mirror of
https://github.com/helm/charts.git
synced 2026-08-23 22:37:45 +00:00
Add securityContext for minio deployments (#19806)
Signed-off-by: Harshavardhana <harsha@minio.io>
This commit is contained in:
Harshavardhana
committed by
Kubernetes Prow Robot
Kubernetes Prow Robot
parent
2a43e9ff73
commit
9fbd1328fa
@@ -1,7 +1,7 @@
|
||||
apiVersion: v1
|
||||
description: MinIO is a high performance data infrastructure for machine learning, analytics and application data workloads.
|
||||
name: minio
|
||||
version: 4.0.3
|
||||
version: 5.0.0
|
||||
appVersion: master
|
||||
keywords:
|
||||
- storage
|
||||
|
||||
+7
-4
@@ -1,10 +1,13 @@
|
||||
approvers:
|
||||
- wlan0
|
||||
- nitisht
|
||||
- krisis
|
||||
- harshavardhana
|
||||
- nitisht
|
||||
- wlan0
|
||||
- dvaldivia
|
||||
reviewers:
|
||||
- wlan0
|
||||
- nitisht
|
||||
- krisis
|
||||
- harshavardhana
|
||||
- nitisht
|
||||
- wlan0
|
||||
- dvaldivia
|
||||
|
||||
|
||||
@@ -95,7 +95,7 @@ The following table lists the configurable parameters of the MinIO chart and the
|
||||
| `nameOverride` | Provide a name in place of `minio` | `""` |
|
||||
| `fullnameOverride` | Provide a name to substitute for the full names of resources | `""` |
|
||||
| `image.repository` | Image repository | `minio/minio` |
|
||||
| `image.tag` | MinIO image tag. Possible values listed [here](https://hub.docker.com/r/minio/minio/tags/). | `RELEASE.2019-12-24T23-04-45Z` |
|
||||
| `image.tag` | MinIO image tag. Possible values listed [here](https://hub.docker.com/r/minio/minio/tags/). | `RELEASE.2019-12-30T05-45-39Z` |
|
||||
| `image.pullPolicy` | Image pull policy | `IfNotPresent` |
|
||||
| `mcImage.repository` | Client image repository | `minio/mc` |
|
||||
| `mcImage.tag` | mc image tag. Possible values listed [here](https://hub.docker.com/r/minio/mc/tags/). | `RELEASE.2019-12-24T23-41-36Z` |
|
||||
@@ -108,12 +108,12 @@ The following table lists the configurable parameters of the MinIO chart and the
|
||||
| `extraArgs` | Additional command line arguments to pass to the MinIO server | `[]` |
|
||||
| `replicas` | Number of nodes (applicable only for MinIO distributed mode). | `4` |
|
||||
| `zones` | Number of zones (applicable only for MinIO distributed mode). | `1` |
|
||||
| `drivesPerNode` | Number of drives per node (applicable only for MinIO distributed mode). | `1` |
|
||||
| `drivesPerNode` | Number of drives per node (applicable only for MinIO distributed mode). | `1` |
|
||||
| `existingSecret` | Name of existing secret with access and secret key. | `""` |
|
||||
| `accessKey` | Default access key (5 to 20 characters) | `AKIAIOSFODNN7EXAMPLE` |
|
||||
| `secretKey` | Default secret key (8 to 40 characters) | `wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY` |
|
||||
| `configPath` | Default config file location | `~/.minio` |
|
||||
| `configPathmc` | Default config file location for MinIO client - mc | `~/.mc` |
|
||||
| `certsPath` | Default certs path location | `/etc/minio/certs` |
|
||||
| `configPathmc` | Default config file location for MinIO client - mc | `/etc/minio/mc` |
|
||||
| `mountPath` | Default mount location for persistent drive | `/export` |
|
||||
| `clusterDomain` | domain name of kubernetes cluster where pod is running. | `cluster.local` |
|
||||
| `service.type` | Kubernetes service type | `ClusterIP` |
|
||||
@@ -130,6 +130,10 @@ The following table lists the configurable parameters of the MinIO chart and the
|
||||
| `persistence.subPath` | Mount a sub directory of the persistent volume if set | `""` |
|
||||
| `resources` | CPU/Memory resource requests/limits | Memory: `256Mi`, CPU: `100m` |
|
||||
| `priorityClassName` | Pod priority settings | `""` |
|
||||
| `securityContext.enabled` | Enable to run containers as non-root. NOTE: if `persistence.enabled=false` then securityContext will be automatically disabled | `true` |
|
||||
| `securityContext.runAsUser` | User id of the user for the container | `1000` |
|
||||
| `securityContext.runAsGroup` | Group id of the user for the container | `1000` |
