New PSP and RBAC resources for the control plane

[alpeb]

In a cluster with PSP enabled, we need to grant enough privileges to the control plane components or else they won't be scheduled. The creation of these resources doesn't hurt even if the PSP admission controller is not enabled.

A PSP granting enough privileges for the Linkerd containers:

apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: linkerd
spec:
  allowPrivilegeEscalation: false
  allowedCapabilities:
  - NET_ADMIN
  fsGroup:
    rule: RunAsAny
  readOnlyRootFilesystem: true
  runAsUser:
    rule: RunAsAny
  seLinux:
    rule: RunAsAny
  supplementalGroups:
    rule: RunAsAny
  volumes:
  - ConfigMap
  - secret
  - emptyDir

A ClusterRole pointing to that PSP:

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: psp:linkerd
rules:
- apiGroups: ['policy']
  resources: ['podsecuritypolicies']
  verbs:     ['use']
  resourceNames:
  - linkerd

A ClusterRoleBinding binding that role to all the Linkerd ServiceAccounts:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: linkerd-rbac
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: psp:linkerd
subjects:
- kind: ServiceAccount
  name: linkerd-controller
  namespace: linkerd
- kind: ServiceAccount
  name: linkerd-grafana
  namespace: linkerd
- kind: ServiceAccount
  name: linkerd-identity
  namespace: linkerd
- kind: ServiceAccount
  name: linkerd-prometheus
  namespace: linkerd
- kind: ServiceAccount
  name: linkerd-proxy-injector
  namespace: linkerd
- kind: ServiceAccount
  name: linkerd-web
  namespace: linkerd
- kind: ServiceAccount
  name: linkerd-sp-validator
  namespace: linkerd
- kind: ServiceAccount
  name: linkerd-tap
  namespace: linkerd

For CNI, we also need to create a separate PSP, ClusteRole and ClusterRoleBinding, given the CNI pod requires a bit more privileges.

[ihcsim]

@alpeb @grampelberg Do we have any opinion on whether we want to introduce a new install and upgrade option like (--enable-psp), or just always install the policies by default? The policies won't be in-effect until the PSP admission controller is enabled.

[grampelberg]

I'm a +1 to always installing the policies by default.