chore(psp): Adding podSecurityPolicies in RBAC (#387)
Signed-off-by: shubhamchaudhary <shubham.chaudhary@mayadata.io>
This commit is contained in:
Shubham Chaudhary
committed by
GitHub
GitHub
parent
f8961a5a75
commit
44752414ea
44
charts/generic/container-kill/rbac-psp.yaml
Normal file
44
charts/generic/container-kill/rbac-psp.yaml
Normal file
@@ -0,0 +1,44 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: container-kill-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: container-kill-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: container-kill-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: container-kill-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: ["","litmuschaos.io","batch","apps"]
|
||||
resources: ["pods","jobs","pods/exec","pods/log","events","chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: ["policy"]
|
||||
resources: ["podsecuritypolicies"]
|
||||
verbs: ["use"]
|
||||
resourceNames: ["litmus"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: container-kill-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: container-kill-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: container-kill-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: container-kill-sa
|
||||
namespace: default
|
||||
|
||||
41
charts/generic/disk-fill/rbac-psp.yaml
Normal file
41
charts/generic/disk-fill/rbac-psp.yaml
Normal file
@@ -0,0 +1,41 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: disk-fill-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: disk-fill-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: disk-fill-sa
|
||||
labels:
|
||||
name: disk-fill-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: ["","apps","litmuschaos.io","batch"]
|
||||
resources: ["pods","jobs","pods/exec","events","pods/log","chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: ["policy"]
|
||||
resources: ["podsecuritypolicies"]
|
||||
verbs: ["use"]
|
||||
resourceNames: ["litmus"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: disk-fill-sa
|
||||
labels:
|
||||
name: disk-fill-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: disk-fill-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: disk-fill-sa
|
||||
namespace: default
|
||||
44
charts/generic/kubelet-service-kill/rbac-psp.yaml
Normal file
44
charts/generic/kubelet-service-kill/rbac-psp.yaml
Normal file
@@ -0,0 +1,44 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: kubelet-service-kill-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: kubelet-service-kill-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: kubelet-service-kill-sa
|
||||
labels:
|
||||
name: kubelet-service-kill-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: ["","litmuschaos.io","batch","apps"]
|
||||
resources: ["pods","jobs","pods/log","events","chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update","delete"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get","list"]
|
||||
- apiGroups: ["policy"]
|
||||
resources: ["podsecuritypolicies"]
|
||||
verbs: ["use"]
|
||||
resourceNames: ["litmus"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: kubelet-service-kill-sa
|
||||
labels:
|
||||
name: kubelet-service-kill-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: kubelet-service-kill-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: kubelet-service-kill-sa
|
||||
namespace: default
|
||||
44
charts/generic/node-cpu-hog/rbac-psp.yaml
Normal file
44
charts/generic/node-cpu-hog/rbac-psp.yaml
Normal file
@@ -0,0 +1,44 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: node-cpu-hog-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: node-cpu-hog-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: node-cpu-hog-sa
|
||||
labels:
|
||||
name: node-cpu-hog-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: ["","litmuschaos.io","batch","apps"]
|
||||
resources: ["pods","jobs","events","chaosengines","pods/log","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get","list"]
|
||||
- apiGroups: ["policy"]
|
||||
resources: ["podsecuritypolicies"]
|
||||
verbs: ["use"]
|
||||
resourceNames: ["litmus"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: node-cpu-hog-sa
|
||||
labels:
|
||||
name: node-cpu-hog-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: node-cpu-hog-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: node-cpu-hog-sa
|
||||
namespace: default
|
||||
44
charts/generic/node-drain/rbac-psp.yaml
Normal file
44
charts/generic/node-drain/rbac-psp.yaml
Normal file
@@ -0,0 +1,44 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: node-drain-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: node-drain-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: node-drain-sa
|
||||
labels:
|
||||
name: node-drain-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: ["","litmuschaos.io","batch","extensions","apps"]
|
||||
resources: ["pods","jobs","events","chaosengines","pods/log","daemonsets","pods/eviction","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update","delete"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["patch","get","list"]
|
||||
- apiGroups: ["policy"]
|
||||
resources: ["podsecuritypolicies"]
|
||||
verbs: ["use"]
|
||||
resourceNames: ["litmus"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: node-drain-sa
|
||||
labels:
|
||||
