Skip to content

Commit 27def72

Browse files
AsgavarAsgavar
committed
Allow chart users to specify a Security Context
1 parent 58e87a7 commit 27def72

9 files changed

+52
-2
lines changed

‎cockroachdb/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
apiVersion: v1
33
name: cockroachdb
44
home: https://www.cockroachlabs.com
5-
version: 7.0.1
5+
version: 7.1.0
66
appVersion: 21.2.7
77
description: CockroachDB is a scalable, survivable, strongly-consistent SQL database.
88
icon: https://raw.githubusercontent.com/cockroachdb/cockroach/master/docs/media/cockroach_db.png

‎cockroachdb/README.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -344,6 +344,7 @@ For details see the [`values.yaml`](values.yaml) file.
344344
| `statefulset.resources` | Resource requests and limits for StatefulSet Pods | `{}` |
345345
| `statefulset.customLivenessProbe` | Custom Liveness probe | `{}` |
346346
| `statefulset.customReadinessProbe` | Custom Rediness probe | `{}` |
347+
| `statefulset.securityContext` | Security context for containers | `{}` |
347348
| `service.ports.grpc.external.port` | CockroachDB primary serving port in Services | `26257` |
348349
| `service.ports.grpc.external.name` | CockroachDB primary serving port name in Services | `grpc` |
349350
| `service.ports.grpc.internal.port` | CockroachDB inter-communication port in Services | `26257` |
@@ -380,6 +381,7 @@ For details see the [`values.yaml`](values.yaml) file.
380381
| `init.nodeSelector` | Node labels for init Job Pod assignment | `{}` |
381382
| `init.tolerations` | Node taints to tolerate by init Job Pod | `[]` |
382383
| `init.resources` | Resource requests and limits for the Pod of init Job | `{}` |
384+
| `init.securityContext` | Security context for the init job containers | `{}` |
383385
| `tls.enabled` | Whether to run securely using TLS certificates | `no` |
384386
| `tls.serviceAccount.create` | Whether to create a new RBAC service account | `yes` |
385387
| `tls.serviceAccount.name` | Name of RBAC service account to use | `""` |
@@ -408,9 +410,11 @@ For details see the [`values.yaml`](values.yaml) file.
408410
| `tls.selfSigner.image.tag` | Image tag to use for self signing TLS certificates | `0.1` |
409411
| `tls.selfSigner.image.pullPolicy` | Self signing TLS certificates container pull policy | `IfNotPresent` |
410412
| `tls.selfSigner.image.credentials` | `registry`, `user` and `pass` credentials to pull private image | `{}` |
413+
| `tls.selfSigner.securityContext` | Security context applied to selfSigner containers | `{}` |
411414
| `networkPolicy.enabled` | Enable NetworkPolicy for CockroachDB's Pods | `no` |
412415
| `networkPolicy.ingress.grpc` | Whitelist resources to access gRPC port of CockroachDB's Pods | `[]` |
413416
| `networkPolicy.ingress.http` | Whitelist resources to access gRPC port of CockroachDB's Pods | `[]` |
417+
| `securityContext` | Security context applied to Pods | `{}` |
414418

415419

416420
Override the default parameters using the `--set key=value[,key=value]` argument to `helm install`.

‎cockroachdb/templates/cronjob-ca-certSelfSigner.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,10 @@ spec:
2222
- name: cert-rotate-job
2323
image: "{{ .Values.tls.selfSigner.image.registry }}/{{ .Values.tls.selfSigner.image.repository }}:{{ .Values.tls.selfSigner.image.tag }}"
2424
imagePullPolicy: "{{ .Values.tls.selfSigner.image.pullPolicy }}"
25+
{{- if .Values.tls.selfSigner.securityContext }}
26+
securityContext:
27+
{{- toYaml .Values.tls.selfSigner.securityContext | nindent 14 }}
28+
{{- end }}
2529
args:
2630
- rotate
2731
- --ca

‎cockroachdb/templates/cronjob-client-node-certSelfSigner.yaml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,10 @@ spec:
2121
- name: cert-rotate-job
2222
image: "{{ .Values.tls.selfSigner.image.registry }}/{{ .Values.tls.selfSigner.image.repository }}:{{ .Values.tls.selfSigner.image.tag }}"
2323
imagePullPolicy: "{{ .Values.tls.selfSigner.image.pullPolicy }}"
24+
{{- if .Values.tls.selfSigner.securityContext }}
25+
securityContext:
26+
{{- toYaml .Values.tls.selfSigner.securityContext | nindent 14 }}
27+
{{- end }}
2428
args:
2529
- rotate
2630
{{- if .Values.tls.certs.selfSigner.caProvided }}
@@ -46,4 +50,4 @@ spec:
4650
- name: CLUSTER_DOMAIN
4751
value: {{ .Values.clusterDomain}}
4852
serviceAccountName: {{ template "rotatecerts.fullname" . }}
49-
{{- end}}
53+
{{- end}}

