From 84fcbc5e6b79111baba54ff9593378cb34cae6b7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Javier=20J=2E=20Salmer=C3=B3n-Garc=C3=ADa?= Date: Wed, 25 Jul 2018 12:16:56 +0200 Subject: [PATCH] Fix MongoDB chart non-root volumes (#6809) * Fix MongoDB chart non-root volumes * Update README --- stable/mongodb/Chart.yaml | 2 +- stable/mongodb/README.md | 4 +++- stable/mongodb/templates/deployment-standalone.yaml | 5 +++++ stable/mongodb/templates/statefulset-arbiter-rs.yaml | 7 ++++++- stable/mongodb/templates/statefulset-primary-rs.yaml | 5 +++++ stable/mongodb/values-production.yaml | 10 +++++++++- stable/mongodb/values.yaml | 8 ++++++++ 7 files changed, 37 insertions(+), 4 deletions(-) diff --git a/stable/mongodb/Chart.yaml b/stable/mongodb/Chart.yaml index 2bbc07480d..559dc5c8a6 100644 --- a/stable/mongodb/Chart.yaml +++ b/stable/mongodb/Chart.yaml @@ -1,5 +1,5 @@ name: mongodb -version: 3.0.4 +version: 4.0.0 appVersion: 3.6.6 description: NoSQL document-oriented database that stores JSON-like documents with dynamic schemas, simplifying the integration of data in content-driven applications. keywords: diff --git a/stable/mongodb/README.md b/stable/mongodb/README.md index 25bd9de4ce..0d2803b843 100644 --- a/stable/mongodb/README.md +++ b/stable/mongodb/README.md @@ -73,7 +73,9 @@ The following table lists the configurable parameters of the MongoDB chart and t | `nodeSelector` | Node labels for pod assignment | {} | | `affinity` | Affinity for pod assignment | {} | | `tolerations` | Toleration labels for pod assignment | {} | -| `persistence.enabled` | Use a PVC to persist data | `true` | +| `securityContext.enabled` | Enable security context | `true` | +| `securityContext.fsGroup` | Group ID for the container | `1001` | +| `securityContext.runAsUser` | User ID for the container | `1001` | `persistence.enabled` | Use a PVC to persist data | `true` | | `persistence.storageClass` | Storage class of backing PVC | `nil` (uses alpha storage class annotation) | | `persistence.accessMode` | Use volume as ReadOnly or ReadWrite | `ReadWriteOnce` | | `persistence.size` | Size of data volume | `8Gi` | diff --git a/stable/mongodb/templates/deployment-standalone.yaml b/stable/mongodb/templates/deployment-standalone.yaml index 15191f3f75..db2ee2737b 100644 --- a/stable/mongodb/templates/deployment-standalone.yaml +++ b/stable/mongodb/templates/deployment-standalone.yaml @@ -15,6 +15,11 @@ spec: app: {{ template "mongodb.name" . }} release: "{{ .Release.Name }}" spec: + {{- if .Values.securityContext.enabled }} + securityContext: + fsGroup: {{ .Values.securityContext.fsGroup }} + runAsUser: {{ .Values.securityContext.runAsUser }} + {{- end }} {{- if .Values.nodeSelector }} nodeSelector: {{ toYaml .Values.nodeSelector | indent 8 }} diff --git a/stable/mongodb/templates/statefulset-arbiter-rs.yaml b/stable/mongodb/templates/statefulset-arbiter-rs.yaml index b02521fae2..f556baedb1 100644 --- a/stable/mongodb/templates/statefulset-arbiter-rs.yaml +++ b/stable/mongodb/templates/statefulset-arbiter-rs.yaml @@ -23,6 +23,11 @@ spec: release: {{ .Release.Name }} component: arbiter spec: + {{- if .Values.securityContext.enabled }} + securityContext: + fsGroup: {{ .Values.securityContext.fsGroup }} + runAsUser: {{ .Values.securityContext.runAsUser }} + {{- end }} {{- if .Values.image.pullSecrets }} imagePullSecrets: {{- range .Values.image.pullSecrets }} @@ -95,4 +100,4 @@ spec: configMap: name: {{ template "mongodb.fullname" . }} {{- end }} -{{- end }} \ No newline at end of file +{{- end }} diff --git a/stable/mongodb/templates/statefulset-primary-rs.yaml b/stable/mongodb/templates/statefulset-primary-rs.yaml index 04a79ce449..9737b37656 100644 --- a/stable/mongodb/templates/statefulset-primary-rs.yaml +++ b/stable/mongodb/templates/statefulset-primary-rs.yaml @@ -23,6 +23,11 @@ spec: release: {{ .Release.Name }} component: primary spec: + {{- if .Values.securityContext.enabled }} + securityContext: + fsGroup: {{ .Values.securityContext.fsGroup }} + runAsUser: {{ .Values.securityContext.runAsUser }} + {{- end }} {{- if .Values.image.pullSecrets }} imagePullSecrets: {{- range .Values.image.pullSecrets }} diff --git a/stable/mongodb/values-production.yaml b/stable/mongodb/values-production.yaml index 5cf34c4e6f..41bd600d9a 100644 --- a/stable/mongodb/values-production.yaml +++ b/stable/mongodb/values-production.yaml @@ -47,6 +47,14 @@ usePassword: true ## - "--wiredTigerCacheSizeGB=2" mongodbExtraFlags: [] +## Pod Security Context +## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ +## +securityContext: + enabled: true + fsGroup: 1001 + runAsUser: 1001 + ## Kubernetes service type service: type: ClusterIP @@ -182,4 +190,4 @@ configmap: # # security options # security: # authorization: enabled -# keyFile: /opt/bitnami/mongodb/conf/keyfile \ No newline at end of file +# keyFile: /opt/bitnami/mongodb/conf/keyfile diff --git a/stable/mongodb/values.yaml b/stable/mongodb/values.yaml index f82a100e96..5b24729de5 100644 --- a/stable/mongodb/values.yaml +++ b/stable/mongodb/values.yaml @@ -47,6 +47,14 @@ usePassword: true ## - "--wiredTigerCacheSizeGB=2" mongodbExtraFlags: [] +## Pod Security Context +## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ +## +securityContext: + enabled: true + fsGroup: 1001 + runAsUser: 1001 + ## Kubernetes service type service: type: ClusterIP