Your commit message
This commit is contained in:
zeaslity
105
部署应用/Oracle-Cloud/traefik-20.5.3/templates/rbac/clusterrole.yaml
Normal file
105
部署应用/Oracle-Cloud/traefik-20.5.3/templates/rbac/clusterrole.yaml
Normal file
@@ -0,0 +1,105 @@
|
||||
{{- if .Values.rbac.enabled -}}
|
||||
---
|
||||
kind: ClusterRole
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ template "traefik.clusterRoleName" . }}
|
||||
labels:
|
||||
{{- include "traefik.labels" . | nindent 4 }}
|
||||
{{- range .Values.rbac.aggregateTo }}
|
||||
rbac.authorization.k8s.io/aggregate-to-{{ . }}: "true"
|
||||
{{- end }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- extensions
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingressclasses
|
||||
{{- if not .Values.rbac.namespaced }}
|
||||
- ingresses
|
||||
{{- end }}
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
{{- if not .Values.rbac.namespaced }}
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- services
|
||||
- endpoints
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
{{- if .Values.providers.kubernetesIngress.enabled }}
|
||||
- apiGroups:
|
||||
- extensions
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingresses/status
|
||||
verbs:
|
||||
- update
|
||||
{{- end -}}
|
||||
{{- if .Values.providers.kubernetesCRD.enabled }}
|
||||
- apiGroups:
|
||||
- traefik.containo.us
|
||||
resources:
|
||||
- ingressroutes
|
||||
- ingressroutetcps
|
||||
- ingressrouteudps
|
||||
- middlewares
|
||||
- middlewaretcps
|
||||
- tlsoptions
|
||||
- tlsstores
|
||||
- traefikservices
|
||||
- serverstransports
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
{{- end -}}
|
||||
{{- if .Values.podSecurityPolicy.enabled }}
|
||||
- apiGroups:
|
||||
- policy
|
||||
resourceNames:
|
||||
- {{ template "traefik.fullname" . }}
|
||||
resources:
|
||||
- podsecuritypolicies
|
||||
verbs:
|
||||
- use
|
||||
{{- end -}}
|
||||
{{- if .Values.experimental.kubernetesGateway.enabled }}
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- namespaces
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- gateway.networking.k8s.io
|
||||
resources:
|
||||
- gatewayclasses
|
||||
- gateways
|
||||
- httproutes
|
||||
- tcproutes
|
||||
- tlsroutes
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- gateway.networking.k8s.io
|
||||
resources:
|
||||
- gatewayclasses/status
|
||||
- gateways/status
|
||||
- httproutes/status
|
||||
- tcproutes/status
|
||||
- tlsroutes/status
|
||||
verbs:
|
||||
- update
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,17 @@
|
||||
{{- if .Values.rbac.enabled -}}
|
||||
---
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ template "traefik.clusterRoleName" . }}
|
||||
labels:
|
||||
{{- include "traefik.labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "traefik.clusterRoleName" . }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "traefik.serviceAccountName" . }}
|
||||
namespace: {{ template "traefik.namespace" . }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,65 @@
|
||||
{{- if .Values.podSecurityPolicy.enabled }}
|
||||
---
|
||||
apiVersion: policy/v1beta1
|
||||
kind: PodSecurityPolicy
|
||||
metadata:
|
||||
annotations:
|
||||
seccomp.security.alpha.kubernetes.io/allowedProfileNames: runtime/default
|
||||
seccomp.security.alpha.kubernetes.io/defaultProfileName: runtime/default
|
||||
name: {{ template "traefik.fullname" . }}
|
||||
labels:
|
||||
{{- include "traefik.labels" . | nindent 4 }}
|
||||
spec:
|
||||
privileged: false
|
||||
allowPrivilegeEscalation: false
|
||||
requiredDropCapabilities:
|
||||
- ALL
|
||||
{{- if not .Values.securityContext.runAsNonRoot }}
|
||||
allowedCapabilities:
|
||||
- NET_BIND_SERVICE
|
||||
