From f91fa3c12f0c99a4d5f06eccac5d4b83645c7f18 Mon Sep 17 00:00:00 2001
From: Matteo Ruina <matteo.ruina@skyscanner.net>
Date: Tue, 30 Jun 2020 16:43:16 +0200
Subject: [PATCH] Add argocd-server psp

---
 .../argo-cd/templates/argocd-server/psp.yaml  | 66 +++++++++++++++++++
 1 file changed, 66 insertions(+)
 create mode 100644 charts/argo-cd/templates/argocd-server/psp.yaml

diff --git a/charts/argo-cd/templates/argocd-server/psp.yaml b/charts/argo-cd/templates/argocd-server/psp.yaml
new file mode 100644
index 00000000..b415380b
--- /dev/null
+++ b/charts/argo-cd/templates/argocd-server/psp.yaml
@@ -0,0 +1,66 @@
+{{- if .Values.server.pspEnabled }}
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: {{ template "argo-cd.server.fullname" . }}
+  labels:
+    helm.sh/chart: {{ include "argo-cd.chart" . }}
+    app.kubernetes.io/name: {{ include "argo-cd.name" . }}-{{ .Values.server.name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+  annotations:
+    seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'
+spec:
+  privileged: false
+  hostIPC: false
+  hostNetwork: false
+  hostPID: false
+  readOnlyRootFilesystem: false
+  allowPrivilegeEscalation: false
+  allowedCapabilities:
+    - '*'
+  fsGroup:
+    rule: RunAsAny
+  runAsUser:
+    rule: RunAsAny
+  seLinux:
+    rule: RunAsAny
+  supplementalGroups:
+    rule: RunAsAny
+  volumes:
+    - '*'
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ template "argo-cd.server.fullname" . }}-psp
+  labels:
+    helm.sh/chart: {{ include "argo-cd.chart" . }}
+    app.kubernetes.io/name: {{ include "argo-cd.name" . }}-{{ .Values.server.name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+rules:
+  - apiGroups: ['policy']
+    resources: ['podsecuritypolicies']
+    verbs:     ['use']
+    resourceNames:
+      - {{ template "argo-cd.server.fullname" . }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "argo-cd.server.fullname" . }}-psp
+  labels:
+    helm.sh/chart: {{ include "argo-cd.chart" . }}
+    app.kubernetes.io/name: {{ include "argo-cd.name" . }}-{{ .Values.server.name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "argo-cd.server.fullname" . }}-psp
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "argo-cd.serverServiceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end }}