From b0eb3a1df46b989401dd9e7e9812ff384e5abfe5 Mon Sep 17 00:00:00 2001 From: cleverhu Date: Wed, 26 Oct 2022 17:49:49 +0800 Subject: [PATCH] [bitnami/redis-cluster]Allow redis-cluster securityContext override for redis-cluster init-containers (#13068) * Allow securityContext override for redis-cluster init-containers Signed-off-by: cleverhu * Update README.md with readme-generator-for-helm Signed-off-by: Bitnami Containers Signed-off-by: cleverhu Signed-off-by: Bitnami Containers Co-authored-by: Bitnami Containers --- bitnami/redis-cluster/Chart.yaml | 2 +- bitnami/redis-cluster/README.md | 196 +++++++++--------- .../templates/redis-statefulset.yaml | 6 +- bitnami/redis-cluster/values.yaml | 18 ++ 4 files changed, 123 insertions(+), 99 deletions(-) diff --git a/bitnami/redis-cluster/Chart.yaml b/bitnami/redis-cluster/Chart.yaml index eb695d3cd..45eae761f 100644 --- a/bitnami/redis-cluster/Chart.yaml +++ b/bitnami/redis-cluster/Chart.yaml @@ -23,4 +23,4 @@ name: redis-cluster sources: - https://github.com/bitnami/containers/tree/main/bitnami/redis - http://redis.io/ -version: 8.2.5 +version: 8.2.6 diff --git a/bitnami/redis-cluster/README.md b/bitnami/redis-cluster/README.md index 3b8369ca0..fa17e9366 100644 --- a/bitnami/redis-cluster/README.md +++ b/bitnami/redis-cluster/README.md @@ -81,88 +81,91 @@ The command removes all the Kubernetes components associated with the chart and ### Redis® Cluster Common parameters -| Name | Description | Value | -| --------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------- | -| `nameOverride` | String to partially override common.names.fullname template (will maintain the release name) | `""` | -| `fullnameOverride` | String to fully override common.names.fullname template | `""` | -| `clusterDomain` | Kubernetes Cluster Domain | `cluster.local` | -| `commonAnnotations` | Annotations to add to all deployed objects | `{}` | -| `commonLabels` | Labels to add to all deployed objects | `{}` | -| `extraDeploy` | Array of extra objects to deploy with the release (evaluated as a template) | `[]` | -| `diagnosticMode.enabled` | Enable diagnostic mode (all probes will be disabled and the command will be overridden) | `false` | -| `diagnosticMode.command` | Command to override all containers in the deployment | `["sleep"]` | -| `diagnosticMode.args` | Args to override all containers in the deployment | `["infinity"]` | -| `image.registry` | Redis® cluster image registry | `docker.io` | -| `image.repository` | Redis® cluster image repository | `bitnami/redis-cluster` | -| `image.tag` | Redis® cluster image tag (immutable tags are recommended) | `7.0.5-debian-11-r9` | -| `image.digest` | Redis® cluster image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` | -| `image.pullPolicy` | Redis® cluster image pull policy | `IfNotPresent` | -| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` | -| `image.debug` | Enable image debug mode | `false` | -| `networkPolicy.enabled` | Enable NetworkPolicy | `false` | -| `networkPolicy.allowExternal` | The Policy model to apply. Don't require client label for connections | `true` | -| `networkPolicy.ingressNSMatchLabels` | Allow connections from other namespacess. Just set label for namespace and set label for pods (optional). | `{}` | -| `networkPolicy.ingressNSPodMatchLabels` | For other namespaces match by pod labels and namespace labels | `{}` | -| `serviceAccount.create` | Specifies whether a ServiceAccount should be created | `false` | -| `serviceAccount.name` | The name of the ServiceAccount to create | `""` | -| `serviceAccount.annotations` | Annotations for Cassandra Service Account | `{}` | -| `serviceAccount.automountServiceAccountToken` | Automount API credentials for a service account. | `false` | -| `rbac.create` | Specifies whether RBAC resources should be created | `false` | -| `rbac.role.rules` | Rules to create. It follows the role specification | `[]` | -| `podSecurityContext.enabled` | Enable Redis® pod Security Context | `true` | -| `podSecurityContext.fsGroup` | Group ID for the pods | `1001` | -| `podSecurityContext.runAsUser` | User ID for the pods | `1001` | -| `podSecurityContext.sysctls` | Set namespaced sysctls for the pods | `[]` | -| `podDisruptionBudget` | Limits the number of pods of the replicated application that are down simultaneously from voluntary disruptions | `{}` | -| `minAvailable` | Min number of pods that must still be available after the eviction | `""` | -| `maxUnavailable` | Max number of pods that can be unavailable after the eviction | `""` | -| `containerSecurityContext.enabled` | Enable Containers' Security Context | `true` | -| `containerSecurityContext.runAsUser` | User ID for the containers. | `1001` | -| `containerSecurityContext.runAsNonRoot` | Run container as non root | `true` | -| `usePassword` | Use password authentication | `true` | -| `password` | Redis® password (ignored if existingSecret set) | `""` | -| `existingSecret` | Name of