Skip to content

Set fsGroup for RavenDB pods #39

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jkossis wants to merge 1 commit into
base: main
Choose a base branch
from
+41 −21
Open

Set fsGroup for RavenDB pods #39

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 19 additions & 21 deletions pkg/resource/statefulset.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@ import (
appsv1 "k8s.io/api/apps/v1"
corev1 "k8s.io/api/core/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/utils/pointer"
client "sigs.k8s.io/controller-runtime/pkg/client"
)

Expand All @@ -34,12 +35,10 @@ func NewStatefulSetBuilder() PerNodeBuilder {
return &StatefulSetBuilder{}
}


func (b *StatefulSetBuilder) Build(ctx context.Context, cluster *ravendbv1.RavenDBCluster, node ravendbv1.RavenDBNode) (client.Object, error) {
return BuildStatefulSet(cluster, node)
}


func BuildStatefulSet(cluster *ravendbv1.RavenDBCluster, node ravendbv1.RavenDBNode) (*appsv1.StatefulSet, error) {
stsName := common.NodeResourceName(node.Tag)

Expand All @@ -61,7 +60,6 @@ func BuildStatefulSet(cluster *ravendbv1.RavenDBCluster, node ravendbv1.RavenDBN

affinity := buildAWSNodeAffinity(cluster, node.Tag)


sts := &appsv1.StatefulSet{
TypeMeta: metav1.TypeMeta{
APIVersion: "apps/v1",
Expand All @@ -87,16 +85,7 @@ func BuildStatefulSet(cluster *ravendbv1.RavenDBCluster, node ravendbv1.RavenDBN
Affinity: affinity,
ServiceAccountName: common.RavenDbNodeServiceAccount,

// alows us to bind lower ports like 443
// considered safe. see: https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/#safe-and-unsafe-sysctls
SecurityContext: &corev1.PodSecurityContext{
Sysctls: []corev1.Sysctl{
{
Name: "net.ipv4.ip_unprivileged_port_start",
Value: "0",
},
},
},
SecurityContext: buildPodSecurityContext(),
},
},
VolumeClaimTemplates: volumeClaims,
Expand All @@ -106,6 +95,23 @@ func BuildStatefulSet(cluster *ravendbv1.RavenDBCluster, node ravendbv1.RavenDBN
return sts, nil
}

func buildPodSecurityContext() *corev1.PodSecurityContext {
fsGroupChangePolicy := corev1.FSGroupChangeOnRootMismatch

return &corev1.PodSecurityContext{
FSGroup: pointer.Int64(999),
FSGroupChangePolicy: &fsGroupChangePolicy,

// Allows RavenDB to bind lower ports like 443. This sysctl is considered safe.
// See: https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/#safe-and-unsafe-sysctls
Sysctls: []corev1.Sysctl{
{
Name: "net.ipv4.ip_unprivileged_port_start",
Value: "0",
},
},
}
}

func buildContainers(image string, env []corev1.EnvVar, ports []corev1.ContainerPort, mounts []corev1.VolumeMount, ipp corev1.PullPolicy, cluster *ravendbv1.RavenDBCluster) []corev1.Container {
rdbContainer := BuildRavenDBContainer(image, env, ports, mounts, ipp)
Expand All @@ -119,14 +125,11 @@ func buildContainers(image string, env []corev1.EnvVar, ports []corev1.Container

}



func buildStatefulsetSelector(node ravendbv1.RavenDBNode) map[string]string {
return map[string]string{
common.LabelNodeTag: node.Tag}
}


func buildStatefulsetLabels(cluster *ravendbv1.RavenDBCluster, node ravendbv1.RavenDBNode) map[string]string {
return map[string]string{
common.LabelAppName: common.App,
Expand All @@ -142,7 +145,6 @@ func buildStatefulsetAnnotations() map[string]string {
}
}


func buildEnvVars(cluster *ravendbv1.RavenDBCluster, node ravendbv1.RavenDBNode) ([]corev1.EnvVar, error) {
env := common.BuildCommonEnvVars(cluster, node)

Expand Down Expand Up @@ -176,7 +178,6 @@ func buildPorts() []corev1.ContainerPort {
}
}


func buildVolumes(cluster *ravendbv1.RavenDBCluster, node ravendbv1.RavenDBNode) []corev1.Volume {

var volumes []corev1.Volume
Expand Down Expand Up @@ -226,7 +227,6 @@ func buildVolumes(cluster *ravendbv1.RavenDBCluster, node ravendbv1.RavenDBNode)
return volumes
}


func buildVolumeMounts(cluster *ravendbv1.RavenDBCluster) []corev1.VolumeMount {
vMounts := []corev1.VolumeMount{
buildVolumeMount(common.DataVolumeName, common.DataMountPath),
Expand Down Expand Up @@ -278,7 +278,6 @@ func buildVolumeMounts(cluster *ravendbv1.RavenDBCluster) []corev1.VolumeMount {
return vMounts
}


func BuildPVCs(cluster *ravendbv1.RavenDBCluster) []corev1.PersistentVolumeClaim {
var pvcs []corev1.PersistentVolumeClaim

Expand Down Expand Up @@ -317,7 +316,6 @@ func BuildPVCs(cluster *ravendbv1.RavenDBCluster) []corev1.PersistentVolumeClaim
return pvcs
}


func buildAWSNodeAffinity(cluster *ravendbv1.RavenDBCluster, tag string) *corev1.Affinity {
if cluster.Spec.ExternalAccessConfiguration == nil ||

Expand Down
22 changes: 22 additions & 0 deletions pkg/resource/statefulset_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
package resource

import (
"testing"

"github.com/stretchr/testify/require"
corev1 "k8s.io/api/core/v1"
)

func TestBuildPodSecurityContextSetsRavenDBFsGroup(t *testing.T) {
sc := buildPodSecurityContext()

require.NotNil(t, sc)
require.NotNil(t, sc.FSGroup)
require.EqualValues(t, 999, *sc.FSGroup)
require.NotNil(t, sc.FSGroupChangePolicy)
require.Equal(t, corev1.FSGroupChangeOnRootMismatch, *sc.FSGroupChangePolicy)
require.Contains(t, sc.Sysctls, corev1.Sysctl{
Name: "net.ipv4.ip_unprivileged_port_start",
Value: "0",
})
}