Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(shield): allow to override capabilities [SMAGENT-8408] #2077

Merged
merged 10 commits into from
Dec 19, 2024
Merged

feat(shield): allow to override capabilities [SMAGENT-8408] #2077

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
a8aada0
feat(shield): allow to override capabilities [SMAGENT-8408]
iurly Dec 13, 2024
74a3469
add extra_capabilities to values.schema.json
iurly Dec 13, 2024
952f91f
add remaining instances
iurly Dec 13, 2024
c644865
drop the format for extra_capabilities
iurly Dec 13, 2024
9cd775c
Merge remote-tracking branch 'origin/main' into SMAGENT-8408-extra-ca…
iurly Dec 17, 2024
d169a42
rename extra_capabilities to extra_capabilities_api_versions, bump to…
iurly Dec 17, 2024
069490f
Merge remote-tracking branch 'origin/main' into SMAGENT-8408-extra-ca…
iurly Dec 17, 2024
d1fde1f
update README.md
iurly Dec 17, 2024
a24b752
add unit tests
iurly Dec 18, 2024
37789c6
Merge branch 'main' into SMAGENT-8408-extra-capabilities
iurly Dec 19, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion charts/shield/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,5 +13,5 @@ maintainers:
- name: mavimo
email: [email protected]
type: application
version: 0.4.0
version: 0.4.1
appVersion: "1.0.0"
1 change: 1 addition & 0 deletions charts/shield/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -226,6 +226,7 @@ The following table lists the configurable parameters of the `shield` chart and
| proxy.https_proxy_existing_secret | Provide the name of an existing Secret that contains the HTTPS proxy | <code></code> |
| proxy.no_proxy | No proxy hosts and ips | <code></code> |
| proxy.no_proxy_existing_secret | Provide the name of an existing Secret that contains the no proxy hosts | <code></code> |
| extra_capabilities_api_versions | Additional .APIVersions in .Capabilities, e.g. "security.openshift.io/v1" | <code>[]</code> |
| workload_annotations | Additional annotations for the all the workloads (metadata.annotations) | <code>{}</code> |
| workload_labels | Additional labels for the all the workloads (metadata.labels) | <code>{}</code> |
| pod_annotations | Additional annotations for all the pods (spec.template.metadata.annotations) | <code>{}</code> |
Expand Down
2 changes: 1 addition & 1 deletion charts/shield/templates/cluster/openshift-securitycontextconstraint.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
{{- if .Capabilities.APIVersions.Has "security.openshift.io/v1" }}
{{- if or (.Capabilities.APIVersions.Has "security.openshift.io/v1") (has "security.openshift.io/v1" .Values.extra_capabilities_api_versions) }}
apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints
metadata:
Expand Down
3 changes: 2 additions & 1 deletion charts/shield/templates/host/clusterrole.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,7 +113,8 @@ rules:
- get
- list
- watch
{{- if .Capabilities.APIVersions.Has "rbac.authorization.k8s.io/v1beta1/PodSecurityPolicy" }}
{{- if or (.Capabilities.APIVersions.Has "rbac.authorization.k8s.io/v1beta1/PodSecurityPolicy") (has "rbac.authorization.k8s.io/v1beta1/PodSecurityPolicy" .Values.extra_capabilities_api_versions) }}

- apiGroups:
- "policy"
resources:
Expand Down
2 changes: 1 addition & 1 deletion charts/shield/templates/host/openshift-clusterrolebinding-monitor.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
{{- if .Capabilities.APIVersions.Has "monitoring.openshift.io/v1" }}
{{- if or (.Capabilities.APIVersions.Has "monitoring.openshift.io/v1") (has "monitoring.openshift.io/v1" .Values.extra_capabilities_api_versions) }}
{{- $clusterRole := lookup "rbac.authorization.k8s.io/v1" "ClusterRole" "" "cluster-monitoring-view" -}}
{{- if and .Values.host.rbac.create $clusterRole }}
kind: ClusterRoleBinding
Expand Down
2 changes: 1 addition & 1 deletion charts/shield/templates/host/openshift-securitycontextconstraint.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
{{- if .Capabilities.APIVersions.Has "security.openshift.io/v1" }}
{{- if or (.Capabilities.APIVersions.Has "security.openshift.io/v1") (has "security.openshift.io/v1" .Values.extra_capabilities_api_versions) }}
apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints
metadata:
Expand Down
15 changes: 15 additions & 0 deletions charts/shield/tests/cluster/openshift-securitycontextconstraint_test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,3 +26,18 @@ tests:
- contains:
path: users
content: "system:serviceaccount:shield-namespace:release-name-shield-cluster"

- it: Creates SecurityContextConstraints when the extraCapability has been set
set:
extra_capabilities_api_versions:
- security.openshift.io/v1
asserts:
- hasDocuments:
count: 1
- containsDocument:
kind: SecurityContextConstraints
apiVersion: security.openshift.io/v1
name: release-name-shield-cluster
- contains:
path: users
content: "system:serviceaccount:shield-namespace:release-name-shield-cluster"
15 changes: 15 additions & 0 deletions charts/shield/tests/host/openshift-securitycontextconstraint_test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,21 @@ tests:
path: users
content: "system:serviceaccount:shield-namespace:release-name-shield-host"

- it: Creates SecurityContextConstraints when the extraCapability has been set
set:
extra_capabilities_api_versions:
- security.openshift.io/v1
asserts:
- hasDocuments:
count: 1
- containsDocument:
kind: SecurityContextConstraints
apiVersion: security.openshift.io/v1
name: release-name-shield-host
- contains:
path: users
content: "system:serviceaccount:shield-namespace:release-name-shield-host"

- it: SecurityContextConstraints allowedCapabilities is empty when host.privileged is true
capabilities:
apiVersions:
Expand Down
10 changes: 10 additions & 0 deletions charts/shield/values.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,16 @@
},
"proxy": {
"$ref": "#/$defs/Proxy"
},
"extra_capabilities_api_versions": {
"type": "array",
"items": {
"type": "string",
"description": "Capabilities of the cluster",
"examples": [
"security.openshift.io/v1"
]
}
}
},
"required": [
Expand Down
3 changes: 3 additions & 0 deletions charts/shield/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -442,6 +442,9 @@ proxy:
# Provide the name of an existing Secret that contains the no proxy hosts
no_proxy_existing_secret:

# Additional .APIVersions in .Capabilities, e.g. "security.openshift.io/v1"
extra_capabilities_api_versions: []

# Additional annotations for the all the workloads (metadata.annotations)
workload_annotations: {}
# Additional labels for the all the workloads (metadata.labels)
Expand Down
Loading