mirror of
https://github.com/helm/charts.git
synced 2026-08-23 22:37:45 +00:00
[stable/mariadb] Add initContainer for adjusting volume permissions (#15752)
* [stable/mariadb] Add initContainer for adjusting volume permissions Signed-off-by: tompizmor <tompizmor@gmail.com> * Fix indentation Signed-off-by: tompizmor <tompizmor@gmail.com>
This commit is contained in:
Tomas Pizarro
committed by
Kubernetes Prow Robot
Kubernetes Prow Robot
parent
7ba8ad8a86
commit
2c406e427f
@@ -1,6 +1,6 @@
|
||||
apiVersion: v1
|
||||
name: mariadb
|
||||
version: 6.5.9
|
||||
version: 6.6.0
|
||||
appVersion: 10.3.16
|
||||
description: Fast, reliable, scalable, and easy to use open-source relational database system. MariaDB Server is intended for mission-critical, heavy-load production systems as well as for embedding into mass-deployed software. Highly available MariaDB cluster.
|
||||
keywords:
|
||||
|
||||
@@ -59,6 +59,12 @@ The following table lists the configurable parameters of the MariaDB chart and t
|
||||
| `image.debug` | Specify if debug logs should be enabled | `false` |
|
||||
| `nameOverride` | String to partially override mariadb.fullname template with a string (will prepend the release name) | `nil` |
|
||||
| `fullnameOverride` | String to fully override mariadb.fullname template with a string | `nil` |
|
||||
| `volumePermissions.enabled` | Enable init container that changes volume permissions in the data directory (for cases where the default k8s `runAsUser` and `fsUser` values do not work) | `false` |
|
||||
| `volumePermissions.image.registry` | Init container volume-permissions image registry | `docker.io` |
|
||||
| `volumePermissions.image.repository` | Init container volume-permissions image name | `bitnami/minideb` |
|
||||
| `volumePermissions.image.tag` | Init container volume-permissions image tag | `latest` |
|
||||
| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `Always` |
|
||||
| `volumePermissions.resources` | Init container resource requests/limit | `nil` |
|
||||
| `service.type` | Kubernetes service type | `ClusterIP` |
|
||||
| `service.clusterIp` | Specific cluster IP when service type is cluster IP. Use None for headless service | `nil` |
|
||||
| `service.port` | MySQL service port | `3306` |
|
||||
@@ -231,6 +237,15 @@ The [Bitnami MariaDB](https://github.com/bitnami/bitnami-docker-mariadb) image s
|
||||
|
||||
The chart mounts a [Persistent Volume](kubernetes.io/docs/user-guide/persistent-volumes/) volume at this location. The volume is created using dynamic volume provisioning, by default. An existing PersistentVolumeClaim can be defined.
|
||||
|
||||
### Adjust permissions of persistent volume mountpoint
|
||||
|
||||
As the image run as non-root by default, it is necessary to adjust the ownership of the persistent volume so that the container can write data into it.
|
||||
|
||||
By default, the chart is configured to use Kubernetes Security Context to automatically change the ownership of the volume. However, this feature does not work in all Kubernetes distributions.
|
||||
As an alternative, this chart supports using an initContainer to change the ownership of the volume before mounting it in the final destination.
|
||||
|
||||
You can enable this initContainer by setting `volumePermissions.enabled` to `true`.
|
||||
|
||||
## Extra Init Containers
|
||||
|
||||
The feature allows for specifying a template string for a initContainer in the master/slave pod. Usecases include situations when you need some pre-run setup. For example, in IKS (IBM Cloud Kubernetes Service), non-root users do not have write permission on the volume mount path for NFS-powered file storage. So, you could use a initcontainer to `chown` the mount. See a example below, where we add an initContainer on the master pod that reports to an external resource that the db is going to starting.
|
||||
|
||||
@@ -124,7 +124,7 @@ imagePullSecrets:
|
||||
{{- range .Values.global.imagePullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- else if or .Values.image.pullSecrets .Values.metrics.image.pullSecrets }}
|
||||
{{- else if or .Values.image.pullSecrets .Values.metrics.image.pullSecrets .Values.volumePermissions.image.pullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range .Values.image.pullSecrets }}
|
||||
- name: {{ . }}
|
||||
@@ -132,8 +132,11 @@ imagePullSecrets:
|
||||
{{- range .Values.metrics.image.pullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- range .Values.volumePermissions.image.pullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- else if or .Values.image.pullSecrets .Values.metrics.image.pullSecrets }}
|
||||
{{- else if or .Values.image.pullSecrets .Values.metrics.image.pullSecrets .Values.volumePermissions.image.pullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range .Values.image.pullSecrets }}
|
||||
- name: {{ . }}
|
||||
@@ -141,5 +144,31 @@ imagePullSecrets:
|
||||
{{- range .Values.metrics.image.pullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- range .Values.volumePermissions.image.pullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper image name (for the init container volume-permissions image)
|
||||
*/}}
|
||||
{{- define "mariadb.volumePermissions.image" -}}
|
||||
{{- $registryName := .Values.volumePermissions.image.registry -}}
|
||||
{{- $repositoryName := .Values.volumePermissions.image.repository -}}
|
||||
{{- $tag := .Values.volumePermissions.image.tag | toString -}}
|
||||
{{/*
|
||||
Helm 2.11 supports the assignment of a value to a variable defined in a different scope,
|
||||
but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic.
