Skip to content

Commit

Permalink
RBAC support
Browse files Browse the repository at this point in the history
With this change deis-monitor-telegraf became available to work in RBAC-only clusters

Works with both Kubernetes 1.5 and 1.6 (see templates/_helpers.tmpl for details)
Actually tested with 1.5.7 and 1.6.2

ClusterRole allows deis-monitor-telegraf:
- pods: get
  • Loading branch information
Bregor committed May 12, 2017
1 parent 115ea92 commit ff4058d
Show file tree
Hide file tree
Showing 4 changed files with 45 additions and 0 deletions.
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
{{- if (.Values.global.use_rbac) -}}
{{- if (.Capabilities.APIVersions.Has (include "rbacAPIVersion" .)) -}}
kind: Role
apiVersion: {{ template "rbacAPIVersion" . }}
metadata:
name: deis-monitor-telegraf
labels:
app: deis-monitor-telegraf
heritage: deis
rules:
- apiGroups: [""]
resources: ["pods"]
verbs: ["get"]
{{- end -}}
{{- end -}}
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
{{- if (.Values.global.use_rbac) -}}
{{- if (.Capabilities.APIVersions.Has (include "rbacAPIVersion" .)) -}}
kind: RoleBinding
apiVersion: {{ template "rbacAPIVersion" . }}
metadata:
name: deis-monitor-telegraf
labels:
app: deis-monitor-telegraf
heritage: deis
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: deis-monitor-telegraf
subjects:
- kind: ServiceAccount
name: deis-monitor-telegraf
{{- end -}}
{{- end -}}
10 changes: 10 additions & 0 deletions charts/monitor/templates/_helpers.tmpl
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
{{/*
Set apiVersion based on Kubernetes version
*/}}
{{- define "rbacAPIVersion" -}}
{{- if ge .Capabilities.KubeVersion.Minor "6" -}}
rbac.authorization.k8s.io/v1beta1
{{- else -}}
rbac.authorization.k8s.io/v1alpha1
{{- end -}}
{{- end -}}
2 changes: 2 additions & 0 deletions charts/monitor/values.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -49,3 +49,5 @@ global:
# - on-cluster: Run Redis within the Kubernetes cluster
# - off-cluster: Run Redis outside the Kubernetes cluster (configure in loggerRedis section)
logger_redis_location: "on-cluster"
# Role-Based Access Control for Kubernetes >= 1.5
use_rbac: false

0 comments on commit ff4058d

Please sign in to comment.