name: node-drain-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: node-drain-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: node-drain-sa
|
||||
namespace: default
|
||||
44
charts/generic/node-io-stress/rbac-psp.yaml
Normal file
44
charts/generic/node-io-stress/rbac-psp.yaml
Normal file
@@ -0,0 +1,44 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: node-io-stress-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: node-io-stress-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: node-io-stress-sa
|
||||
labels:
|
||||
name: node-io-stress-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: ["","litmuschaos.io","batch","apps"]
|
||||
resources: ["pods","jobs","pods/log","events","chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get","list"]
|
||||
- apiGroups: ["policy"]
|
||||
resources: ["podsecuritypolicies"]
|
||||
verbs: ["use"]
|
||||
resourceNames: ["litmus"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: node-io-stress-sa
|
||||
labels:
|
||||
name: node-io-stress-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: node-io-stress-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: node-io-stress-sa
|
||||
namespace: default
|
||||
44
charts/generic/node-memory-hog/rbac-psp.yaml
Normal file
44
charts/generic/node-memory-hog/rbac-psp.yaml
Normal file
@@ -0,0 +1,44 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: node-memory-hog-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: node-memory-hog-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: node-memory-hog-sa
|
||||
labels:
|
||||
name: node-memory-hog-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: ["","litmuschaos.io","batch","apps"]
|
||||
resources: ["pods","jobs","pods/log","events","chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get","list"]
|
||||
- apiGroups: ["policy"]
|
||||
resources: ["podsecuritypolicies"]
|
||||
verbs: ["use"]
|
||||
resourceNames: ["litmus"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: node-memory-hog-sa
|
||||
labels:
|
||||
name: node-memory-hog-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: node-memory-hog-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: node-memory-hog-sa
|
||||
namespace: default
|
||||
44
charts/generic/node-poweroff/rbac-psp.yaml
Normal file
44
charts/generic/node-poweroff/rbac-psp.yaml
Normal file
@@ -0,0 +1,44 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: node-poweroff-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: node-poweroff-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: node-poweroff-sa
|
||||
labels:
|
||||
name: node-poweroff-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: ["","litmuschaos.io","batch","apps"]
|
||||
resources: ["pods","jobs","secrets","events","chaosengines","pods/log","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get","list"]
|
||||
- apiGroups: ["policy"]
|
||||
resources: ["podsecuritypolicies"]
|
||||
verbs: ["use"]
|
||||
resourceNames: ["litmus"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: node-poweroff-sa
|
||||
labels:
|
||||
name: node-poweroff-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: node-poweroff-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: node-poweroff-sa
|
||||
namespace: default
|
||||
44
charts/generic/node-restart/rbac-psp.yaml
Normal file
44
charts/generic/node-restart/rbac-psp.yaml
Normal file
@@ -0,0 +1,44 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: node-restart-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: node-restart-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: node-restart-sa
|
||||
labels:
|
||||
name: node-restart-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: ["","litmuschaos.io","batch","apps"]
|
||||
resources: ["pods","jobs","secrets","events","chaosengines","pods/log","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get","list"]
|
||||
- apiGroups: ["policy"]
|
||||
resources: ["podsecuritypolicies"]
|
||||
verbs: ["use"]
|
||||
resourceNames: ["litmus"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: node-restart-sa
|
||||
labels:
|
||||
name: node-restart-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: node-restart-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: node-restart-sa
|
||||
namespace: default
|
||||
44
charts/generic/node-taint/rbac-psp.yaml
Normal file
44
charts/generic/node-taint/rbac-psp.yaml
Normal file
@@ -0,0 +1,44 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: node-taint-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: node-taint-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: node-taint-sa
|
||||
labels:
|
||||
name: node-taint-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: ["","litmuschaos.io","batch","extensions"]
|
||||
resources: ["pods","jobs","events","chaosengines","pods/log","daemonsets","pods/eviction","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update","delete"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["patch","get","list","update"]
|
||||
- apiGroups: ["policy"]
|
||||
resources: ["podsecuritypolicies"]
|
||||
verbs: ["use"]
|
||||
resourceNames: ["litmus"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: node-taint-sa
|
||||
labels:
|
||||
name: node-taint-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: node-taint-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: node-taint-sa
|
||||
namespace: default
|
||||
44
charts/generic/pod-autoscaler/rbac-psp.yaml
