diff --git a/bitnami/cassandra/Chart.yaml b/bitnami/cassandra/Chart.yaml index 4b0887c07..14c815304 100644 --- a/bitnami/cassandra/Chart.yaml +++ b/bitnami/cassandra/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: cassandra -version: 6.0.4 +version: 6.0.5 appVersion: 3.11.8 description: Apache Cassandra is a free and open-source distributed database management system designed to handle large amounts of data across many commodity servers, providing high availability with no single point of failure. Cassandra offers robust support for clusters spanning multiple datacenters, with asynchronous masterless replication allowing low latency operations for all clients. keywords: diff --git a/bitnami/cassandra/README.md b/bitnami/cassandra/README.md index 68aa72875..1292e65d2 100644 --- a/bitnami/cassandra/README.md +++ b/bitnami/cassandra/README.md @@ -163,19 +163,22 @@ The following table lists the configurable parameters of the Cassandra chart and | `persistence.annotations` | Persistent Volume Claim annotations Annotations | `{}` (evaluated as a template) | | `persistence.accessMode` | PVC Access Mode for Cassandra data volume | `[ReadWriteOnce]` | | `persistence.size` | PVC Storage Request for Cassandra data volume | `8Gi` | +| `persistence.mountPath` | The path the volume will be mounted at | `/bitnami/cassandra` | ### Volume Permissions parameters -| Parameter | Description | Default | -|-------------------------------------------|----------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------| -| `volumePermissions.enabled` | Enable init container that changes the owner and group of the persistent volume(s) mountpoint to `runAsUser:fsGroup` | `false` | -| `volumePermissions.image.registry` | Init container volume-permissions image registry | `docker.io` | -| `volumePermissions.image.repository` | Init container volume-permissions image name | `bitnami/minideb` | -| `volumePermissions.image.tag` | Init container volume-permissions image tag | `buster` | -| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `Always` | -| `volumePermissions.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `volumePermissions.resources.limits` | Init container volume-permissions resource limits | `{}` | -| `volumePermissions.resources.requests` | Init container volume-permissions resource requests | `{}` | +| Parameter | Description | Default | +|-----------------------------------------------|----------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------| +| `volumePermissions.enabled` | Enable init container that changes the owner and group of the persistent volume(s) mountpoint to `runAsUser:fsGroup` | `false` | +| `volumePermissions.image.registry` | Init container volume-permissions image registry | `docker.io` | +| `volumePermissions.image.repository` | Init container volume-permissions image name | `bitnami/minideb` | +| `volumePermissions.image.tag` | Init container volume-permissions image tag | `buster` | +| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `Always` | +| `volumePermissions.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `volumePermissions.resources.limits` | Init container volume-permissions resource limits | `{}` | +| `volumePermissions.resources.requests` | Init container volume-permissions resource requests | `{}` | +| `volumePermissions.securityContext.*` | Other container security context to be included as-is in the container spec | `{}` | +| `volumePermissions.securityContext.runAsUser` | User ID for the init container (when facing issues in OpenShift or uid unknown, try value "auto") | `0` | ### Metrics parameters diff --git a/bitnami/cassandra/templates/statefulset.yaml b/bitnami/cassandra/templates/statefulset.yaml index c8e51779b..97afad0f8 100644 --- a/bitnami/cassandra/templates/statefulset.yaml +++ b/bitnami/cassandra/templates/statefulset.yaml @@ -68,18 +68,35 @@ spec: image: {{ include "cassandra.volumePermissions.image" . }} imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} command: - - /bin/bash - - -ec + - /bin/sh + - -cx - | - chown -R {{ .Values.containerSecurityContext.runAsUser }}:{{ .Values.podSecurityContext.fsGroup }} /bitnami/cassandra - securityContext: - runAsUser: 0 + {{- if .Values.persistence.enabled }} + {{- if eq ( toString ( .Values.volumePermissions.securityContext.runAsUser )) "auto" }} + chown `id -u`:`id -G | cut -d " " -f2` {{ .Values.persistence.mountPath }} + {{- else }} + chown {{ .Values.containerSecurityContext.runAsUser }}:{{ .Values.podSecurityContext.fsGroup }} {{ .Values.persistence.mountPath }} + {{- end }} + mkdir -p {{ .Values.persistence.mountPath }}/data + chmod 700 {{ .Values.persistence.mountPath }}/data + find {{ .Values.persistence.mountPath }} -mindepth 1 -maxdepth 1 -not -name ".snapshot" -not -name "lost+found" | \ + {{- if eq ( toString ( .Values.volumePermissions.securityContext.runAsUser )) "auto" }} + xargs chown -R `id -u`:`id -G | cut -d " " -f2` + {{- else }} + xargs chown -R {{ .Values.containerSecurityContext.runAsUser }}:{{ .Values.podSecurityContext.fsGroup }} + {{- end }} + {{- end }} + {{- if eq ( toString ( .Values.volumePermissions.securityContext.runAsUser )) "auto" }} + securityContext: {{- omit .Values.volumePermissions.securityContext "runAsUser" | toYaml | nindent 12 }} + {{- else }} + securityContext: {{- .Values.volumePermissions.securityContext | toYaml | nindent 12 }} + {{- end }} {{- if .Values.volumePermissions.resources }} resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }} {{- end }} volumeMounts: - name: data - mountPath: /bitnami/cassandra + mountPath: {{ .Values.persistence.mountPath }} {{- end }} {{- if .Values.initContainers }} {{- include "common.tplvalues.render" (dict "value" .Values.initContainers "context" $) | nindent 8 }} @@ -243,10 +260,10 @@ spec: {{- end }} volumeMounts: - name: data - mountPath: /bitnami/cassandra + mountPath: {{ .Values.persistence.mountPath }} {{- if .Values.tlsEncryptionSecretName }} - name: encryption-secrets - mountPath: /bitnami/cassandra/secrets + mountPath: {{ .Values.persistence.mountPath }}/secrets {{- end }} {{- if .Values.initDBConfigMap }} - name: init-db-cm @@ -258,7 +275,7 @@ spec: {{- end }} {{ if .Values.existingConfiguration }} - name: configurations - mountPath: /bitnami/cassandra/conf + mountPath: {{ .Values.persistence.mountPath }}/conf {{- end }} {{- if .Values.extraVolumeMounts }} {{- include "common.tplvalues.render" (dict "value" .Values.extraVolumeMounts "context" $) | nindent 12 }} diff --git a/bitnami/cassandra/values-production.yaml b/bitnami/cassandra/values-production.yaml index 9320a0534..e597d0175 100644 --- a/bitnami/cassandra/values-production.yaml +++ b/bitnami/cassandra/values-production.yaml @@ -111,6 +111,9 @@ persistence: ## Persistent Volume size ## size: 8Gi + ## The path the volume will be mounted at + ## + mountPath: /bitnami/cassandra ## Init containers parameters: ## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section. @@ -142,6 +145,17 @@ volumePermissions: requests: {} # cpu: 100m # memory: 128Mi + ## Init container Security Context + ## Note: the chown of the data folder is done to securityContext.runAsUser + ## and not the below volumePermissions.securityContext.runAsUser + ## When runAsUser is set to special value "auto", init container will try to chwon the + ## data folder to autodetermined user&group, using commands: `id -u`:`id -G | cut -d" " -f2` + ## "auto" is especially useful for OpenShift which has scc with dynamic userids (and 0 is not allowed). + ## You may want to use this volumePermissions.securityContext.runAsUser="auto" in combination with + ## pod securityContext.enabled=false and shmVolume.chmod.enabled=false + ## + securityContext: + runAsUser: 0 ## Secret with keystore, keystore password, truststore, truststore password ## diff --git a/bitnami/cassandra/values.yaml b/bitnami/cassandra/values.yaml index a7b69619c..4e76df9eb 100644 --- a/bitnami/cassandra/values.yaml +++ b/bitnami/cassandra/values.yaml @@ -111,6 +111,9 @@ persistence: ## Persistent Volume size ## size: 8Gi + ## The path the volume will be mounted at + ## + mountPath: /bitnami/cassandra ## Init containers parameters: ## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section. @@ -142,6 +145,17 @@ volumePermissions: requests: {} # cpu: 100m # memory: 128Mi + ## Init container Security Context + ## Note: the chown of the data folder is done to securityContext.runAsUser + ## and not the below volumePermissions.securityContext.runAsUser + ## When runAsUser is set to special value "auto", init container will try to chwon the + ## data folder to autodetermined user&group, using commands: `id -u`:`id -G | cut -d" " -f2` + ## "auto" is especially useful for OpenShift which has scc with dynamic userids (and 0 is not allowed). + ## You may want to use this volumePermissions.securityContext.runAsUser="auto" in combination with + ## pod securityContext.enabled=false and shmVolume.chmod.enabled=false + ## + securityContext: + runAsUser: 0 ## Secret with keystore, keystore password, truststore, truststore password ##