add agent Role object

charts/parca/templates/agent-podsecuritypolicy.yaml

@@ -1,4 +1,4 @@
-{{- if .Values.agent.enabled -}}
+{{- if and .Values.agent.enabled .Values.agent.podSecurityPolicy.enabled -}}
 apiVersion: policy/v1beta1
 kind: PodSecurityPolicy
 metadata:
@@ -36,4 +36,4 @@ spec:
   - downwardAPI
   - persistentVolumeClaim
   - hostPath
-{{- end }}
+{{- end }}

charts/parca/templates/agent-role.yaml

@@ -0,0 +1,18 @@
+{{- if and .Values.agent.enabled .Values.agent.podSecurityPolicy.enabled -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  labels:
+    {{- include "parca.labels.agent" . | nindent 4 }}
+  name: {{ include "parca.fullname" . }}-agent
+  namespace: {{ .Release.Namespace }}
+rules:
+- apiGroups:
+  - policy
+  resourceNames:
+  - {{ include "parca.fullname" . }}-agent
+  resources:
+  - podsecuritypolicies
+  verbs:
+  - use
+{{- end }}

charts/parca/templates/agent-rolebinding.yaml

@@ -1,4 +1,4 @@
-{{- if .Values.agent.enabled -}}
+{{- if and .Values.agent.enabled .Values.agent.podSecurityPolicy.enabled -}}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
@@ -13,4 +13,4 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: {{ include "parca.fullname" . }}-agent
-{{- end }}
+{{- end }}

charts/parca/values.yaml

@@ -54,6 +54,9 @@ agent:
       operator: Exists
   # -- resource limits and requests
   resources: {}
+  # -- podSecurityPolicy for agent
+  podSecurityPolicy:
+    enabled: true
 
 server:
   # -- Allows disabling parca server