From 23bc6fa43286b0a856403a2e13550c60838601a2 Mon Sep 17 00:00:00 2001 From: Paul Charlton Date: Mon, 19 Mar 2018 06:43:58 -0700 Subject: [PATCH] [stable/mariadb] add settings that can be overridden for Discretionary Access Controls (#3599) * add settings that can be overridden for Discretionary Access Controls - runAs, fsGroup. ref : https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ * remove spaces per lint * bump to 2.1.12 * merge down latest changes from master; bump chart version number --- stable/mariadb/Chart.yaml | 2 +- stable/mariadb/README.md | 50 ++++++++++++------------ stable/mariadb/templates/deployment.yaml | 4 +- stable/mariadb/values.yaml | 7 ++++ 4 files changed, 36 insertions(+), 27 deletions(-) diff --git a/stable/mariadb/Chart.yaml b/stable/mariadb/Chart.yaml index 49d726f525..31f8874997 100644 --- a/stable/mariadb/Chart.yaml +++ b/stable/mariadb/Chart.yaml @@ -1,5 +1,5 @@ name: mariadb -version: 2.1.12 +version: 2.1.13 appVersion: 10.1.31 description: Fast, reliable, scalable, and easy to use open-source relational database system. MariaDB Server is intended for mission-critical, heavy-load production systems as well as for embedding into mass-deployed software. keywords: diff --git a/stable/mariadb/README.md b/stable/mariadb/README.md index 37a7b14444..7360f8d3f8 100644 --- a/stable/mariadb/README.md +++ b/stable/mariadb/README.md @@ -45,30 +45,32 @@ The command removes all the Kubernetes components associated with the chart and The following table lists the configurable parameters of the MariaDB chart and their default values. -| Parameter | Description | Default | -| --------------------------- | ------------------------------------------ | ------------------------------------------- | -| `image` | MariaDB image | `bitnami/mariadb:{VERSION}` | -| `service.type` | Kubernetes service type to expose | `ClusterIP` | -| `service.nodePort` | Port to bind to for NodePort service type | `nil` | -| `service.annotations` | Additional annotations to add to service | `nil` | -| `imagePullPolicy` | Image pull policy. | `IfNotPresent` | -| `usePassword` | Enable password authentication | `true` | -| `mariadbRootPassword` | Password for the `root` user. | Randomly generated | -| `mariadbUser` | Username of new user to create. | `nil` | -| `mariadbPassword` | Password for the new user. | `nil` | -| `mariadbDatabase` | Name for new database to create. | `nil` | -| `persistence.enabled` | Use a PVC to persist data | `true` | -| `persistence.existingClaim` | Use an existing PVC | `nil` | -| `persistence.storageClass` | Storage class of backing PVC | `nil` (uses alpha storage class annotation) | -| `persistence.accessMode` | Use volume as ReadOnly or ReadWrite | `ReadWriteOnce` | -| `persistence.size` | Size of data volume | `8Gi` | -| `resources` | CPU/Memory resource requests/limits | Memory: `256Mi`, CPU: `250m` | -| `config` | Multi-line string for my.cnf configuration | `nil` | -| `metrics.enabled` | Start a side-car prometheus exporter | `false` | -| `metrics.image` | Exporter image | `prom/mysqld-exporter` | -| `metrics.imageTag` | Exporter image | `v0.10.0` | -| `metrics.imagePullPolicy` | Exporter image pull policy | `IfNotPresent` | -| `metrics.resources` | Exporter resource requests/limit | `nil` | +| Parameter | Description | Default | +| ---------------------------- | ------------------------------------------ | ------------------------------------------- | +| `image` | MariaDB image | `bitnami/mariadb:{VERSION}` | +| `service.type` | Kubernetes service type to expose | `ClusterIP` | +| `service.nodePort` | Port to bind to for NodePort service type | `nil` | +| `service.annotations` | Additional annotations to add to service | `nil` | +| `imagePullPolicy` | Image pull policy. | `IfNotPresent` | +| `usePassword` | Enable password authentication | `true` | +| `mariadbRootPassword` | Password for the `root` user. | Randomly generated | +| `mariadbUser` | Username of new user to create. | `nil` | +| `mariadbPassword` | Password for the new user. | `nil` | +| `mariadbDatabase` | Name for new database to create. | `nil` | +| `persistence.enabled` | Use a PVC to persist data | `true` | +| `persistence.existingClaim` | Use an existing PVC | `nil` | +| `persistence.storageClass` | Storage class of backing PVC | `nil` (uses alpha storage class annotation) | +| `persistence.accessMode` | Use volume as ReadOnly or ReadWrite | `ReadWriteOnce` | +| `persistence.size` | Size of data volume | `8Gi` | +| `resources` | CPU/Memory resource requests/limits | Memory: `256Mi`, CPU: `250m` | +| `config` | Multi-line string for my.cnf configuration | `nil` | +| `metrics.enabled` | Start a side-car prometheus exporter | `false` | +| `metrics.image` | Exporter image | `prom/mysqld-exporter` | +| `metrics.imageTag` | Exporter image | `v0.10.0` | +| `metrics.imagePullPolicy` | Exporter image pull policy | `IfNotPresent` | +| `metrics.resources` | Exporter resource requests/limit | `nil` | +| `securitySettings.runAsUser` | DAC UID for containers in this Deployment | `1001` | +| `securitySettings.fsGroup` | DAC GID for containers in this Deployment | `1001` | The above parameters map to the env variables defined in [bitnami/mariadb](http://github.com/bitnami/bitnami-docker-mariadb). For more information please refer to the [bitnami/mariadb](http://github.com/bitnami/bitnami-docker-mariadb) image documentation. diff --git a/stable/mariadb/templates/deployment.yaml b/stable/mariadb/templates/deployment.yaml index 342ac1645b..66bab94762 100644 --- a/stable/mariadb/templates/deployment.yaml +++ b/stable/mariadb/templates/deployment.yaml @@ -14,8 +14,8 @@ spec: app: {{ template "mariadb.name" . }} spec: securityContext: - runAsUser: 1001 - fsGroup: 1001 + runAsUser: {{ .Values.securitySettings.runAsUser }} + fsGroup: {{ .Values.securitySettings.fsGroup }} initContainers: - name: "copy-custom-config" image: "busybox" diff --git a/stable/mariadb/values.yaml b/stable/mariadb/values.yaml index c5b210065b..59505bc805 100644 --- a/stable/mariadb/values.yaml +++ b/stable/mariadb/values.yaml @@ -92,3 +92,10 @@ resources: requests: memory: 256Mi cpu: 250m + +## Discretionary Access Controls +## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ +## +securitySettings: + runAsUser: 1001 + fsGroup: 1001