[stable/grafana]: add RBAC #5386

mikeraimondi · 2018-05-03T23:46:13Z

What this PR does / why we need it:

Adds the option to create a role and roleBinding
Adds the option to create a podSecurityPolicy
Adds the option to create a serviceAccount or use an existing serviceAccount

k8s-ci-robot · 2018-05-03T23:46:15Z

Thanks for your pull request. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please follow instructions at https://git.k8s.io/community/CLA.md#the-contributor-license-agreement to sign the CLA.

It may take a couple minutes for the CLA signature to be fully registered; after that, please reply here with a new comment and we'll verify. Thanks.

If you've already signed a CLA, it's possible we don't have your GitHub username or you're using a different email address. Check your existing CLA data and verify that your email is set on your git commits.
If you signed the CLA as a corporation, please sign in with your organization's credentials at https://identity.linuxfoundation.org/projects/cncf to be authorized.
If you have done the above and are still having issues with the CLA being reported as unsigned, please email the CNCF helpdesk: helpdesk@rt.linuxfoundation.org

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

mikeraimondi · 2018-05-03T23:51:32Z

CLA signed

mikeraimondi · 2018-05-04T04:39:37Z

/assign @linki

unguiculus · 2018-05-04T04:52:26Z

stable/grafana/templates/podsecuritypolicy.yaml

+apiVersion: extensions/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: {{ template "grafana.fullname" . }}


Add standard labels.

unguiculus · 2018-05-04T04:52:47Z

/assign

mikeraimondi · 2018-05-07T02:37:22Z

stable/grafana/templates/podsecuritypolicy.yaml

+  privileged: false
+  allowPrivilegeEscalation: false
+  allowedCapabilities:
+    - CAP_CHOWN


This and the 'RunAsAny' on line 32 are only needed for images prior to 5.1.0. I could condition on the image tag to render the most restrictive PSP. I'm not sure if that's needed/desired.

What's the typical approach, here?

Personally, I'd move forward with the chart and not make it backwards-compatible.

@zanhsieh @rtluckie What do you think?

Agreed with @unguiculus . I think we might add kubeVersion in Chart.yaml file (e.g. kubeVersion: 1.9) as charts.md suggested.

unguiculus · 2018-05-10T19:25:49Z

stable/grafana/templates/_helpers.tpl

+*/}}
+{{- define "grafana.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create -}}
+    {{ default (include "grafana.fullname" .) .Values.rbac.serviceAccountName }}


.Values.serviceAccount.name

unguiculus · 2018-05-10T19:26:20Z

stable/grafana/templates/_helpers.tpl

+{{- if .Values.serviceAccount.create -}}
+    {{ default (include "grafana.fullname" .) .Values.rbac.serviceAccountName }}
+{{- else -}}
+    {{ default "default" .Values.rbac.serviceAccountName }}


.Values.serviceAccount.name

unguiculus · 2018-05-10T19:26:36Z

stable/grafana/Chart.yaml

@@ -1,5 +1,5 @@
 name: grafana
-version: 1.3.0
+version: 1.3.1


Bump minor version.

unguiculus · 2018-05-10T19:28:21Z

stable/grafana/templates/podsecuritypolicy.yaml

+  privileged: false
+  allowPrivilegeEscalation: false
+  allowedCapabilities:
+    - CAP_CHOWN


Personally, I'd move forward with the chart and not make it backwards-compatible.

@zanhsieh @rtluckie What do you think?

unguiculus · 2018-05-12T06:21:02Z

/ok-to-test

zanhsieh

/lgtm

mikeraimondi · 2018-05-15T03:05:21Z

CI is showing this: Error: Chart requires kubernetesVersion: >=1.8 which is incompatible with Kubernetes v1.9.6-gke.1

Any idea what that's about?

zanhsieh · 2018-05-15T05:13:30Z

@mikeraimondi It's about the recently update grafana chart RBAC standardization.

mikeraimondi · 2018-05-16T04:02:18Z

Updated with latest changes and passing CI! Let me know if anything else needs to be fixed up. CC @unguiculus

unguiculus · 2018-05-16T04:38:40Z

/lgtm

k8s-ci-robot · 2018-05-16T04:38:47Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: mikeraimondi, unguiculus, zanhsieh

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [unguiculus]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

* add RBAC to Grafana * bump version * add standard labels * conditionalize PSP role * fix whitespace * fix reference to serviceAccount * update version to not require root or chown * set minimum kubeVersion to earliest version w/ stable RBAC * attempt to fix test failure * blind attempt to fix CI failure * match versions between stable RBAC and possible breaking changes in 2.x * include pre-release versions

