Skip to content

Commit 3d04f4a

Browse files
EliMoshkovichEliMoshkovich
committed
Openshift support
1 parent 3984bde commit 3d04f4a

File tree

4 files changed

+167
-8
lines changed

4 files changed

+167
-8
lines changed

‎charts/pdp/Chart.yaml‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,13 @@
11
apiVersion: v2
22
name: pdp
3-
description: An official Helm chart for Permit.io PDP (Policy Decision Point)
4-
version: 0.0.4
3+
description: An official Helm chart for Permit.io PDP (Policy Decision Point) with OpenShift support
4+
version: 0.0.5
5+
keywords:
6+
- policy
7+
- authorization
8+
- security
9+
- permit
10+
- openshift
11+
maintainers:
12+
- name: Permit.io
13+
url: https://permit.io

‎charts/pdp/templates/deployment.yaml‎

Lines changed: 87 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,10 +22,83 @@ spec:
2222
{{- toYaml . | nindent 8 }}
2323
{{- end }}
2424
spec:
25+
{{- if .Values.openshift.enabled }}
26+
serviceAccountName: {{ .Values.openshift.serviceAccount.name }}
27+
# OpenShift-compatible pod security context
28+
securityContext:
29+
{{- if .Values.openshift.securityContext.pod.runAsNonRoot }}
30+
runAsNonRoot: {{ .Values.openshift.securityContext.pod.runAsNonRoot }}
31+
{{- end }}
32+
{{- if .Values.openshift.securityContext.pod.runAsUser }}
33+
runAsUser: {{ .Values.openshift.securityContext.pod.runAsUser }}
34+
{{- end }}
35+
{{- if .Values.openshift.securityContext.pod.runAsGroup }}
36+
runAsGroup: {{ .Values.openshift.securityContext.pod.runAsGroup }}
37+
{{- end }}
38+
{{- if .Values.openshift.securityContext.pod.fsGroup }}
39+
fsGroup: {{ .Values.openshift.securityContext.pod.fsGroup }}
40+
{{- end }}
41+
seccompProfile:
42+
type: RuntimeDefault
43+
{{- else }}
44+
# Standard Kubernetes security context
45+
securityContext:
46+
{{- if .Values.securityContext.standard.pod.runAsNonRoot }}
47+
runAsNonRoot: {{ .Values.securityContext.standard.pod.runAsNonRoot }}
48+
{{- end }}
49+
{{- if .Values.securityContext.standard.pod.runAsUser }}
50+
runAsUser: {{ .Values.securityContext.standard.pod.runAsUser }}
51+
{{- end }}
52+
{{- if .Values.securityContext.standard.pod.runAsGroup }}
53+
runAsGroup: {{ .Values.securityContext.standard.pod.runAsGroup }}
54+
{{- end }}
55+
{{- if .Values.securityContext.standard.pod.fsGroup }}
56+
fsGroup: {{ .Values.securityContext.standard.pod.fsGroup }}
57+
{{- end }}
58+
seccompProfile:
59+
type: RuntimeDefault
60+
{{- end }}
2561
containers:
2662
- name: permitio-pdp
2763
image: "{{ .Values.pdp.image.repository }}:{{ .Values.pdp.image.tag }}"
2864
imagePullPolicy: {{ .Values.pdp.image.pullPolicy }}
65+
{{- if .Values.openshift.enabled }}
66+
# OpenShift-compatible container security context
67+
securityContext:
68+
allowPrivilegeEscalation: false
69+
capabilities:
70+
drop:
71+
- ALL
72+
{{- if .Values.openshift.securityContext.container.runAsNonRoot }}
73+
runAsNonRoot: {{ .Values.openshift.securityContext.container.runAsNonRoot }}
74+
{{- end }}
75+
{{- if .Values.openshift.securityContext.container.runAsUser }}
76+
runAsUser: {{ .Values.openshift.securityContext.container.runAsUser }}
77+
{{- end }}
78+
{{- if .Values.openshift.securityContext.container.runAsGroup }}
79+
runAsGroup: {{ .Values.openshift.securityContext.container.runAsGroup }}
80+
{{- end }}
81+
seccompProfile:
82+
type: RuntimeDefault
83+
{{- else }}
84+
# Standard Kubernetes container security context
85+
securityContext:
86+
allowPrivilegeEscalation: false
87+
capabilities:
88+
drop:
89+
- ALL
90+
{{- if .Values.securityContext.standard.container.runAsNonRoot }}
91+
runAsNonRoot: {{ .Values.securityContext.standard.container.runAsNonRoot }}
92+
{{- end }}
93+
{{- if .Values.securityContext.standard.container.runAsUser }}
94+
runAsUser: {{ .Values.securityContext.standard.container.runAsUser }}
95+
{{- end }}
96+
{{- if .Values.securityContext.standard.container.runAsGroup }}
97+
runAsGroup: {{ .Values.securityContext.standard.container.runAsGroup }}
98+
{{- end }}
99+
seccompProfile:
100+
type: RuntimeDefault
101+
{{- end }}
29102
ports:
30103
- containerPort: {{ .Values.pdp.port }}
31104
env:
@@ -90,10 +163,16 @@ spec:
90163
port: 7000
91164
initialDelaySeconds: 10
92165
periodSeconds: 10
93-
{{- if .Values.pdp.logs_forwarder.enabled }}
94166
volumeMounts:
167+
{{- if .Values.pdp.logs_forwarder.enabled }}
95168
- name: logs
96169
mountPath: /tmp/
170+
{{- else if .Values.openshift.enabled }}
171+
# OpenShift filesystem permissions volume mounts
172+
- name: tmp-volume
173+
mountPath: /tmp
174+
- name: opa-volume
175+
mountPath: /opa
97176
{{- end }}
98177
{{- if .Values.pdp.logs_forwarder.enabled }}
99178
- name: fluentbit
@@ -110,11 +189,17 @@ spec:
110189
fieldRef:
111190
fieldPath: metadata.labels['app']
112191
{{- end }}
113-
{{- if .Values.pdp.logs_forwarder.enabled }}
114192
volumes:
193+
{{- if .Values.pdp.logs_forwarder.enabled }}
115194
- name: fluent-bit-config
116195
configMap:
117196
name: fluentbit-config
118197
- name: logs
119198
emptyDir: {}
199+
{{- else if .Values.openshift.enabled }}
200+
# OpenShift filesystem permissions volumes
201+
- name: tmp-volume
202+
emptyDir: {}
203+
- name: opa-volume
204+
emptyDir: {}
120205
{{- end }}

