Merge pull request #3195 from mirwan/fix_psp_templates

Fix some addons when PodSecurityPolicy is enabled
This commit is contained in:
k8s-ci-robot 2018-08-30 03:37:52 -07:00 committed by GitHub
commit f48468b83b
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 17 additions and 2 deletions

View file

@ -35,7 +35,7 @@
- name: Local Volume Provisioner | Insert extra templates to Local Volume Provisioner templates list for PodSecurityPolicy - name: Local Volume Provisioner | Insert extra templates to Local Volume Provisioner templates list for PodSecurityPolicy
set_fact: set_fact:
local_volume_provisioner_templates: "{{ local_volume_provisioner_templates[:2] + local_volume_provisioner_templates_for_psp_not_system_ns + local_volume_provisioner_templates[3:] }}" local_volume_provisioner_templates: "{{ local_volume_provisioner_templates[:2] + local_volume_provisioner_templates_for_psp_not_system_ns + local_volume_provisioner_templates[2:] }}"
when: when:
- podsecuritypolicy_enabled - podsecuritypolicy_enabled
- local_volume_provisioner_namespace != "kube-system" - local_volume_provisioner_namespace != "kube-system"

View file

@ -0,0 +1,15 @@
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
name: psp:local-volume-provisioner
namespace: {{ local_volume_provisioner_namespace }}
rules:
- apiGroups:
- policy
resourceNames:
- local-volume-provisioner
resources:
- podsecuritypolicies
verbs:
- use

View file

@ -27,7 +27,7 @@
- name: Registry | Append extra templates to Registry Templates list for PodSecurityPolicy - name: Registry | Append extra templates to Registry Templates list for PodSecurityPolicy
set_fact: set_fact:
registry_templates: "{{ registry_templates[:3] + registry_templates_for_psp + registry_templates[4:] }}" registry_templates: "{{ registry_templates[:3] + registry_templates_for_psp + registry_templates[3:] }}"
when: when:
- podsecuritypolicy_enabled - podsecuritypolicy_enabled
- registry_namespace != "kube-system" - registry_namespace != "kube-system"