAggregateClusterRoles: false createAggregateClusterRoles: false
# If cluster is set to run as privileged - which pod security policy should be used
operatorRunWithPsp: false
spiloRunWithPsp: false
spiloPrivilegedPodSecurityPolicy: privileged
operatorPrivilegedPodSecurityPolicy: privileged
serviceAccount: serviceAccount:
# Specifies whether a ServiceAccount should be created # Specifies whether a ServiceAccount should be created