‎charts/pdp/templates/serviceaccount.yaml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{{- if and .Values.openshift.enabled .Values.openshift.serviceAccount.create }}
2+
apiVersion: v1
3+
kind: ServiceAccount
4+
metadata:
5+
name: {{ .Values.openshift.serviceAccount.name }}
6+
namespace: {{ .Release.Namespace }}
7+
labels:
8+
{{- include "pdp.labels" . | nindent 4 }}
9+
{{- end }}
10+
11+
{{- if and .Values.openshift.enabled .Values.openshift.serviceAccount.create }}
12+
---
13+
# RoleBinding to allow the ServiceAccount to use the specified SCC
14+
apiVersion: rbac.authorization.k8s.io/v1
15+
kind: RoleBinding
16+
metadata:
17+
name: {{ .Values.openshift.serviceAccount.name }}-scc-binding
18+
namespace: {{ .Release.Namespace }}
19+
labels:
20+
{{- include "pdp.labels" . | nindent 4 }}
21+
subjects:
22+
- kind: ServiceAccount
23+
name: {{ .Values.openshift.serviceAccount.name }}
24+
namespace: {{ .Release.Namespace }}
25+
roleRef:
26+
kind: ClusterRole
27+
name: system:openshift:scc:{{ .Values.openshift.serviceAccount.sccName }}
28+
apiGroup: rbac.authorization.k8s.io
29+
{{- end }}

‎charts/pdp/values.yaml‎

Lines changed: 40 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,9 @@ annotations: {}
33

44
pdp:
55
pdpEnvs:
6-
[]
7-
# - name: custom_env
8-
# value: "custom_env"
9-
ApiKey: "<your PDP API Key>"
6+
- name: PDP_CONTROL_PLANE
7+
value: "http://permit-backend-v2:8000"
8+
ApiKey: "permit_key_kymHPKiIiUGklAMnSJfqEE9YRNCsFn52SQzFO2eCnwLfnEgQ7kg8HvuV7MOedG30IfGinaAgq9nYSoJTOArJf6"
109
# Use an existing secret for the API key instead of creating one
1110
# If defined, the chart will not create a secret and will use this existing secret
1211
# existingApiKeySecret:
@@ -41,3 +40,40 @@ resources:
4140
memory: "512Mi"
4241
limits:
4342
memory: "1Gi"
43+
44+
# OpenShift configuration
45+
openshift:
46+
enabled: false # Set to true for OpenShift deployments
47+
# ServiceAccount configuration for OpenShift compatibility
48+
serviceAccount:
49+
create: true
50+
name: "permitio-pdp-sa"
51+
sccName: "restricted-v2" # OpenShift Security Context Constraint
52+
# Security context configuration for OpenShift
53+
securityContext:
54+
# Pod security context (applied to all containers in pod)
55+
pod:
56+
runAsNonRoot: true
57+
# runAsUser: null # OpenShift SCC assigns UID automatically
58+
# runAsGroup: null # OpenShift SCC assigns GID automatically
59+
# fsGroup: null # OpenShift SCC assigns fsGroup automatically
60+
# Container security context (applied to individual containers)
61+
container:
62+
runAsNonRoot: true
63+
# runAsUser: null # OpenShift SCC assigns UID automatically
64+
# runAsGroup: null # OpenShift SCC assigns GID automatically
65+
66+
# Standard Kubernetes security contexts (used when openshift.enabled: false)
67+
securityContext:
68+
standard:
69+
# Pod security context (applied to all containers in pod)
70+
pod:
71+
runAsNonRoot: true
72+
runAsUser: 1001
73+
runAsGroup: 1001
74+
fsGroup: 1001
75+
# Container security context (applied to individual containers)
76+
container:
77+
runAsNonRoot: true
78+
runAsUser: 1001
79+
runAsGroup: 1001

0 commit comments

Comments
 (0)