|
||||
Also, we can't use a single if because lazy evaluation is not an option
|
||||
*/}}
|
||||
{{- if .Values.global }}
|
||||
{{- if .Values.global.imageRegistry }}
|
||||
{{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
@@ -85,10 +85,22 @@ spec:
|
||||
{{ toYaml . | indent 8 }}
|
||||
{{- end }}
|
||||
{{- include "mariadb.imagePullSecrets" . | indent 6 }}
|
||||
{{- if .Values.master.extraInitContainers }}
|
||||
initContainers:
|
||||
{{- if .Values.master.extraInitContainers }}
|
||||
{{ tpl .Values.master.extraInitContainers . | indent 6}}
|
||||
{{- end }}
|
||||
{{- if and .Values.volumePermissions.enabled .Values.master.persistence.enabled }}
|
||||
- name: volume-permissions
|
||||
image: {{ template "mariadb.volumePermissions.image" . }}
|
||||
imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }}
|
||||
command: ["chown", "-R", "{{ .Values.securityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }}", "{{ .Values.master.persistence.mountPath }}"]
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
resources: {{ toYaml .Values.volumePermissions.resources | nindent 10 }}
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: {{ .Values.master.persistence.mountPath }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: "mariadb"
|
||||
image: {{ template "mariadb.image" . }}
|
||||
|
||||
@@ -86,10 +86,22 @@ spec:
|
||||
{{ toYaml . | indent 8 }}
|
||||
{{- end }}
|
||||
{{- include "mariadb.imagePullSecrets" . | indent 6 }}
|
||||
{{- if .Values.master.extraInitContainers }}
|
||||
initContainers:
|
||||
{{- if .Values.master.extraInitContainers }}
|
||||
{{ tpl .Values.master.extraInitContainers . | indent 6}}
|
||||
{{- end }}
|
||||
{{- if and .Values.volumePermissions.enabled .Values.slave.persistence.enabled }}
|
||||
- name: volume-permissions
|
||||
image: {{ template "mariadb.volumePermissions.image" . }}
|
||||
imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }}
|
||||
command: ["chown", "-R", "{{ .Values.securityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }}", "/bitnami/mariadb"]
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
resources: {{ toYaml .Values.volumePermissions.resources | nindent 10 }}
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /bitnami/mariadb
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: "mariadb"
|
||||
image: {{ template "mariadb.image" . }}
|
||||
|
||||
@@ -44,6 +44,24 @@ image:
|
||||
##
|
||||
# fullnameOverride:
|
||||
|
||||
## Init containers parameters:
|
||||
## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section.
|
||||
##
|
||||
volumePermissions:
|
||||
enabled: false
|
||||
image:
|
||||
registry: docker.io
|
||||
repository: bitnami/minideb
|
||||
tag: latest
|
||||
pullPolicy: Always
|
||||
## Optionally specify an array of imagePullSecrets.
|
||||
## Secrets must be manually created in the namespace.
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
|
||||
##
|
||||
# pullSecrets:
|
||||
# - myRegistryKeySecretName
|
||||
resources: {}
|
||||
|
||||
service:
|
||||
## Kubernetes service type, ClusterIP and NodePort are supported at present
|
||||
type: ClusterIP
|
||||
|
||||
@@ -44,6 +44,24 @@ image:
|
||||
##
|
||||
# fullnameOverride:
|
||||
|
||||
## Init containers parameters:
|
||||
## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section.
|
||||
##
|
||||
volumePermissions:
|
||||
enabled: false
|
||||
image:
|
||||
registry: docker.io
|
||||
repository: bitnami/minideb
|
||||
tag: latest
|
||||
pullPolicy: Always
|
||||
## Optionally specify an array of imagePullSecrets.
|
||||
## Secrets must be manually created in the namespace.
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
|
||||
##
|
||||
# pullSecrets:
|
||||
# - myRegistryKeySecretName
|
||||
resources: {}
|
||||
|
||||
service:
|
||||
## Kubernetes service type, ClusterIP and NodePort are supported at present
|
||||
type: ClusterIP
|
||||
|
||||
Reference in New Issue
Block a user