existing secret object (for password authentication) | `""` | -| `existingSecretPasswordKey` | Name of key containing password to be retrieved from the existing secret | `""` | -| `usePasswordFile` | Mount passwords as files instead of environment variables | `false` | -| `tls.enabled` | Enable TLS support for replication traffic | `false` | -| `tls.authClients` | Require clients to authenticate or not | `true` | -| `tls.autoGenerated` | Generate automatically self-signed TLS certificates | `false` | -| `tls.existingSecret` | The name of the existing secret that contains the TLS certificates | `""` | -| `tls.certificatesSecret` | DEPRECATED. Use tls.existingSecret instead | `""` | -| `tls.certFilename` | Certificate filename | `""` | -| `tls.certKeyFilename` | Certificate key filename | `""` | -| `tls.certCAFilename` | CA Certificate filename | `""` | -| `tls.dhParamsFilename` | File containing DH params (in order to support DH based ciphers) | `""` | -| `service.ports.redis` | Kubernetes Redis service port | `6379` | -| `service.nodePorts.redis` | Node port for Redis | `""` | -| `service.extraPorts` | Extra ports to expose in the service (normally used with the `sidecar` value) | `[]` | -| `service.annotations` | Provide any additional annotations which may be required. | `{}` | -| `service.labels` | Additional labels for redis service | `{}` | -| `service.type` | Service type for default redis service | `ClusterIP` | -| `service.clusterIP` | Service Cluster IP | `""` | -| `service.loadBalancerIP` | Load balancer IP if `service.type` is `LoadBalancer` | `""` | -| `service.loadBalancerSourceRanges` | Service Load Balancer sources | `[]` | -| `service.externalTrafficPolicy` | Service external traffic policy | `Cluster` | -| `service.sessionAffinity` | Session Affinity for Kubernetes service, can be "None" or "ClientIP" | `None` | -| `service.sessionAffinityConfig` | Additional settings for the sessionAffinity | `{}` | -| `persistence.path` | Path to mount the volume at, to use other images Redis® images. | `/bitnami/redis/data` | -| `persistence.subPath` | The subdirectory of the volume to mount to, useful in dev environments and one PV for multiple services | `""` | -| `persistence.storageClass` | Storage class of backing PVC | `""` | -| `persistence.annotations` | Persistent Volume Claim annotations | `{}` | -| `persistence.accessModes` | Persistent Volume Access Modes | `["ReadWriteOnce"]` | -| `persistence.size` | Size of data volume | `8Gi` | -| `persistence.matchLabels` | Persistent Volume selectors | `{}` | -| `persistence.matchExpressions` | matchExpressions Persistent Volume selectors | `{}` | -| `volumePermissions.enabled` | Enable init container that changes volume permissions in the registry (for cases where the default k8s `runAsUser` and `fsUser` values do not work) | `false` | -| `volumePermissions.image.registry` | Init container volume-permissions image registry | `docker.io` | -| `volumePermissions.image.repository` | Init container volume-permissions image repository | `bitnami/bitnami-shell` | -| `volumePermissions.image.tag` | Init container volume-permissions image tag | `11-debian-11-r43` | -| `volumePermissions.image.digest` | Init container volume-permissions image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` | -| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `IfNotPresent` | -| `volumePermissions.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` | -| `volumePermissions.resources.limits` | The resources limits for the container | `{}` | -| `volumePermissions.resources.requests` | The requested resources for the container | `{}` | -| `podSecurityPolicy.create` | Whether to create a PodSecurityPolicy. WARNING: PodSecurityPolicy is deprecated in Kubernetes v1.21 or later, unavailable in v1.25 or later | `false` | +| Name | Description | Value | +| ------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------- | +| `nameOverride` | String to partially override common.names.fullname template (will maintain the release name) | `""` | +| `fullnameOverride` | String to fully override common.names.fullname template | `""` | +| `clusterDomain` | Kubernetes Cluster Domain | `cluster.local` | +| `commonAnnotations` | Annotations to add to all deployed objects | `{}` | +| `commonLabels` | Labels to add to all deployed objects | `{}` | +| `extraDeploy` | Array of extra objects to deploy with the release (evaluated as a template) | `[]` | +| `diagnosticMode.enabled` | Enable diagnostic mode (all probes will be disabled and the command will be overridden) | `false` | +| `diagnosticMode.command` | Command to override all containers in the deployment | `["sleep"]` | +| `diagnosticMode.args` | Args to override all containers in the deployment | `["infinity"]` | +| `image.registry` | Redis® cluster image registry | `docker.io` | +| `image.repository` | Redis® cluster image repository | `bitnami/redis-cluster` | +| `image.tag` | Redis® cluster image