Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make busybox securityContext configurable #649

Draft
wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

Make busybox securityContext configurable #649

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 37 additions & 0 deletions api/v1beta1/common_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -216,6 +216,43 @@ type AdditionalVolume struct {
DefaultContainerMount *corev1.VolumeMount `json:"defaultContainerMount,omitempty"`
}

// ContainerSecurityContext defines RunAsNonRoot, RunAsGroup and RunAsUser options
type ContainerSecurityContext struct {
// The UID to run the entrypoint of the container process.
// +optional
RunAsUser *int64 `json:"runAsUser,omitempty" protobuf:"varint,4,opt,name=runAsUser"`
// The GID to run the entrypoint of the container process.
// +optional
RunAsGroup *int64 `json:"runAsGroup,omitempty" protobuf:"varint,8,opt,name=runAsGroup"`
// Indicates that the container must run as a non-root user.
// +optional
RunAsNonRoot *bool `json:"runAsNonRoot,omitempty" protobuf:"varint,5,opt,name=runAsNonRoot"`
}

func (c *ContainerSecurityContext) withDefaults(userId int64, groupId int64, nonRoot bool) (changed bool) {
if c.RunAsUser == nil {
changed = true
c.RunAsUser = &userId
}
if c.RunAsGroup == nil {
changed = true
c.RunAsGroup = &groupId
}
if c.RunAsNonRoot == nil {
changed = true
c.RunAsNonRoot = &nonRoot
}
return changed
}

func (c *ContainerSecurityContext) ToSC() *corev1.SecurityContext {
return &corev1.SecurityContext{
RunAsUser: c.RunAsUser,
RunAsGroup: c.RunAsGroup,
RunAsNonRoot: c.RunAsNonRoot,
}
}

// ContainerImage defines the fields needed for a Docker repository image. The
// format here matches the predominant format used in Helm charts.
type ContainerImage struct {
Expand Down
14 changes: 13 additions & 1 deletion api/v1beta1/solrcloud_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,10 @@ const (
DefaultSolrGCTune = ""

DefaultBusyBoxImageRepo = "library/busybox"
DefaultBusyBoxImageVersion = "1.28.0-glibc"
DefaultBusyBoxImageVersion = "1.36.1-glibc"
DefaultBusyBoxUserId = int64(65534)
DefaultBusyBoxGroupId = int64(65534)
DefaultBusyBoxRunAsNonRoot = true

DefaultZkReplicas = int32(3)
DefaultZkStorage = "5Gi"
Expand Down Expand Up @@ -103,6 +106,9 @@ type SolrCloudSpec struct {
// +optional
BusyBoxImage *ContainerImage `json:"busyBoxImage,omitempty"`

// +optional
BusyBoxSecurityContext *ContainerSecurityContext `json:"busyBoxSecurityContext,omitempty"`

// +optional
SolrJavaMem string `json:"solrJavaMem,omitempty"`

Expand Down Expand Up @@ -204,6 +210,12 @@ func (spec *SolrCloudSpec) withDefaults(logger logr.Logger) (changed bool) {
}
changed = spec.BusyBoxImage.withDefaults(DefaultBusyBoxImageRepo, DefaultBusyBoxImageVersion, DefaultPullPolicy) || changed

if spec.BusyBoxSecurityContext == nil {
c := ContainerSecurityContext{}
spec.BusyBoxSecurityContext = &c
}
changed = spec.BusyBoxSecurityContext.withDefaults(DefaultBusyBoxUserId, DefaultBusyBoxGroupId, DefaultBusyBoxRunAsNonRoot) || changed

return changed
}

Expand Down
35 changes: 35 additions & 0 deletions api/v1beta1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

29 changes: 29 additions & 0 deletions config/crd/bases/solr.apache.org_solrclouds.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2015,6 +2015,35 @@ spec:
tag:
type: string
type: object
busyBoxSecurityContext:
description: ContainerSecurityContext defines RunAsNonRoot, RunAsGroup
and RunAsUser options
properties:
runAsGroup:
description: The GID to run the entrypoint of the container process.
Uses runtime default if unset. May also be set in PodSecurityContext. If
set in both SecurityContext and PodSecurityContext, the value
specified in SecurityContext takes precedence.
format: int64
type: integer
runAsNonRoot:
description: Indicates that the container must run as a non-root
user. If true, the Kubelet will validate the image at runtime
to ensure that it does not run as UID 0 (root) and fail to start
the container if it does. If unset or false, no such validation
will be performed. May also be set in PodSecurityContext. If
set in both SecurityContext and PodSecurityContext, the value
specified in SecurityContext takes precedence.
type: boolean
runAsUser:
description: The UID to run the entrypoint of the container process.
Defaults to user specified in image metadata if unspecified.
May also be set in PodSecurityContext. If set in both SecurityContext
and PodSecurityContext, the value specified in SecurityContext
takes precedence.
format: int64
type: integer
type: object
customSolrKubeOptions:
description: Provide custom options for kubernetes objects created
for the Solr Cloud.
Expand Down
1 change: 1 addition & 0 deletions controllers/util/solr_util.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -757,6 +757,7 @@ func generateSolrSetupInitContainers(solrCloud *solr.SolrCloud, solrCloudStatus
Requests: volumePrepResources,
Limits: volumePrepResources,
},
SecurityContext: solrCloud.Spec.BusyBoxSecurityContext.ToSC(),
}

containers = append(containers, volumePrepInitContainer)
Expand Down
29 changes: 29 additions & 0 deletions helm/solr-operator/crds/crds.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2264,6 +2264,35 @@ spec:
tag:
type: string
type: object
busyBoxSecurityContext:
description: ContainerSecurityContext defines RunAsNonRoot, RunAsGroup
and RunAsUser options
properties:
runAsGroup:
description: The GID to run the entrypoint of the container process.
Uses runtime default if unset. May also be set in PodSecurityContext. If
set in both SecurityContext and PodSecurityContext, the value
specified in SecurityContext takes precedence.
format: int64
type: integer
runAsNonRoot:
description: Indicates that the container must run as a non-root
user. If true, the Kubelet will validate the image at runtime
to ensure that it does not run as UID 0 (root) and fail to start
the container if it does. If unset or false, no such validation
will be performed. May also be set in PodSecurityContext. If
set in both SecurityContext and PodSecurityContext, the value
specified in SecurityContext takes precedence.
type: boolean
runAsUser:
description: The UID to run the entrypoint of the container process.
Defaults to user specified in image metadata if unspecified.
May also be set in PodSecurityContext. If set in both SecurityContext
and PodSecurityContext, the value specified in SecurityContext
takes precedence.
format: int64
type: integer
type: object
customSolrKubeOptions:
description: Provide custom options for kubernetes objects created
for the Solr Cloud.
Expand Down
2 changes: 1 addition & 1 deletion helm/solr/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@ image:

busyBoxImage: {}
# repository: "busybox"
# tag: "1.28.0-glibc"
# tag: "1.36.1-glibc"
# pullPolicy: ""
# imagePullSecret: ""

Expand Down
Loading