[Promtail] enables configuring psp in helm chart (#2659)

* makes pod security policy configurable

* bump promtail chart version

* bump loki-stack chart version

production/helm/loki-stack/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: "v1"
 name: loki-stack
-version: 0.40.1
+version: 0.41.0
 appVersion: v1.6.0
 kubeVersion: "^1.10.0-0"
 description: "Loki: like Prometheus, but for logs."

production/helm/promtail/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: "v1"
 name: promtail
-version: 0.24.0
+version: 0.25.0
 appVersion: v1.6.0
 kubeVersion: "^1.10.0-0"
 description: "Responsible for gathering logs and sending them to Loki"

production/helm/promtail/templates/podsecuritypolicy.yaml

@@ -9,27 +9,5 @@ metadata:
     heritage: {{ .Release.Service }}
     release: {{ .Release.Name }}
 spec:
-  privileged: false
-  allowPrivilegeEscalation: false
-  volumes:
-    - 'secret'
-    - 'configMap'
-    - 'hostPath'
-    - 'projected'
-    - 'downwardAPI'
-    - 'emptyDir'
-  hostNetwork: false
-  hostIPC: false
-  hostPID: false
-  runAsUser:
-    rule: 'RunAsAny'
-  seLinux:
-    rule: 'RunAsAny'
-  supplementalGroups:
-    rule: 'RunAsAny'
-  fsGroup:
-    rule: 'RunAsAny'
-  readOnlyRootFilesystem: true
-  requiredDropCapabilities:
-    - ALL
-  {{- end }}
+  {{- toYaml .Values.podSecurityPolicy | nindent 2 }}
+{{- end }}

production/helm/promtail/values.yaml

@@ -58,6 +58,31 @@ rbac:
   create: true
   pspEnabled: true
 
+podSecurityPolicy:
+  privileged: false
+  allowPrivilegeEscalation: false
+  volumes:
+    - 'secret'
+    - 'configMap'
+    - 'hostPath'
+    - 'projected'
+    - 'downwardAPI'
+    - 'emptyDir'
+  hostNetwork: false
+  hostIPC: false
+  hostPID: false
+  runAsUser:
+    rule: 'RunAsAny'
+  seLinux:
+    rule: 'RunAsAny'
+  supplementalGroups:
+    rule: 'RunAsAny'
+  fsGroup:
+    rule: 'RunAsAny'
+  readOnlyRootFilesystem: true
+  requiredDropCapabilities:
+    - ALL
+
 readinessProbe:
   failureThreshold: 5
   httpGet: