From 9fbd1328fa981f48e561569524a0dcfc6426b401 Mon Sep 17 00:00:00 2001 From: Harshavardhana Date: Mon, 30 Dec 2019 20:19:40 -0800 Subject: [PATCH] Add securityContext for minio deployments (#19806) Signed-off-by: Harshavardhana --- stable/minio/Chart.yaml | 2 +- stable/minio/OWNERS | 11 +++--- stable/minio/README.md | 12 ++++--- stable/minio/templates/deployment.yaml | 46 +++++++++++++------------ stable/minio/templates/statefulset.yaml | 14 ++++---- stable/minio/values.yaml | 17 +++++++-- 6 files changed, 62 insertions(+), 40 deletions(-) diff --git a/stable/minio/Chart.yaml b/stable/minio/Chart.yaml index 82c2124f42..61be8f5915 100755 --- a/stable/minio/Chart.yaml +++ b/stable/minio/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 description: MinIO is a high performance data infrastructure for machine learning, analytics and application data workloads. name: minio -version: 4.0.3 +version: 5.0.0 appVersion: master keywords: - storage diff --git a/stable/minio/OWNERS b/stable/minio/OWNERS index b9b395bc4c..f8d8d1f401 100644 --- a/stable/minio/OWNERS +++ b/stable/minio/OWNERS @@ -1,10 +1,13 @@ approvers: -- wlan0 -- nitisht - krisis - harshavardhana +- nitisht +- wlan0 +- dvaldivia reviewers: -- wlan0 -- nitisht - krisis - harshavardhana +- nitisht +- wlan0 +- dvaldivia + diff --git a/stable/minio/README.md b/stable/minio/README.md index 1ed7c420b4..84a437347d 100755 --- a/stable/minio/README.md +++ b/stable/minio/README.md @@ -95,7 +95,7 @@ The following table lists the configurable parameters of the MinIO chart and the | `nameOverride` | Provide a name in place of `minio` | `""` | | `fullnameOverride` | Provide a name to substitute for the full names of resources | `""` | | `image.repository` | Image repository | `minio/minio` | -| `image.tag` | MinIO image tag. Possible values listed [here](https://hub.docker.com/r/minio/minio/tags/). | `RELEASE.2019-12-24T23-04-45Z` | +| `image.tag` | MinIO image tag. Possible values listed [here](https://hub.docker.com/r/minio/minio/tags/). | `RELEASE.2019-12-30T05-45-39Z` | | `image.pullPolicy` | Image pull policy | `IfNotPresent` | | `mcImage.repository` | Client image repository | `minio/mc` | | `mcImage.tag` | mc image tag. Possible values listed [here](https://hub.docker.com/r/minio/mc/tags/). | `RELEASE.2019-12-24T23-41-36Z` | @@ -108,12 +108,12 @@ The following table lists the configurable parameters of the MinIO chart and the | `extraArgs` | Additional command line arguments to pass to the MinIO server | `[]` | | `replicas` | Number of nodes (applicable only for MinIO distributed mode). | `4` | | `zones` | Number of zones (applicable only for MinIO distributed mode). | `1` | -| `drivesPerNode` | Number of drives per node (applicable only for MinIO distributed mode). | `1` | +| `drivesPerNode` | Number of drives per node (applicable only for MinIO distributed mode). | `1` | | `existingSecret` | Name of existing secret with access and secret key. | `""` | | `accessKey` | Default access key (5 to 20 characters) | `AKIAIOSFODNN7EXAMPLE` | | `secretKey` | Default secret key (8 to 40 characters) | `wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY` | -| `configPath` | Default config file location | `~/.minio` | -| `configPathmc` | Default config file location for MinIO client - mc | `~/.mc` | +| `certsPath` | Default certs path location | `/etc/minio/certs` | +| `configPathmc` | Default config file location for MinIO client - mc | `/etc/minio/mc` | | `mountPath` | Default mount location for persistent drive | `/export` | | `clusterDomain` | domain name of kubernetes cluster where pod is running. | `cluster.local` | | `service.type` | Kubernetes service type | `ClusterIP` | @@ -130,6 +130,10 @@ The following table lists the configurable parameters of the MinIO chart and the | `persistence.subPath` | Mount a sub directory of the persistent volume if set | `""` | | `resources` | CPU/Memory resource requests/limits | Memory: `256Mi`, CPU: `100m` | | `priorityClassName` | Pod priority settings | `""` | +| `securityContext.enabled` | Enable to run containers as non-root. NOTE: if `persistence.enabled=false` then securityContext will be automatically disabled | `true` | +| `securityContext.runAsUser` | User id of the user for the container | `1000` | +| `securityContext.runAsGroup` | Group id of the user for the container | `1000` | +| `securityContext.fsGroup` | Group id of the persistent volume mount for the container | `1000` | | `nodeSelector` | Node labels for pod assignment | `{}` | | `affinity` | Affinity settings for pod assignment | `{}` | | `tolerations` | Toleration labels for pod assignment | `[]` | diff --git a/stable/minio/templates/deployment.yaml b/stable/minio/templates/deployment.yaml index d7a1979733..29b7811414 100644 --- a/stable/minio/templates/deployment.yaml +++ b/stable/minio/templates/deployment.yaml @@ -58,6 +58,12 @@ spec: priorityClassName: "{{ .Values.priorityClassName }}" {{- end }} serviceAccountName: {{ include "minio.serviceAccountName" . | quote }} +{{- if and .Values.securityContext.enabled .Values.persistence.enabled }} + securityContext: + runAsUser: {{ .Values.securityContext.runAsUser }} + runAsGroup: {{ .Values.securityContext.runAsGroup }} + fsGroup: {{ .Values.securityContext.fsGroup }} +{{- end }} containers: - name: {{ .Chart.Name }} image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" @@ -65,36 +71,36 @@ spec: {{- if .Values.s3gateway.enabled }} command: [ "/bin/sh", "-ce", - "/usr/bin/docker-entrypoint.sh minio -C {{ .Values.configPath }} gateway s3 {{ .Values.s3gateway.serviceEndpoint }}" ] + "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} gateway s3 {{ .Values.s3gateway.serviceEndpoint }}" ] {{- else }} {{- if .Values.azuregateway.enabled }} - command: [ "/bin/sh", - "-ce", - "/usr/bin/docker-entrypoint.sh minio -C {{ .Values.configPath }} gateway azure" ] + command: [ "/bin/sh", + "-ce", + "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} gateway azure" ] {{- else }} {{- if .Values.gcsgateway.enabled }} - command: [ "/bin/sh", - "-ce", - "/usr/bin/docker-entrypoint.sh minio -C {{ .Values.configPath }} gateway gcs {{ .Values.gcsgateway.projectId }}" ] + command: [ "/bin/sh", + "-ce", + "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} gateway gcs {{ .Values.gcsgateway.projectId }}" ] {{- else }} {{- if .Values.ossgateway.enabled }} - command: [ "/bin/sh", - "-ce", - "/usr/bin/docker-entrypoint.sh minio -C {{ .Values.configPath }} gateway oss {{ .Values.ossgateway.endpointURL }}" ] + command: [ "/bin/sh", + "-ce", + "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} gateway oss {{ .Values.ossgateway.endpointURL }}" ] {{- else }} {{- if .Values.nasgateway.enabled }} - command: [ "/bin/sh", - "-ce", - "/usr/bin/docker-entrypoint.sh minio -C {{ .Values.configPath }} gateway nas {{ .Values.mountPath }}" ] + command: [ "/bin/sh", + "-ce", + "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} gateway nas {{ .Values.mountPath }}" ] {{- else }} {{- if .Values.b2gateway.enabled }} command: [ "/bin/sh", "-ce", - "/usr/bin/docker-entrypoint.sh minio -C {{ .Values.configPath }} gateway b2" ] + "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} gateway b2" ] {{- else }} - command: [ "/bin/sh", - "-ce", - "/usr/bin/docker-entrypoint.sh minio -C {{ .Values.configPath }} server {{ .Values.mountPath }}" ] + command: [ "/bin/sh", + "-ce", + "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} server {{ .Values.mountPath }}" ] {{- end }} {{- end }} {{- end }} @@ -118,11 +124,9 @@ spec: mountPath: "/etc/credentials" readOnly: true {{- end }} - - name: minio-config-dir - mountPath: {{ .Values.configPath }} {{- if .Values.tls.enabled }} - name: cert-secret-volume - mountPath: {{ .Values.configPath }}certs + mountPath: {{ .Values.certsPath }} {{ end }} ports: - name: service @@ -199,8 +203,6 @@ spec: - name: minio-user secret: secretName: {{ if .Values.existingSecret }}{{ .Values.existingSecret }}{{ else }}{{ template "minio.fullname" . }}{{ end }} - - name: minio-config-dir - emptyDir: {} {{- if .Values.tls.enabled }} - name: cert-secret-volume secret: diff --git a/stable/minio/templates/statefulset.yaml b/stable/minio/templates/statefulset.yaml index 5d452a4518..825b0306ff 100644 --- a/stable/minio/templates/statefulset.yaml +++ b/stable/minio/templates/statefulset.yaml @@ -70,11 +70,17 @@ spec: priorityClassName: "{{ .Values.priorityClassName }}" {{- end }} serviceAccountName: {{ include "minio.serviceAccountName" . | quote }} +{{- if and .Values.securityContext.enabled .Values.persistence.enabled }} + securityContext: + runAsUser: {{ .Values.securityContext.runAsUser }} + runAsGroup: {{ .Values.securityContext.runAsGroup }} + fsGroup: {{ .Values.securityContext.fsGroup }} +{{- end }} containers: - name: {{ .Chart.Name }} image: {{ .Values.image.repository }}:{{ .Values.image.tag }} imagePullPolicy: {{ .Values.image.pullPolicy }} - command: [ "/bin/sh", "-ce", "/usr/bin/docker-entrypoint.sh minio -C {{ .Values.configPath }} server {{- range $i := until $zoneCount }}{{ $factor := mul $i $nodeCount }}{{ $endIndex := add $factor $nodeCount }}{{ $beginIndex := mul $i $nodeCount }} {{ $scheme }}://{{ template `minio.fullname` $ }}-{{ `{` }}{{ $beginIndex }}...{{ sub $endIndex 1 }}{{ `}`}}.{{ template `minio.fullname` $ }}-svc.{{ $.Release.Namespace }}.svc.{{ $.Values.clusterDomain }}{{if (gt $drivesPerNode 1)}}{{ $.Values.mountPath }}-{{ `{` }}0...{{ sub $drivesPerNode 1 }}{{ `}` }}{{else}}{{ $.Values.mountPath }}{{end}}{{- end}}" ] + command: [ "/bin/sh", "-ce", "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} server {{- range $i := until $zoneCount }}{{ $factor := mul $i $nodeCount }}{{ $endIndex := add $factor $nodeCount }}{{ $beginIndex := mul $i $nodeCount }} {{ $scheme }}://{{ template `minio.fullname` $ }}-{{ `{` }}{{ $beginIndex }}...{{ sub $endIndex 1 }}{{ `}`}}.{{ template `minio.fullname` $ }}-svc.{{ $.Release.Namespace }}.svc.{{ $.Values.clusterDomain }}{{if (gt $drivesPerNode 1)}}{{ $.Values.mountPath }}-{{ `{` }}0...{{ sub $drivesPerNode 1 }}{{ `}` }}{{else}}{{ $.Values.mountPath }}{{end}}{{- end}}" ] {{- if .Values.extraArgs }} args: {{ toYaml .Values.extraArgs | indent 12 }} @@ -97,11 +103,9 @@ spec: {{- end }} {{- end }} {{- end }} - - name: minio-config-dir - mountPath: {{ .Values.configPath }} {{- if .Values.tls.enabled }} - name: cert-secret-volume - mountPath: {{ .Values.configPath }}certs + mountPath: {{ .Values.certsPath }} {{ end }} ports: - name: service @@ -153,8 +157,6 @@ spec: - name: minio-user secret: secretName: {{ if .Values.existingSecret }}{{ .Values.existingSecret }}{{ else }}{{ template "minio.fullname" . }}{{ end }} - - name: minio-config-dir - emptyDir: {} {{- if .Values.tls.enabled }} - name: cert-secret-volume secret: diff --git a/stable/minio/values.yaml b/stable/minio/values.yaml index 55edf4d2cd..78e12eab53 100755 --- a/stable/minio/values.yaml +++ b/stable/minio/values.yaml @@ -14,7 +14,7 @@ clusterDomain: cluster.local ## image: repository: minio/minio - tag: RELEASE.2019-12-24T23-04-45Z + tag: RELEASE.2019-12-30T05-45-39Z pullPolicy: IfNotPresent ## Set default image, imageTag, and imagePullPolicy for the `mc` (the minio @@ -56,12 +56,15 @@ priorityClassName: "" existingSecret: "" accessKey: "AKIAIOSFODNN7EXAMPLE" secretKey: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" -configPath: "/root/.minio/" -configPathmc: "/root/.mc/" +certsPath: "/etc/minio/certs/" +configPathmc: "/etc/minio/mc/" mountPath: "/export" + # Number of drives attached to a node drivesPerNode: 1 +# Number of MinIO containers running replicas: 4 +# Number of expanded MinIO clusters zones: 1 ## TLS Settings for Minio @@ -152,6 +155,14 @@ nodeSelector: {} tolerations: [] affinity: {} +## Add stateful containers to have security context, if enabled MinIO will run as this +## user and group NOTE: securityContext is only enabled if persistence.enabled=true +securityContext: + enabled: false + runAsUser: 1000 + runAsGroup: 1000 + fsGroup: 1000 + # Additational pod annotations podAnnotations: {}