Merge "Fix the chartmuseum cannot create dir problem, include release repo credential...
[ric-plt/ric-dep.git] / helm / infrastructure / subcharts / kong / templates / psp.yaml
1 {{- if .Values.podSecurityPolicy.enabled }}
2 apiVersion: policy/v1beta1
3 kind: PodSecurityPolicy
4 metadata:
5   name: {{ template "kong.serviceAccountName" . }}-psp
6   labels:
7     {{- include "kong.metaLabels" . | nindent 4 }}
8 spec:
9   privileged: false
10   fsGroup:
11     rule: RunAsAny
12   runAsUser:
13     rule: RunAsAny
14   runAsGroup:
15     rule: RunAsAny
16   seLinux:
17     rule: RunAsAny
18   supplementalGroups:
19     rule: RunAsAny
20   volumes:
21     - 'configMap'
22     - 'secret'
23     - 'emptyDir'
24   allowPrivilegeEscalation: false
25   hostNetwork: false
26   hostIPC: false
27   hostPID: false
28 ---
29 apiVersion: rbac.authorization.k8s.io/v1
30 kind: ClusterRole
31 metadata:
32   name: {{ template "kong.serviceAccountName" . }}-psp
33   labels:
34     {{- include "kong.metaLabels" . | nindent 4 }}
35 rules:
36   - apiGroups:
37       - extensions
38     resources:
39       - podsecuritypolicies
40     verbs:
41       - use
42     resourceNames:
43       - {{ template "kong.serviceAccountName" . }}-psp
44 ---
45 apiVersion: rbac.authorization.k8s.io/v1
46 kind: ClusterRoleBinding
47 metadata:
48   name: {{ template "kong.serviceAccountName" . }}-psp
49   namespace: {{ .Release.Namespace }}
50   labels:
51     {{- include "kong.metaLabels" . | nindent 4 }}
52 subjects:
53   - kind: ServiceAccount
54     name: {{ template "kong.serviceAccountName" . }}
55     namespace: {{ .Release.Namespace }}
56 roleRef:
57   kind: ClusterRole
58   name: {{ template "kong.serviceAccountName" . }}-psp
59   apiGroup: rbac.authorization.k8s.io
60 {{- end }}