fix(fuentbit): update PSP resource with missing values (#1142)

kube-logging · May 22, 2023 · 250b002 · 250b002
1 parent c5530fc
commit 250b002
Showing 1 changed file with 28 additions and 1 deletion.
diff --git a/pkg/resources/fluentbit/psp.go b/pkg/resources/fluentbit/psp.go
@@ -36,6 +36,13 @@ func (r *Reconciler) clusterPodSecurityPolicy() (runtime.Object, reconciler.Desi
 			ReadOnly:   true,
 		}}
 
+		if r.Logging.Spec.FluentbitSpec.BufferStorageVolume.HostPath != nil {
+			allowedHostPaths = append(allowedHostPaths, policyv1beta1.AllowedHostPath{
+				PathPrefix: r.Logging.Spec.FluentbitSpec.BufferStorageVolume.HostPath.Path,
+				ReadOnly:   false,
+			})
+		}
+
 		for _, vMnt := range r.Logging.Spec.FluentbitSpec.ExtraVolumeMounts {
 			allowedHostPaths = append(allowedHostPaths, policyv1beta1.AllowedHostPath{
 				PathPrefix: vMnt.Source,
@@ -53,14 +60,32 @@ func (r *Reconciler) clusterPodSecurityPolicy() (runtime.Object, reconciler.Desi
 			})
 		}
 
+		hostPorts := []policyv1beta1.HostPortRange{}
+		if r.Logging.Spec.FluentbitSpec.HostNetwork {
+			if r.Logging.Spec.FluentbitSpec.Metrics != nil && r.Logging.Spec.FluentbitSpec.Metrics.Port != 0 {
+				hostPorts = append(hostPorts, policyv1beta1.HostPortRange{
+					Min: r.Logging.Spec.FluentbitSpec.Metrics.Port,
+					Max: r.Logging.Spec.FluentbitSpec.Metrics.Port,
+				})
+			}
+
+			if r.Logging.Spec.FluentbitSpec.BufferVolumeMetrics != nil && r.Logging.Spec.FluentbitSpec.BufferVolumeMetrics.Port != 0 {
+				hostPorts = append(hostPorts, policyv1beta1.HostPortRange{
+					Min: r.Logging.Spec.FluentbitSpec.BufferVolumeMetrics.Port,
+					Max: r.Logging.Spec.FluentbitSpec.BufferVolumeMetrics.Port,
+				})
+			}
+		}
+
 		return &policyv1beta1.PodSecurityPolicy{
 			ObjectMeta: r.FluentbitObjectMetaClusterScope(fluentbitPodSecurityPolicyName),
 			Spec: policyv1beta1.PodSecurityPolicySpec{
 				Volumes: []policyv1beta1.FSType{
 					"configMap",
 					"emptyDir",
 					"secret",
-					"hostPath"},
+					"hostPath",
+					"persistentVolumeClaim"},
 				SELinux: policyv1beta1.SELinuxStrategyOptions{
 					Rule: policyv1beta1.SELinuxStrategyRunAsAny,
 				},
@@ -76,6 +101,8 @@ func (r *Reconciler) clusterPodSecurityPolicy() (runtime.Object, reconciler.Desi
 				ReadOnlyRootFilesystem:   true,
 				AllowPrivilegeEscalation: util.BoolPointer(false),
 				AllowedHostPaths:         allowedHostPaths,
+				HostNetwork:              r.Logging.Spec.FluentbitSpec.HostNetwork,
+				HostPorts:                hostPorts,
 			},
 		}, reconciler.StatePresent, nil
 	}