Add argocd-redis psp

charts/argo-cd/templates/_helpers.tpl

@@ -52,6 +52,17 @@ Create redis name and version as used by the chart label.
 {{- end -}}
 {{- end -}}
 
+{{/*
+Create the name of the redis service account to use
+*/}}
+{{- define "argo-cd.redisServiceAccountName" -}}
+{{- if .Values.redis.serviceAccount.create -}}
+    {{ default (include "argo-cd.fullname" .) .Values.redis.serviceAccount.name }}
+{{- else -}}
+    {{ default "default" .Values.redis.serviceAccount.name }}
+{{- end -}}
+{{- end -}}
+
 {{/*
 Create argocd server name and version as used by the chart label.
 */}}

charts/argo-cd/templates/redis/deployment.yaml

@@ -81,6 +81,7 @@ spec:
       affinity:
 {{- toYaml .Values.redis.affinity | nindent 8 }}
     {{- end }}
+      serviceAccountName: {{ template "argo-cd.redisServiceAccountName" . }}
 {{- if .Values.redis.volumes }}
       volumes:
 {{- toYaml .Values.redis.volumes | nindent 8}}

charts/argo-cd/templates/redis/psp.yaml

@@ -0,0 +1,66 @@
+{{- if .Values.redis.pspEnabled }}
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: {{ template "argo-cd.redis.fullname" . }}
+  labels:
+    helm.sh/chart: {{ include "argo-cd.chart" . }}
+    app.kubernetes.io/name: {{ include "argo-cd.name" . }}-{{ .Values.redis.name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+  annotations:
+    seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'
+spec:
+  privileged: false
+  hostIPC: false
+  hostNetwork: false
+  hostPID: false
+  readOnlyRootFilesystem: false
+  allowPrivilegeEscalation: false
+  allowedCapabilities:
+    - '*'
+  fsGroup:
+    rule: RunAsAny
+  runAsUser:
+    rule: RunAsAny
+  seLinux:
+    rule: RunAsAny
+  supplementalGroups:
+    rule: RunAsAny
+  volumes:
+    - '*'
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ template "argo-cd.redis.fullname" . }}-psp
+  labels:
+    helm.sh/chart: {{ include "argo-cd.chart" . }}
+    app.kubernetes.io/name: {{ include "argo-cd.name" . }}-{{ .Values.redis.name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+rules:
+  - apiGroups: ['policy']
+    resources: ['podsecuritypolicies']
+    verbs:     ['use']
+    resourceNames:
+      - {{ template "argo-cd.redis.fullname" . }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "argo-cd.redis.fullname" . }}-psp
+  labels:
+    helm.sh/chart: {{ include "argo-cd.chart" . }}
+    app.kubernetes.io/name: {{ include "argo-cd.name" . }}-{{ .Values.redis.name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "argo-cd.redis.fullname" . }}-psp
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "argo-cd.redisServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end }}

charts/argo-cd/templates/redis/serviceaccount.yaml

@@ -0,0 +1,13 @@
+{{- if .Values.redis.serviceAccount.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "argo-cd.redisServiceAccountName" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "argo-cd.name" . }}-{{ .Values.redis.name }}
+    helm.sh/chart: {{ include "argo-cd.chart" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/part-of: argocd
+    app.kubernetes.io/component: {{ .Values.redis.name }}
+{{- end }}