Merge branch 'master' into feature/wifi-5420--add-sysctl-context

Signed-off-by: Dmitry Dunaev <dmitry@opsfleet.com>

helm/templates/deployment.yaml

@@ -25,7 +25,7 @@ spec:
       annotations:
         checksum/config: {{ include "owgw.config" . | sha256sum }}
         {{- if .Values.podSecurityPolicy.enabled }}
-        kubernetes.io/psp: {{ include "owgw.fullname" . }}-{{ .Release.Namespace }}-unsafe-sysctl
+        kubernetes.io/psp: {{ include "owgw.fullname" . }}-{{ .Release.Namespace }}-owgw-unsafe-sysctl
         {{- end }}
         {{- with .Values.podAnnotations }}
         {{- toYaml . | nindent 8 }}

helm/templates/psp.yaml

@@ -3,7 +3,7 @@
 apiVersion: policy/v1beta1
 kind: PodSecurityPolicy
 metadata:
-  name: {{ include "owgw.fullname" . }}-{{ .Release.Namespace }}-unsafe-sysctl
+  name: {{ include "owgw.fullname" . }}-{{ .Release.Namespace }}-owgw-unsafe-sysctl
   labels:
     app.kubernetes.io/name: {{ include "owgw.name" . }}
     helm.sh/chart: {{ include "owgw.chart" . }}

helm/templates/role.yaml

@@ -0,0 +1,16 @@
+{{- if .Values.podSecurityPolicy.enabled }}
+---
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ include "owgw.fullname" . }}-owgw-use-unsafe-sysctl
+rules:
+- apiGroups:
+  - policy
+  resources:
+  - podsecuritypolicies
+  verbs:
+  - use
+  resourceNames:
+  - {{ include "owgw.fullname" . }}-{{ .Release.Namespace }}-owgw-unsafe-sysctl
+{{- end }}

helm/templates/rolebinding.yaml

@@ -0,0 +1,15 @@
+{{- if .Values.podSecurityPolicy.enabled }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "owgw.fullname" . }}-owgw-use-unsafe-sysctl-to-default
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ include "owgw.fullname" . }}-owgw-use-unsafe-sysctl
+subjects:
+- kind: ServiceAccount
+  name: default
+  namespace: {{ .Release.Namespace }}
+{{- end }}