|
||||
| `securityContext.fsGroup` | Group id of the persistent volume mount for the container | `1000` |
|
||||
| `nodeSelector` | Node labels for pod assignment | `{}` |
|
||||
| `affinity` | Affinity settings for pod assignment | `{}` |
|
||||
| `tolerations` | Toleration labels for pod assignment | `[]` |
|
||||
|
||||
@@ -58,6 +58,12 @@ spec:
|
||||
priorityClassName: "{{ .Values.priorityClassName }}"
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "minio.serviceAccountName" . | quote }}
|
||||
{{- if and .Values.securityContext.enabled .Values.persistence.enabled }}
|
||||
securityContext:
|
||||
runAsUser: {{ .Values.securityContext.runAsUser }}
|
||||
runAsGroup: {{ .Values.securityContext.runAsGroup }}
|
||||
fsGroup: {{ .Values.securityContext.fsGroup }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
|
||||
@@ -65,36 +71,36 @@ spec:
|
||||
{{- if .Values.s3gateway.enabled }}
|
||||
command: [ "/bin/sh",
|
||||
"-ce",
|
||||
"/usr/bin/docker-entrypoint.sh minio -C {{ .Values.configPath }} gateway s3 {{ .Values.s3gateway.serviceEndpoint }}" ]
|
||||
"/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} gateway s3 {{ .Values.s3gateway.serviceEndpoint }}" ]
|
||||
{{- else }}
|
||||
{{- if .Values.azuregateway.enabled }}
|
||||
command: [ "/bin/sh",
|
||||
"-ce",
|
||||
"/usr/bin/docker-entrypoint.sh minio -C {{ .Values.configPath }} gateway azure" ]
|
||||
command: [ "/bin/sh",
|
||||
"-ce",
|
||||
"/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} gateway azure" ]
|
||||
{{- else }}
|
||||
{{- if .Values.gcsgateway.enabled }}
|
||||
command: [ "/bin/sh",
|
||||
"-ce",
|
||||
"/usr/bin/docker-entrypoint.sh minio -C {{ .Values.configPath }} gateway gcs {{ .Values.gcsgateway.projectId }}" ]
|
||||
command: [ "/bin/sh",
|
||||
"-ce",
|
||||
"/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} gateway gcs {{ .Values.gcsgateway.projectId }}" ]
|
||||
{{- else }}
|
||||
{{- if .Values.ossgateway.enabled }}
|
||||
command: [ "/bin/sh",
|
||||
"-ce",
|
||||
"/usr/bin/docker-entrypoint.sh minio -C {{ .Values.configPath }} gateway oss {{ .Values.ossgateway.endpointURL }}" ]
|
||||
command: [ "/bin/sh",
|
||||
"-ce",
|
||||
"/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} gateway oss {{ .Values.ossgateway.endpointURL }}" ]
|
||||
{{- else }}
|
||||
{{- if .Values.nasgateway.enabled }}
|
||||
command: [ "/bin/sh",
|
||||
"-ce",
|
||||
"/usr/bin/docker-entrypoint.sh minio -C {{ .Values.configPath }} gateway nas {{ .Values.mountPath }}" ]
|
||||
command: [ "/bin/sh",
|
||||
"-ce",
|
||||
"/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} gateway nas {{ .Values.mountPath }}" ]
|
||||
{{- else }}
|
||||
{{- if .Values.b2gateway.enabled }}
|
||||
command: [ "/bin/sh",
|
||||
"-ce",
|
||||
"/usr/bin/docker-entrypoint.sh minio -C {{ .Values.configPath }} gateway b2" ]
|
||||
"/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} gateway b2" ]
|
||||
{{- else }}
|
||||
command: [ "/bin/sh",
|
||||
"-ce",
|
||||
"/usr/bin/docker-entrypoint.sh minio -C {{ .Values.configPath }} server {{ .Values.mountPath }}" ]
|
||||
command: [ "/bin/sh",
|
||||
"-ce",
|
||||
"/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} server {{ .Values.mountPath }}" ]
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -118,11 +124,9 @@ spec:
|
||||
mountPath: "/etc/credentials"
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
- name: minio-config-dir
|
||||
mountPath: {{ .Values.configPath }}
|
||||
{{- if .Values.tls.enabled }}
|
||||
- name: cert-secret-volume
|
||||
mountPath: {{ .Values.configPath }}certs
|
||||
mountPath: {{ .Values.certsPath }}
|
||||
{{ end }}
|
||||
ports:
|
||||
- name: service
|
||||
@@ -199,8 +203,6 @@ spec:
|
||||
- name: minio-user
|
||||
secret:
|
||||
secretName: {{ if .Values.existingSecret }}{{ .Values.existingSecret }}{{ else }}{{ template "minio.fullname" . }}{{ end }}
|
||||
- name: minio-config-dir
|
||||
emptyDir: {}
|
||||
{{- if .Values.tls.enabled }}
|
||||
- name: cert-secret-volume
|
||||
secret:
|
||||
|