Normal file
44
charts/generic/pod-autoscaler/rbac-psp.yaml
Normal file
@@ -0,0 +1,44 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: pod-autoscaler-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-autoscaler-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: pod-autoscaler-sa
|
||||
labels:
|
||||
name: pod-autoscaler-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: ["","litmuschaos.io","batch","apps"]
|
||||
resources: ["pods","deployments","jobs","events","chaosengines","pods/log","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update","delete"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get","list"]
|
||||
- apiGroups: ["policy"]
|
||||
resources: ["podsecuritypolicies"]
|
||||
verbs: ["use"]
|
||||
resourceNames: ["litmus"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: pod-autoscaler-sa
|
||||
labels:
|
||||
name: pod-autoscaler-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: pod-autoscaler-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: pod-autoscaler-sa
|
||||
namespace: default
|
||||
43
charts/generic/pod-cpu-hog/rbac-psp.yaml
Normal file
43
charts/generic/pod-cpu-hog/rbac-psp.yaml
Normal file
@@ -0,0 +1,43 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: pod-cpu-hog-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-cpu-hog-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: pod-cpu-hog-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-cpu-hog-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: ["","litmuschaos.io","batch"]
|
||||
resources: ["pods","jobs","events","pods/log","pods/exec","chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: ["policy"]
|
||||
resources: ["podsecuritypolicies"]
|
||||
verbs: ["use"]
|
||||
resourceNames: ["litmus"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: pod-cpu-hog-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-cpu-hog-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: pod-cpu-hog-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: pod-cpu-hog-sa
|
||||
namespace: default
|
||||
34
charts/generic/pod-delete/litmus-psp.yaml
Normal file
34
charts/generic/pod-delete/litmus-psp.yaml
Normal file
@@ -0,0 +1,34 @@
|
||||
apiVersion: policy/v1beta1
|
||||
kind: PodSecurityPolicy
|
||||
metadata:
|
||||
name: litmus
|
||||
annotations:
|
||||
seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'
|
||||
spec:
|
||||
privileged: false
|
||||
# Required to prevent escalations to root.
|
||||
allowPrivilegeEscalation: false
|
||||
# Allow core volume types.
|
||||
volumes:
|
||||
- 'configMap'
|
||||
- 'emptyDir'
|
||||
- 'projected'
|
||||
- 'secret'
|
||||
- 'downwardAPI'
|
||||
# Assume that persistentVolumes set up by the cluster admin are safe to use.
|
||||
- 'persistentVolumeClaim'
|
||||
- 'hostPath'
|
||||
hostNetwork: false
|
||||
hostIPC: false
|
||||
hostPID: false
|
||||
runAsUser:
|
||||
# Require the container to run without root privileges.
|
||||
rule: 'RunAsAny'
|
||||
seLinux:
|
||||
# This policy assumes the nodes are using AppArmor rather than SELinux.
|
||||
rule: 'RunAsAny'
|
||||
supplementalGroups:
|
||||
rule: 'RunAsAny'
|
||||
fsGroup:
|
||||
rule: 'RunAsAny'
|
||||
readOnlyRootFilesystem: false
|
||||
44
charts/generic/pod-delete/rbac-psp.yaml
Normal file
44
charts/generic/pod-delete/rbac-psp.yaml
Normal file
@@ -0,0 +1,44 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: pod-delete-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-delete-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: pod-delete-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-delete-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: ["","litmuschaos.io","batch","apps"]
|
||||
resources: ["pods","deployments","pods/log","events","jobs","chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: ["policy"]
|
||||
resources: ["podsecuritypolicies"]
|
||||
verbs: ["use"]
|
||||
resourceNames: ["litmus"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: pod-delete-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-delete-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: pod-delete-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: pod-delete-sa
|
||||
namespace: default
|
||||
|
||||
43
charts/generic/pod-io-stress/rbac-psp.yaml
Normal file
43
charts/generic/pod-io-stress/rbac-psp.yaml
Normal file
@@ -0,0 +1,43 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: pod-io-stress-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-io-stress-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: pod-io-stress-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-io-stress-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: ["","litmuschaos.io","batch"]
|
||||
resources: ["pods","jobs","events","pods/log","pods/exec","chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: ["policy"]
|
||||
resources: ["podsecuritypolicies"]
|
||||
verbs: ["use"]
|
||||
resourceNames: ["litmus"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: pod-io-stress-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-io-stress-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: pod-io-stress-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: pod-io-stress-sa
|
||||
namespace: default
|
||||
43
charts/generic/pod-memory-hog/rbac-psp.yaml
Normal file
43
charts/generic/pod-memory-hog/rbac-psp.yaml
Normal file
