[stable/elasticsearch] chown initContainer can be disabled (#13287)

* feat: elasticsearch chmod initContainer can be disabled

Signed-off-by: Enrique Gonzalez <goga.enrique@gmail.com>

* docs: add chownInitContainer.enabled value to README.md

Signed-off-by: Enrique Gonzalez <goga.enrique@gmail.com>

* fix: initContainer if statement

Signed-off-by: Enrique Gonzalez <goga.enrique@gmail.com>

* chore: bump elasticsearch chart version

Signed-off-by: Enrique Gonzalez <goga.enrique@gmail.com>

* chore: bump elasticsearch chart minor

Signed-off-by: Enrique Gonzalez <goga.enrique@gmail.com>

* test: ci test values file for ES non-root and unprivileged deployment

Signed-off-by: Enrique Gonzalez <goga.enrique@gmail.com>

stable/elasticsearch/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 name: elasticsearch
 home: https://www.elastic.co/products/elasticsearch
-version: 1.28.5
+version: 1.29.0
 appVersion: 6.7.0
 description: Flexible and powerful open source, distributed real-time search and analytics
   engine.

stable/elasticsearch/README.md

@@ -155,7 +155,8 @@ The following table lists the configurable parameters of the elasticsearch chart
 | `data.nodeAffinity`                  | Data node affinity policy                                           | `{}`                                                |
 | `data.podManagementPolicy`           | Data pod creation strategy                                          | `OrderedReady`                                      |
 | `data.updateStrategy`                | Data node update strategy policy                                    | `{type: "onDelete"}`                                |
-| `sysctlInitContainer.enabled`        | If true, the sysctl init container is enabled (does not stop extraInitContainers from running) | `true`                                              |
+| `sysctlInitContainer.enabled`        | If true, the sysctl init container is enabled (does not stop chownInitContainer or extraInitContainers from running) | `true`                                              |
+| `chownInitContainer.enabled`        | If true, the chown init container is enabled (does not stop sysctlInitContainer or extraInitContainers from running) | `true`                                              |
 | `extraInitContainers`                | Additional init container passed through the tpl                    | ``                                                  |
 | `podSecurityPolicy.annotations`      | Specify pod annotations in the pod security policy                  | `{}`                                              |
 | `podSecurityPolicy.enabled`          | Specify if a pod security policy must be created                    | `false`                                             |

stable/elasticsearch/ci/nonroot-deployment-values.yaml

@@ -0,0 +1,12 @@
+---
+# Deploy Chart as non-root and unprivileged
+
+chownInitContainer:
+  enabled: false
+
+securityContext:
+  enabled: true
+  runAsUser: 1000
+
+sysctlInitContainer:
+  enabled: false

stable/elasticsearch/templates/data-statefulset.yaml

@@ -73,7 +73,9 @@ spec:
       tolerations:
 {{ toYaml .Values.data.tolerations | indent 8 }}
 {{- end }}
+{{- if or .Values.extraInitContainers .Values.sysctlInitContainer.enabled .Values.chownInitContainer.enabled .Values.cluster.plugins }}
       initContainers:
+{{- end }}
 {{- if .Values.sysctlInitContainer.enabled }}
       # see https://www.elastic.co/guide/en/elasticsearch/reference/current/vm-max-map-count.html
       # and https://www.elastic.co/guide/en/elasticsearch/reference/current/setup-configuration-memory.html#mlockall
@@ -86,6 +88,7 @@ spec:
         securityContext:
           privileged: true
 {{- end }}
+{{- if .Values.chownInitContainer.enabled }}
       - name: "chown"
         image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
         imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
@@ -110,6 +113,7 @@ spec:
         volumeMounts:
         - mountPath: /usr/share/elasticsearch/data
           name: data
+{{- end }}
 {{- if .Values.extraInitContainers }}
 {{ tpl .Values.extraInitContainers . | indent 6 }}
 {{- end }}

stable/elasticsearch/templates/master-statefulset.yaml

@@ -73,7 +73,9 @@ spec:
       tolerations:
 {{ toYaml .Values.master.tolerations | indent 8 }}
 {{- end }}
+{{- if or .Values.extraInitContainers .Values.sysctlInitContainer.enabled .Values.chownInitContainer.enabled .Values.cluster.plugins }}
       initContainers:
+{{- end }}
 {{- if .Values.sysctlInitContainer.enabled }}
       # see https://www.elastic.co/guide/en/elasticsearch/reference/current/vm-max-map-count.html
       # and https://www.elastic.co/guide/en/elasticsearch/reference/current/setup-configuration-memory.html#mlockall
@@ -86,6 +88,7 @@ spec:
         securityContext:
           privileged: true
 {{- end }}
+{{- if .Values.chownInitContainer.enabled }}
       - name: "chown"
         image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
         imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
@@ -110,6 +113,7 @@ spec:
         volumeMounts:
         - mountPath: /usr/share/elasticsearch/data
           name: data
+{{- end }}
 {{- if .Values.extraInitContainers }}
 {{ tpl .Values.extraInitContainers . | indent 6 }}
 {{- end }}

stable/elasticsearch/values.yaml

@@ -264,5 +264,8 @@ data:
 # and https://www.elastic.co/guide/en/elasticsearch/reference/current/setup-configuration-memory.html#mlockall
 sysctlInitContainer:
   enabled: true
+## Chown init container to change ownership of data and logs directories to elasticsearch user
+chownInitContainer:
+  enabled: true
 ## Additional init containers
 extraInitContainers: |