tag (immutable tags are recommended) | `7.0.5-debian-11-r9` | +| `image.digest` | Redis® cluster image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` | +| `image.pullPolicy` | Redis® cluster image pull policy | `IfNotPresent` | +| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` | +| `image.debug` | Enable image debug mode | `false` | +| `networkPolicy.enabled` | Enable NetworkPolicy | `false` | +| `networkPolicy.allowExternal` | The Policy model to apply. Don't require client label for connections | `true` | +| `networkPolicy.ingressNSMatchLabels` | Allow connections from other namespacess. Just set label for namespace and set label for pods (optional). | `{}` | +| `networkPolicy.ingressNSPodMatchLabels` | For other namespaces match by pod labels and namespace labels | `{}` | +| `serviceAccount.create` | Specifies whether a ServiceAccount should be created | `false` | +| `serviceAccount.name` | The name of the ServiceAccount to create | `""` | +| `serviceAccount.annotations` | Annotations for Cassandra Service Account | `{}` | +| `serviceAccount.automountServiceAccountToken` | Automount API credentials for a service account. | `false` | +| `rbac.create` | Specifies whether RBAC resources should be created | `false` | +| `rbac.role.rules` | Rules to create. It follows the role specification | `[]` | +| `podSecurityContext.enabled` | Enable Redis® pod Security Context | `true` | +| `podSecurityContext.fsGroup` | Group ID for the pods | `1001` | +| `podSecurityContext.runAsUser` | User ID for the pods | `1001` | +| `podSecurityContext.sysctls` | Set namespaced sysctls for the pods | `[]` | +| `podDisruptionBudget` | Limits the number of pods of the replicated application that are down simultaneously from voluntary disruptions | `{}` | +| `minAvailable` | Min number of pods that must still be available after the eviction | `""` | +| `maxUnavailable` | Max number of pods that can be unavailable after the eviction | `""` | +| `containerSecurityContext.enabled` | Enable Containers' Security Context | `true` | +| `containerSecurityContext.runAsUser` | User ID for the containers. | `1001` | +| `containerSecurityContext.runAsNonRoot` | Run container as non root | `true` | +| `usePassword` | Use password authentication | `true` | +| `password` | Redis® password (ignored if existingSecret set) | `""` | +| `existingSecret` | Name of existing secret object (for password authentication) | `""` | +| `existingSecretPasswordKey` | Name of key containing password to be retrieved from the existing secret | `""` | +| `usePasswordFile` | Mount passwords as files instead of environment variables | `false` | +| `tls.enabled` | Enable TLS support for replication traffic | `false` | +| `tls.authClients` | Require clients to authenticate or not | `true` | +| `tls.autoGenerated` | Generate automatically self-signed TLS certificates | `false` | +| `tls.existingSecret` | The name of the existing secret that contains the TLS certificates | `""` | +| `tls.certificatesSecret` | DEPRECATED. Use tls.existingSecret instead | `""` | +| `tls.certFilename` | Certificate filename | `""` | +| `tls.certKeyFilename` | Certificate key filename | `""` | +| `tls.certCAFilename` | CA Certificate filename | `""` | +| `tls.dhParamsFilename` | File containing DH params (in order to support DH based ciphers) | `""` | +| `service.ports.redis` | Kubernetes Redis service port | `6379` | +| `service.nodePorts.redis` | Node port for Redis | `""` | +| `service.extraPorts` | Extra ports to expose in the service (normally used with the `sidecar` value) | `[]` | +| `service.annotations` | Provide any additional annotations which may be required. | `{}` | +| `service.labels` | Additional labels for redis service | `{}` | +| `service.type` | Service type for default redis service | `ClusterIP` | +| `service.clusterIP` | Service Cluster IP | `""` | +| `service.loadBalancerIP` | Load balancer IP if `service.type` is `LoadBalancer` | `""` | +| `service.loadBalancerSourceRanges` | Service Load Balancer sources | `[]` | +| `service.externalTrafficPolicy` | Service external traffic policy | `Cluster` | +| `service.sessionAffinity` | Session Affinity for Kubernetes service, can be "None" or "ClientIP" | `None` | +| `service.sessionAffinityConfig` | Additional settings for the sessionAffinity | `{}` | +| `persistence.path` | Path to mount the volume at, to use other images Redis® images. | `/bitnami/redis/data` | +| `persistence.subPath` | The subdirectory of the volume to mount to, useful in dev environments and one PV for multiple services | `""` | +| `persistence.storageClass` | Storage class of backing PVC | `""` | +| `persistence.annotations` | Persistent Volume Claim annotations | `{}` | +| `persistence.accessModes` | Persistent Volume Access Modes | `["ReadWriteOnce"]` | +| `persistence.size` | Size of data volume | `8Gi` | +| `persistence.matchLabels` | Persistent Volume selectors | `{}` | +| `persistence.matchExpressions` | matchExpressions