[stable/redis] add init-container for set chown redis data dir (#7928)

* add init-container for set chown redis data dir
when securityContext and persistence claim template is enabled

Signed-off-by: Sergey Bondarev <s.bondarev@southbridge.ru>

* add to Readme and values-production.yaml

Signed-off-by: Sergey Bondarev <s.bondarev@southbridge.ru>

* change init-container image to busybox
bump chart version to 4.1

Signed-off-by: Sergey Bondarev <s.bondarev@southbridge.ru>

* also change init conatiner image in values-production.yml

Signed-off-by: Sergey Bondarev <s.bondarev@southbridge.ru>

* fix version

Signed-off-by: Sergey Bondarev <s.bondarev@southbridge.ru>

stable/redis/Chart.yaml

@@ -1,5 +1,5 @@
 name: redis
-version: 4.0.1
+version: 4.1.0
 appVersion: 4.0.11
 description: Open source, advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets.
 keywords:

stable/redis/README.md

@@ -146,6 +146,10 @@ The following table lists the configurable parameters of the Redis chart and the
 | `master.readinessProbe.timeoutSeconds`     | When the probe times out (redis master pod)                                                                    | `1`                                                  |
 | `master.readinessProbe.successThreshold`   | Minimum consecutive successes for the probe to be considered successful after having failed (redis master pod) | `1`                                                  |
 | `master.readinessProbe.failureThreshold`   | Minimum consecutive failures for the probe to be considered failed after having succeeded.                     | `5`                                                  |
+| `volumePermissions.image.registry`         | Init container volume-permissions image registry                                                               | `docker.io`                                          |
+| `volumePermissions.image.repository`       | Init container volume-permissions image name                                                                   | `alpine`                                             |
+| `volumePermissions.image.tag`              | Init container volume-permissions image tag                                                                    | `3.8`                                                |
+| `volumePermissions.image.pullPolicy`       | Init container volume-permissions image pull policy                                                            | `IfNotPresent`                                       |
 | `slave.serviceType`                        | Kubernetes Service type (redis slave)                                                                          | `LoadBalancer`                                       |
 | `slave.service.nodePort`                   | Kubernetes Service nodePort (redis slave)                                                                      | `nil`                                                |
 | `slave.service.annotations`                | annotations for redis slave service                                                                            | {}                                                   |

stable/redis/templates/_helpers.tpl

@@ -62,6 +62,16 @@ Return the proper image name (for the metrics image)
 {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
 {{- end -}}
 
+{{/*
+Return the proper image name (for the init container volume-permissions image)
+*/}}
+{{- define "volumePermissions.image" -}}
+{{- $registryName :=  .Values.volumePermissions.image.registry -}}
+{{- $repositoryName := .Values.volumePermissions.image.repository -}}
+{{- $tag := .Values.volumePermissions.image.tag | toString -}}
+{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
+{{- end -}}
+
 {{/*
 Return slave readiness probe
 */}}

stable/redis/templates/redis-master-statefulset.yaml

@@ -134,6 +134,19 @@ spec:
           mountPath: /opt/bitnami/redis/etc/redis.conf
           subPath: redis.conf
         {{- end }}
+      {{- if and ( and .Values.master.persistence.enabled (not .Values.persistence.existingClaim) ) .Values.master.securityContext.enabled }}
+      initContainers:
+      - name: volume-permissions
+        image: "{{ template "volumePermissions.image" . }}"
+        imagePullPolicy: {{ default "" .Values.volumePermissions.image.pullPolicy | quote }}
+        command: ["/bin/chown", "-R", "{{ .Values.master.securityContext.runAsUser }}:{{ .Values.master.securityContext.fsGroup }}", "{{ .Values.master.persistence.path }}"]
+        securityContext:
+          runAsUser: 0
+        volumeMounts:
+        - name: redis-data
+          mountPath: {{ .Values.master.persistence.path }}
+          subPath: {{ .Values.master.persistence.subPath }}
+      {{- end }}
       volumes:
       - name: health
         configMap:

stable/redis/values-production.yaml

@@ -317,6 +317,18 @@ metrics:
   # podAnnotations: {}
   # podLabels: {}
 
+##
+## Init containers parameters:
+## volumePermissions: Change the owner of the persist volume mountpoint to RunAsUser:fsGroup
+##
+
+volumePermissions:
+  image:
+    registry: docker.io
+    repository: busybox
+    tag: latest
+    pullPolicy: IfNotPresent
+
 ## Redis config file
 ##
 configmap: |-

stable/redis/values.yaml

@@ -332,6 +332,18 @@ metrics:
   # podAnnotations: {}
   # podLabels: {}
 
+##
+## Init containers parameters:
+## volumePermissions: Change the owner of the persist volume mountpoint to RunAsUser:fsGroup
+##
+
+volumePermissions:
+  image:
+    registry: docker.io
+    repository: busybox
+    tag: latest
+    pullPolicy: IfNotPresent
+
 ## Redis config file
 ##
 configmap: |-