From 9d7bc791cd82476c3955f007686abceda08146d0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Enrique=20Gonz=C3=A1lez?= Date: Thu, 20 Jun 2019 16:10:48 +0200 Subject: [PATCH] [stable/elasticsearch] chown initContainer can be disabled (#13287) * feat: elasticsearch chmod initContainer can be disabled Signed-off-by: Enrique Gonzalez * docs: add chownInitContainer.enabled value to README.md Signed-off-by: Enrique Gonzalez * fix: initContainer if statement Signed-off-by: Enrique Gonzalez * chore: bump elasticsearch chart version Signed-off-by: Enrique Gonzalez * chore: bump elasticsearch chart minor Signed-off-by: Enrique Gonzalez * test: ci test values file for ES non-root and unprivileged deployment Signed-off-by: Enrique Gonzalez --- stable/elasticsearch/Chart.yaml | 2 +- stable/elasticsearch/README.md | 3 ++- .../elasticsearch/ci/nonroot-deployment-values.yaml | 12 ++++++++++++ stable/elasticsearch/templates/data-statefulset.yaml | 4 ++++ .../elasticsearch/templates/master-statefulset.yaml | 4 ++++ stable/elasticsearch/values.yaml | 3 +++ 6 files changed, 26 insertions(+), 2 deletions(-) create mode 100644 stable/elasticsearch/ci/nonroot-deployment-values.yaml diff --git a/stable/elasticsearch/Chart.yaml b/stable/elasticsearch/Chart.yaml index 51351865a4..900ea4b0de 100755 --- a/stable/elasticsearch/Chart.yaml +++ b/stable/elasticsearch/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: elasticsearch home: https://www.elastic.co/products/elasticsearch -version: 1.28.5 +version: 1.29.0 appVersion: 6.7.0 description: Flexible and powerful open source, distributed real-time search and analytics engine. diff --git a/stable/elasticsearch/README.md b/stable/elasticsearch/README.md index 858e5c510a..7aaca72ecb 100644 --- a/stable/elasticsearch/README.md +++ b/stable/elasticsearch/README.md @@ -155,7 +155,8 @@ The following table lists the configurable parameters of the elasticsearch chart | `data.nodeAffinity` | Data node affinity policy | `{}` | | `data.podManagementPolicy` | Data pod creation strategy | `OrderedReady` | | `data.updateStrategy` | Data node update strategy policy | `{type: "onDelete"}` | -| `sysctlInitContainer.enabled` | If true, the sysctl init container is enabled (does not stop extraInitContainers from running) | `true` | +| `sysctlInitContainer.enabled` | If true, the sysctl init container is enabled (does not stop chownInitContainer or extraInitContainers from running) | `true` | +| `chownInitContainer.enabled` | If true, the chown init container is enabled (does not stop sysctlInitContainer or extraInitContainers from running) | `true` | | `extraInitContainers` | Additional init container passed through the tpl | `` | | `podSecurityPolicy.annotations` | Specify pod annotations in the pod security policy | `{}` | | `podSecurityPolicy.enabled` | Specify if a pod security policy must be created | `false` | diff --git a/stable/elasticsearch/ci/nonroot-deployment-values.yaml b/stable/elasticsearch/ci/nonroot-deployment-values.yaml new file mode 100644 index 0000000000..e3e3239ddb --- /dev/null +++ b/stable/elasticsearch/ci/nonroot-deployment-values.yaml @@ -0,0 +1,12 @@ +--- +# Deploy Chart as non-root and unprivileged + +chownInitContainer: + enabled: false + +securityContext: + enabled: true + runAsUser: 1000 + +sysctlInitContainer: + enabled: false diff --git a/stable/elasticsearch/templates/data-statefulset.yaml b/stable/elasticsearch/templates/data-statefulset.yaml index fd99c44a12..99972cc201 100644 --- a/stable/elasticsearch/templates/data-statefulset.yaml +++ b/stable/elasticsearch/templates/data-statefulset.yaml @@ -73,7 +73,9 @@ spec: tolerations: {{ toYaml .Values.data.tolerations | indent 8 }} {{- end }} +{{- if or .Values.extraInitContainers .Values.sysctlInitContainer.enabled .Values.chownInitContainer.enabled .Values.cluster.plugins }} initContainers: +{{- end }} {{- if .Values.sysctlInitContainer.enabled }} # see https://www.elastic.co/guide/en/elasticsearch/reference/current/vm-max-map-count.html # and https://www.elastic.co/guide/en/elasticsearch/reference/current/setup-configuration-memory.html#mlockall @@ -86,6 +88,7 @@ spec: securityContext: privileged: true {{- end }} +{{- if .Values.chownInitContainer.enabled }} - name: "chown" image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" imagePullPolicy: {{ .Values.image.pullPolicy | quote }} @@ -110,6 +113,7 @@ spec: volumeMounts: - mountPath: /usr/share/elasticsearch/data name: data +{{- end }} {{- if .Values.extraInitContainers }} {{ tpl .Values.extraInitContainers . | indent 6 }} {{- end }} diff --git a/stable/elasticsearch/templates/master-statefulset.yaml b/stable/elasticsearch/templates/master-statefulset.yaml index 5cc7d3e3a9..9c85e62e3f 100644 --- a/stable/elasticsearch/templates/master-statefulset.yaml +++ b/stable/elasticsearch/templates/master-statefulset.yaml @@ -73,7 +73,9 @@ spec: tolerations: {{ toYaml .Values.master.tolerations | indent 8 }} {{- end }} +{{- if or .Values.extraInitContainers .Values.sysctlInitContainer.enabled .Values.chownInitContainer.enabled .Values.cluster.plugins }} initContainers: +{{- end }} {{- if .Values.sysctlInitContainer.enabled }} # see https://www.elastic.co/guide/en/elasticsearch/reference/current/vm-max-map-count.html # and https://www.elastic.co/guide/en/elasticsearch/reference/current/setup-configuration-memory.html#mlockall @@ -86,6 +88,7 @@ spec: securityContext: privileged: true {{- end }} +{{- if .Values.chownInitContainer.enabled }} - name: "chown" image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" imagePullPolicy: {{ .Values.image.pullPolicy | quote }} @@ -110,6 +113,7 @@ spec: volumeMounts: - mountPath: /usr/share/elasticsearch/data name: data +{{- end }} {{- if .Values.extraInitContainers }} {{ tpl .Values.extraInitContainers . | indent 6 }} {{- end }} diff --git a/stable/elasticsearch/values.yaml b/stable/elasticsearch/values.yaml index 053ad8d79c..f042200df7 100644 --- a/stable/elasticsearch/values.yaml +++ b/stable/elasticsearch/values.yaml @@ -264,5 +264,8 @@ data: # and https://www.elastic.co/guide/en/elasticsearch/reference/current/setup-configuration-memory.html#mlockall sysctlInitContainer: enabled: true +## Chown init container to change ownership of data and logs directories to elasticsearch user +chownInitContainer: + enabled: true ## Additional init containers extraInitContainers: |