@@ -0,0 +1,43 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: pod-memory-hog-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-memory-hog-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: pod-memory-hog-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-memory-hog-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: ["","litmuschaos.io","batch"]
|
||||
resources: ["pods","jobs","events","pods/log","pods/exec","chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: ["policy"]
|
||||
resources: ["podsecuritypolicies"]
|
||||
verbs: ["use"]
|
||||
resourceNames: ["litmus"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: pod-memory-hog-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-memory-hog-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: pod-memory-hog-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: pod-memory-hog-sa
|
||||
namespace: default
|
||||
43
charts/generic/pod-network-corruption/rbac-psp.yaml
Normal file
43
charts/generic/pod-network-corruption/rbac-psp.yaml
Normal file
@@ -0,0 +1,43 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: pod-network-corruption-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-network-corruption-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: pod-network-corruption-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-network-corruption-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: ["","litmuschaos.io","batch"]
|
||||
resources: ["pods","jobs","events","pods/log","chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: ["policy"]
|
||||
resources: ["podsecuritypolicies"]
|
||||
verbs: ["use"]
|
||||
resourceNames: ["litmus"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: pod-network-corruption-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-network-corruption-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: pod-network-corruption-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: pod-network-corruption-sa
|
||||
namespace: default
|
||||
42
charts/generic/pod-network-duplication/rbac-psp.yaml
Normal file
42
charts/generic/pod-network-duplication/rbac-psp.yaml
Normal file
@@ -0,0 +1,42 @@
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: pod-network-duplication-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-network-duplication-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: pod-network-duplication-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-network-duplication-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: ["","litmuschaos.io","batch"]
|
||||
resources: ["pods","jobs","events","pods/log","chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: ["policy"]
|
||||
resources: ["podsecuritypolicies"]
|
||||
verbs: ["use"]
|
||||
resourceNames: ["litmus"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: pod-network-duplication-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-network-duplication-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: pod-network-duplication-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: pod-network-duplication-sa
|
||||
namespace: default
|
||||
43
charts/generic/pod-network-latency/rbac-psp.yaml
Normal file
43
charts/generic/pod-network-latency/rbac-psp.yaml
Normal file
@@ -0,0 +1,43 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: pod-network-latency-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-network-latency-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: pod-network-latency-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-network-latency-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: ["","litmuschaos.io","batch"]
|
||||
resources: ["pods","jobs","pods/log","events","chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: ["policy"]
|
||||
resources: ["podsecuritypolicies"]
|
||||
verbs: ["use"]
|
||||
resourceNames: ["litmus"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: pod-network-latency-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-network-latency-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: pod-network-latency-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: pod-network-latency-sa
|
||||
namespace: default
|
||||
42
charts/generic/pod-network-loss/rbac-psp.yaml
Normal file
42
charts/generic/pod-network-loss/rbac-psp.yaml
Normal file
@@ -0,0 +1,42 @@
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: pod-network-loss-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-network-loss-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: pod-network-loss-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-network-loss-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
rules:
|
||||
- apiGroups: ["","litmuschaos.io","batch"]
|
||||
resources: ["pods","jobs","events","pods/log","chaosengines","chaosexperiments","chaosresults"]
|
||||
verbs: ["create","list","get","patch","update","delete","deletecollection"]
|
||||
- apiGroups: ["policy"]
|
||||
resources: ["podsecuritypolicies"]
|
||||
verbs: ["use"]
|
||||
resourceNames: ["litmus"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: pod-network-loss-sa
|
||||
namespace: default
|
||||
labels:
|
||||
name: pod-network-loss-sa
|
||||
app.kubernetes.io/part-of: litmus
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: pod-network-loss-sa
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: pod-network-loss-sa
|
||||
namespace: default
|
||||
Reference in New Issue
Block a user