Merge pull request #65474 from davidebelloni/patch-1

Automatic merge from submit-queue (batch tested with PRs 65319, 64513, 65474, 65601, 65634). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Enable “Kubernetes Monitoring” and “PodSecurityPolicies” on the same cluster Without that the daemonset "metadata-agent" return: ```pods "metadata-agent-" is forbidden: unable to validate against any pod security policy: [spec.containers[0].securityContext.containers[0].hostPort: Invalid value: 8799: Host port 8799 is not allowed to be used. Allowed ports: []]``` ```release-note NONE ```

Merge pull request #65474 from davidebelloni/patch-1
b9237462 · Kubernetes Submit Queue · GitHub · 7b46e884 · d8d894ae · b9237462
Unverified Commit b9237462 authored Jun 29, 2018 by Kubernetes Submit Queue Committed by GitHub Jun 29, 2018
Hide whitespace changes
Inline Side-by-side

Showing with 16 additions and 0 deletions

metadata-agent-psp-binding.yaml ...river/podsecuritypolicies/metadata-agent-psp-binding.yaml +16 -0

No files found.
--- a/cluster/addons/metadata-agent/stackdriver/podsecuritypolicies/metadata-agent-psp-binding.yaml
+++ b/cluster/addons/metadata-agent/stackdriver/podsecuritypolicies/metadata-agent-psp-binding.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: gce:podsecuritypolicy:metadata-agent
+  namespace: kube-system
+  labels:
+    addonmanager.kubernetes.io/mode: Reconcile
+    kubernetes.io/cluster-service: "true"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: gce:podsecuritypolicy:privileged
+subjects:
+  - kind: ServiceAccount
+    name: metadata-agent
+    namespace: kube-system