* add RBAC to Grafana * bump version * add standard labels * conditionalize PSP role * fix whitespace * fix reference to serviceAccount * update version to not require root or chown * set minimum kubeVersion to earliest version w/ stable RBAC * attempt to fix test failure * blind attempt to fix CI failure * match versions between stable RBAC and possible breaking changes in 2.x * include pre-release versions Signed-off-by: voron <av@arilot.com>

* add RBAC to Grafana * bump version * add standard labels * conditionalize PSP role * fix whitespace * fix reference to serviceAccount * update version to not require root or chown * set minimum kubeVersion to earliest version w/ stable RBAC * attempt to fix test failure * blind attempt to fix CI failure * match versions between stable RBAC and possible breaking changes in 2.x * include pre-release versions

mikeraimondi added 2 commits May 3, 2018 19:38

add RBAC to Grafana

895dc90

bump version

0cfe39b

k8s-ci-robot added cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels May 3, 2018

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels May 3, 2018

k8s-ci-robot assigned linki May 4, 2018

unguiculus reviewed May 4, 2018

View reviewed changes

k8s-ci-robot assigned unguiculus May 4, 2018

mikeraimondi added 5 commits May 4, 2018 11:40

add standard labels

4447c4a

Merge remote-tracking branch 'upstream/master' into grafana-rbac

695265a

conditionalize PSP role

c1735d9

fix whitespace

200f3a6

Merge remote-tracking branch 'upstream/master' into grafana-rbac

96f6a1a

mikeraimondi commented May 7, 2018

View reviewed changes

unguiculus suggested changes May 10, 2018

View reviewed changes

mikeraimondi added 2 commits May 11, 2018 17:45

Merge remote-tracking branch 'upstream/master' into grafana-rbac

3bbb941

fix reference to serviceAccount

9da1d96

k8s-ci-robot removed the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label May 12, 2018

mikeraimondi added 2 commits May 13, 2018 20:30

update version to not require root or chown

982b735

set minimum kubeVersion to earliest version w/ stable RBAC

8f46695

zanhsieh approved these changes May 14, 2018

View reviewed changes

attempt to fix test failure

1709172

mikeraimondi added 3 commits May 15, 2018 23:46

blind attempt to fix CI failure

042e0e9

match versions between stable RBAC and possible breaking changes in 2.x

2eabc32

include pre-release versions

067f1f9

k8s-ci-robot added the lgtm Indicates that a PR is ready to be merged. label May 16, 2018

unguiculus approved these changes May 16, 2018

View reviewed changes

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label May 16, 2018

k8s-ci-robot merged commit 81eca40 into helm:master May 16, 2018

unguiculus mentioned this pull request May 16, 2018

Grafana: Prepare chart for 5.1.x #5576

Closed

FrederikNJS mentioned this pull request May 18, 2018

[stable/grafana] Crash-looping with volume permission denied on fresh install #5635

Closed

This was referenced May 31, 2018

[stable/grafana] Cannot start container with error "container has runAsNonRoot and image has non-numeric user 'grafana'" #5851

Closed

[stable/grafana] Relax user restrictions to work around non-numeric 'grafana' user #5852

Merged

mattfarina unassigned linki Jul 19, 2018

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[stable/grafana]: add RBAC #5386

[stable/grafana]: add RBAC #5386

mikeraimondi commented May 3, 2018

k8s-ci-robot commented May 3, 2018

mikeraimondi commented May 3, 2018

mikeraimondi commented May 4, 2018

unguiculus May 4, 2018

mikeraimondi May 4, 2018

unguiculus commented May 4, 2018

mikeraimondi May 7, 2018

unguiculus May 10, 2018

zanhsieh May 12, 2018 •

edited

Loading

unguiculus May 10, 2018

unguiculus May 10, 2018

unguiculus May 10, 2018

unguiculus May 10, 2018

unguiculus commented May 12, 2018

zanhsieh left a comment •

edited

Loading

mikeraimondi commented May 15, 2018

zanhsieh commented May 15, 2018

mikeraimondi commented May 16, 2018 •

edited

Loading

unguiculus commented May 16, 2018

k8s-ci-robot commented May 16, 2018

[stable/grafana]: add RBAC #5386

[stable/grafana]: add RBAC #5386

Conversation

mikeraimondi commented May 3, 2018

k8s-ci-robot commented May 3, 2018

mikeraimondi commented May 3, 2018

mikeraimondi commented May 4, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

unguiculus commented May 4, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

zanhsieh May 12, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

unguiculus commented May 12, 2018

zanhsieh left a comment • edited Loading

Choose a reason for hiding this comment

mikeraimondi commented May 15, 2018

zanhsieh commented May 15, 2018

mikeraimondi commented May 16, 2018 • edited Loading

unguiculus commented May 16, 2018

k8s-ci-robot commented May 16, 2018

zanhsieh May 12, 2018 •

edited

Loading

zanhsieh left a comment •

edited

Loading

mikeraimondi commented May 16, 2018 •

edited

Loading