{{- end }}
|
||||
hostNetwork: {{ .Values.hostNetwork }}
|
||||
hostIPC: false
|
||||
hostPID: false
|
||||
fsGroup:
|
||||
{{- if .Values.securityContext.runAsNonRoot }}
|
||||
ranges:
|
||||
- max: 65535
|
||||
min: 1
|
||||
rule: MustRunAs
|
||||
{{- else }}
|
||||
rule: RunAsAny
|
||||
{{- end }}
|
||||
{{- if .Values.hostNetwork }}
|
||||
hostPorts:
|
||||
- max: 65535
|
||||
min: 1
|
||||
{{- end }}
|
||||
readOnlyRootFilesystem: true
|
||||
runAsUser:
|
||||
{{- if .Values.securityContext.runAsNonRoot }}
|
||||
rule: MustRunAsNonRoot
|
||||
{{- else }}
|
||||
rule: RunAsAny
|
||||
{{- end }}
|
||||
seLinux:
|
||||
rule: RunAsAny
|
||||
supplementalGroups:
|
||||
{{- if .Values.securityContext.runAsNonRoot }}
|
||||
ranges:
|
||||
- max: 65535
|
||||
min: 1
|
||||
rule: MustRunAs
|
||||
{{- else }}
|
||||
rule: RunAsAny
|
||||
{{- end }}
|
||||
volumes:
|
||||
- configMap
|
||||
- downwardAPI
|
||||
- secret
|
||||
- emptyDir
|
||||
- projected
|
||||
{{- if .Values.persistence.enabled }}
|
||||
- persistentVolumeClaim
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
66
部署应用/Oracle-Cloud/traefik-20.5.3/templates/rbac/role.yaml
Normal file
66
部署应用/Oracle-Cloud/traefik-20.5.3/templates/rbac/role.yaml
Normal file
@@ -0,0 +1,66 @@
|
||||
{{- if and .Values.rbac.enabled .Values.rbac.namespaced }}
|
||||
kind: Role
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ template "traefik.fullname" . }}
|
||||
namespace: {{ template "traefik.namespace" . }}
|
||||
labels:
|
||||
{{- include "traefik.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- services
|
||||
- endpoints
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
{{- if .Values.providers.kubernetesIngress.enabled }}
|
||||
- apiGroups:
|
||||
- extensions
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingresses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- extensions
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingresses/status
|
||||
verbs:
|
||||
- update
|
||||
{{- end -}}
|
||||
{{- if .Values.providers.kubernetesCRD.enabled }}
|
||||
- apiGroups:
|
||||
- traefik.containo.us
|
||||
resources:
|
||||
- ingressroutes
|
||||
- ingressroutetcps
|
||||
- ingressrouteudps
|
||||
- middlewares
|
||||
- middlewaretcps
|
||||
- tlsoptions
|
||||
- tlsstores
|
||||
- traefikservices
|
||||
- serverstransports
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
{{- end -}}
|
||||
{{- if .Values.podSecurityPolicy.enabled }}
|
||||
- apiGroups:
|
||||
- extensions
|
||||
resourceNames:
|
||||
- {{ template "traefik.fullname" . }}
|
||||
resources:
|
||||
- podsecuritypolicies
|
||||
verbs:
|
||||
- use
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,17 @@
|
||||
{{- if and .Values.rbac.enabled .Values.rbac.namespaced }}
|
||||
kind: RoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ template "traefik.fullname" . }}
|
||||
namespace: {{ template "traefik.namespace" . }}
|
||||
labels:
|
||||
{{- include "traefik.labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ template "traefik.fullname" . }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "traefik.serviceAccountName" . }}
|
||||
namespace: {{ template "traefik.namespace" . }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,13 @@
|
||||
{{- if not .Values.serviceAccount.name -}}
|
||||
kind: ServiceAccount
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: {{ include "traefik.serviceAccountName" . }}
|
||||
namespace: {{ template "traefik.namespace" . }}
|
||||
labels:
|
||||
{{- include "traefik.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
{{- with .Values.serviceAccountAnnotations }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
Reference in New Issue
Block a user