||||
@@ -70,11 +70,17 @@ spec:
|
||||
priorityClassName: "{{ .Values.priorityClassName }}"
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "minio.serviceAccountName" . | quote }}
|
||||
{{- if and .Values.securityContext.enabled .Values.persistence.enabled }}
|
||||
securityContext:
|
||||
runAsUser: {{ .Values.securityContext.runAsUser }}
|
||||
runAsGroup: {{ .Values.securityContext.runAsGroup }}
|
||||
fsGroup: {{ .Values.securityContext.fsGroup }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}
|
||||
image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
command: [ "/bin/sh", "-ce", "/usr/bin/docker-entrypoint.sh minio -C {{ .Values.configPath }} server {{- range $i := until $zoneCount }}{{ $factor := mul $i $nodeCount }}{{ $endIndex := add $factor $nodeCount }}{{ $beginIndex := mul $i $nodeCount }} {{ $scheme }}://{{ template `minio.fullname` $ }}-{{ `{` }}{{ $beginIndex }}...{{ sub $endIndex 1 }}{{ `}`}}.{{ template `minio.fullname` $ }}-svc.{{ $.Release.Namespace }}.svc.{{ $.Values.clusterDomain }}{{if (gt $drivesPerNode 1)}}{{ $.Values.mountPath }}-{{ `{` }}0...{{ sub $drivesPerNode 1 }}{{ `}` }}{{else}}{{ $.Values.mountPath }}{{end}}{{- end}}" ]
|
||||
command: [ "/bin/sh", "-ce", "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} server {{- range $i := until $zoneCount }}{{ $factor := mul $i $nodeCount }}{{ $endIndex := add $factor $nodeCount }}{{ $beginIndex := mul $i $nodeCount }} {{ $scheme }}://{{ template `minio.fullname` $ }}-{{ `{` }}{{ $beginIndex }}...{{ sub $endIndex 1 }}{{ `}`}}.{{ template `minio.fullname` $ }}-svc.{{ $.Release.Namespace }}.svc.{{ $.Values.clusterDomain }}{{if (gt $drivesPerNode 1)}}{{ $.Values.mountPath }}-{{ `{` }}0...{{ sub $drivesPerNode 1 }}{{ `}` }}{{else}}{{ $.Values.mountPath }}{{end}}{{- end}}" ]
|
||||
{{- if .Values.extraArgs }}
|
||||
args:
|
||||
{{ toYaml .Values.extraArgs | indent 12 }}
|
||||
@@ -97,11 +103,9 @@ spec:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- name: minio-config-dir
|
||||
mountPath: {{ .Values.configPath }}
|
||||
{{- if .Values.tls.enabled }}
|
||||
- name: cert-secret-volume
|
||||
mountPath: {{ .Values.configPath }}certs
|
||||
mountPath: {{ .Values.certsPath }}
|
||||
{{ end }}
|
||||
ports:
|
||||
- name: service
|
||||
@@ -153,8 +157,6 @@ spec:
|
||||
- name: minio-user
|
||||
secret:
|
||||
secretName: {{ if .Values.existingSecret }}{{ .Values.existingSecret }}{{ else }}{{ template "minio.fullname" . }}{{ end }}
|
||||
- name: minio-config-dir
|
||||
emptyDir: {}
|
||||
{{- if .Values.tls.enabled }}
|
||||
- name: cert-secret-volume
|
||||
secret:
|
||||
|
||||
@@ -14,7 +14,7 @@ clusterDomain: cluster.local
|
||||
##
|
||||
image:
|
||||
repository: minio/minio
|
||||
tag: RELEASE.2019-12-24T23-04-45Z
|
||||
tag: RELEASE.2019-12-30T05-45-39Z
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
## Set default image, imageTag, and imagePullPolicy for the `mc` (the minio
|
||||
@@ -56,12 +56,15 @@ priorityClassName: ""
|
||||
existingSecret: ""
|
||||
accessKey: "AKIAIOSFODNN7EXAMPLE"
|
||||
secretKey: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
|
||||
configPath: "/root/.minio/"
|
||||
configPathmc: "/root/.mc/"
|
||||
certsPath: "/etc/minio/certs/"
|
||||
configPathmc: "/etc/minio/mc/"
|
||||
mountPath: "/export"
|
||||
|
||||
# Number of drives attached to a node
|
||||
drivesPerNode: 1
|
||||
# Number of MinIO containers running
|
||||
replicas: 4
|
||||
# Number of expanded MinIO clusters
|
||||
zones: 1
|
||||
|
||||
## TLS Settings for Minio
|
||||
@@ -152,6 +155,14 @@ nodeSelector: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
|
||||
## Add stateful containers to have security context, if enabled MinIO will run as this
|
||||
## user and group NOTE: securityContext is only enabled if persistence.enabled=true
|
||||
securityContext:
|
||||
enabled: false
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
fsGroup: 1000
|
||||
|
||||
# Additational pod annotations
|
||||
podAnnotations: {}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user