Enable “Kubernetes Monitoring” and “PodSecurityPolicies” on the same cluster

Without that the daemonset "metadata-agent" return: ```pods "metadata-agent-" is forbidden: unable to validate against any pod security policy: [spec.containers[0].securityContext.containers[0].hostPort: Invalid value: 8799: Host port 8799 is not allowed to be used. Allowed ports: []]```

Enable “Kubernetes Monitoring” and “PodSecurityPolicies” on the same cluster
b24bf0c5 · Davide Belloni · GitHub · 76b4699c · b24bf0c5
Unverified Commit b24bf0c5 authored Jun 26, 2018 by Davide Belloni Committed by GitHub Jun 26, 2018
Hide whitespace changes
Inline Side-by-side

Showing with 17 additions and 0 deletions

metadata-agent-rbac.yaml ...ddons/metadata-agent/stackdriver/metadata-agent-rbac.yaml +17 -0

No files found.
--- a/cluster/addons/metadata-agent/stackdriver/metadata-agent-rbac.yaml
+++ b/cluster/addons/metadata-agent/stackdriver/metadata-agent-rbac.yaml
@@ -32,3 +32,20 @@ subjects:
 - kind: ServiceAccount
  name: metadata-agent
  namespace: kube-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: gce:podsecuritypolicy:metadata-agent
+  namespace: kube-system
+  labels:
+    addonmanager.kubernetes.io/mode: Reconcile
+    kubernetes.io/cluster-service: "true"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: gce:podsecuritypolicy:privileged
+subjects:
+  - kind: ServiceAccount
+    name: metadata-agent
+    namespace: kube-system