‎cockroachdb/templates/job-certSelfSigner.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,10 @@ spec:
3030
- name: cert-generate-job
3131
image: "{{ .Values.tls.selfSigner.image.registry }}/{{ .Values.tls.selfSigner.image.repository }}:{{ .Values.tls.selfSigner.image.tag }}"
3232
imagePullPolicy: "{{ .Values.tls.selfSigner.image.pullPolicy }}"
33+
{{- if .Values.tls.selfSigner.securityContext }}
34+
securityContext:
35+
{{- toYaml .Values.tls.selfSigner.securityContext | nindent 12 }}
36+
{{- end }}
3337
args:
3438
- generate
3539
{{- if .Values.tls.certs.selfSigner.caProvided }}

‎cockroachdb/templates/job-cleaner.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,10 @@ spec:
3030
- name: cleaner
3131
image: "{{ .Values.tls.selfSigner.image.registry }}/{{ .Values.tls.selfSigner.image.repository }}:{{ .Values.tls.selfSigner.image.tag }}"
3232
imagePullPolicy: "{{ .Values.tls.selfSigner.image.pullPolicy }}"
33+
{{- if .Values.tls.selfSigner.securityContext }}
34+
securityContext:
35+
{{- toYaml .Values.tls.selfSigner.securityContext | nindent 12 }}
36+
{{- end }}
3337
args:
3438
- cleanup
3539
- --namespace={{ .Release.Namespace }}

‎cockroachdb/templates/job.init.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,10 @@ spec:
3636
spec:
3737
restartPolicy: OnFailure
3838
terminationGracePeriodSeconds: 0
39+
{{- if .Values.securityContext }}
40+
securityContext:
41+
{{- toYaml .Values.securityContext | nindent 8 }}
42+
{{- end }}
3943
{{- if or .Values.image.credentials (and .Values.tls.enabled .Values.tls.selfSigner.image.credentials (not .Values.tls.certs.provided) (not .Values.tls.certs.certManager)) }}
4044
imagePullSecrets:
4145
{{- if .Values.image.credentials }}
@@ -51,6 +55,10 @@ spec:
5155
- name: copy-certs
5256
image: "busybox"
5357
imagePullPolicy: {{ .Values.tls.selfSigner.image.pullPolicy | quote }}
58+
{{- if .Values.init.securityContext }}
59+
securityContext:
60+
{{- toYaml .Values.init.securityContext | nindent 12 }}
61+
{{- end }}
5462
command:
5563
- /bin/sh
5664
- -c
@@ -79,6 +87,10 @@ spec:
7987
- name: cluster-init
8088
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
8189
imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
90+
{{- if .Values.init.securityContext }}
91+
securityContext:
92+
{{- toYaml .Values.init.securityContext | nindent 12 }}
93+
{{- end }}
8294
# Run the command in an `while true` loop because this Job is bound
8395
# to come up before the CockroachDB Pods (due to the time needed to
8496
# get PersistentVolumes attached to Nodes), and sleeping 5 seconds

‎cockroachdb/templates/statefulset.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,10 @@ spec:
4141
annotations: {{- toYaml . | nindent 8 }}
4242
{{- end }}
4343
spec:
44+
{{- if .Values.securityContext }}
45+
securityContext:
46+
{{- toYaml .Values.securityContext | nindent 8 }}
47+
{{- end }}
4448
{{- if or .Values.image.credentials (and .Values.tls.enabled .Values.tls.selfSigner.image.credentials (not .Values.tls.certs.provided) (not .Values.tls.certs.certManager)) }}
4549
imagePullSecrets:
4650
{{- if .Values.image.credentials }}
@@ -57,6 +61,10 @@ spec:
5761
- name: copy-certs
5862
image: "busybox"
5963
imagePullPolicy: {{ .Values.tls.selfSigner.image.pullPolicy | quote }}
64+
{{- if .Values.statefulset.securityContext }}
65+
securityContext:
66+
{{- toYaml .Values.statefulset.securityContext | nindent 12 }}
67+
{{- end }}
6068
command:
6169
- /bin/sh
6270
- -c
@@ -143,6 +151,10 @@ spec:
143151
- name: db
144152
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
145153
imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
154+
{{- if .Values.statefulset.securityContext }}
155+
securityContext:
156+
{{- toYaml .Values.statefulset.securityContext | nindent 12 }}
157+
{{- end }}
146158
args:
147159
- shell
148160
- -ecx

‎cockroachdb/values.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -169,6 +169,7 @@ statefulset:
169169
podManagementPolicy: Parallel
170170
budget:
171171
maxUnavailable: 1
172+
securityContext: {}
172173

173174
# List of additional command-line arguments you want to pass to the
174175
# `cockroach start` command.
@@ -390,6 +391,8 @@ init:
390391
# cpu: "10m"
391392
# memory: "128Mi"
392393

394+
securityContext: {}
395+
393396
provisioning:
394397
enabled: false
395398
# https://www.cockroachlabs.com/docs/stable/cluster-settings.html
@@ -492,6 +495,7 @@ tls:
492495
registry: gcr.io
493496
# username: john_doe
494497
# password: changeme
498+
securityContext: {}
495499

496500
networkPolicy:
497501
enabled: false
@@ -522,3 +526,5 @@ iap:
522526
# Create Google Cloud OAuth credentials and set client id and secret
523527
# clientId:
524528
# clientSecret:
529+
530+
securityContext: {}

0 commit comments

Comments
 (0)