Persistent Volume selectors | `{}` | +| `volumePermissions.enabled` | Enable init container that changes volume permissions in the registry (for cases where the default k8s `runAsUser` and `fsUser` values do not work) | `false` | +| `volumePermissions.image.registry` | Init container volume-permissions image registry | `docker.io` | +| `volumePermissions.image.repository` | Init container volume-permissions image repository | `bitnami/bitnami-shell` | +| `volumePermissions.image.tag` | Init container volume-permissions image tag | `11-debian-11-r43` | +| `volumePermissions.image.digest` | Init container volume-permissions image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` | +| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `IfNotPresent` | +| `volumePermissions.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` | +| `volumePermissions.containerSecurityContext.enabled` | Enable Containers' Security Context | `true` | +| `volumePermissions.containerSecurityContext.runAsUser` | User ID for the containers. | `0` | +| `volumePermissions.containerSecurityContext.privileged` | Run container as privileged | `false` | +| `volumePermissions.resources.limits` | The resources limits for the container | `{}` | +| `volumePermissions.resources.requests` | The requested resources for the container | `{}` | +| `podSecurityPolicy.create` | Whether to create a PodSecurityPolicy. WARNING: PodSecurityPolicy is deprecated in Kubernetes v1.21 or later, unavailable in v1.25 or later | `false` | ### Redis® statefulset parameters @@ -318,19 +321,22 @@ The command removes all the Kubernetes components associated with the chart and ### Sysctl Image parameters -| Name | Description | Value | -| -------------------------------- | -------------------------------------------------------------------------------------------------------------------- | ----------------------- | -| `sysctlImage.enabled` | Enable an init container to modify Kernel settings | `false` | -| `sysctlImage.command` | sysctlImage command to execute | `[]` | -| `sysctlImage.registry` | sysctlImage Init container registry | `docker.io` | -| `sysctlImage.repository` | sysctlImage Init container repository | `bitnami/bitnami-shell` | -| `sysctlImage.tag` | sysctlImage Init container tag | `11-debian-11-r43` | -| `sysctlImage.digest` | sysctlImage Init container digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` | -| `sysctlImage.pullPolicy` | sysctlImage Init container pull policy | `IfNotPresent` | -| `sysctlImage.pullSecrets` | Specify docker-registry secret names as an array | `[]` | -| `sysctlImage.mountHostSys` | Mount the host `/sys` folder to `/host-sys` | `false` | -| `sysctlImage.resources.limits` | The resources limits for the container | `{}` | -| `sysctlImage.resources.requests` | The requested resources for the container | `{}` | +| Name | Description | Value | +| ------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- | ----------------------- | +| `sysctlImage.enabled` | Enable an init container to modify Kernel settings | `false` | +| `sysctlImage.command` | sysctlImage command to execute | `[]` | +| `sysctlImage.registry` | sysctlImage Init container registry | `docker.io` | +| `sysctlImage.repository` | sysctlImage Init container repository | `bitnami/bitnami-shell` | +| `sysctlImage.tag` | sysctlImage Init container tag | `11-debian-11-r43` | +| `sysctlImage.digest` | sysctlImage Init container digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` | +| `sysctlImage.pullPolicy` | sysctlImage Init container pull policy | `IfNotPresent` | +| `sysctlImage.pullSecrets` | Specify docker-registry secret names as an array | `[]` | +| `sysctlImage.mountHostSys` | Mount the host `/sys` folder to `/host-sys` | `false` | +| `sysctlImage.containerSecurityContext.enabled` | Enable Containers' Security Context | `true` | +| `sysctlImage.containerSecurityContext.runAsUser` | User ID for the containers. | `0` | +| `sysctlImage.containerSecurityContext.privileged` | Run privileged as privileged | `true` | +| `sysctlImage.resources.limits` | The resources limits for the container | `{}` | +| `sysctlImage.resources.requests` | The requested resources for the container | `{}` | Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, diff --git a/bitnami/redis-cluster/templates/redis-statefulset.yaml b/bitnami/redis-cluster/templates/redis-statefulset.yaml index 197ccd423..e843d805e 100644 --- a/bitnami/redis-cluster/templates/redis-statefulset.yaml +++ b/bitnami/redis-cluster/templates/redis-statefulset.yaml @@ -382,9 +382,9 @@ spec: {{- end }} command: {{- toYaml .Values.sysctlImage.command | nindent 12 }} - securityContext: - privileged: true - runAsUser: 0 + {{- if .Values.sysctlImage.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.sysctlImage.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} {{- end }} {{- if .Values.redis.initContainers }} {{- toYaml .Values.redis.initContainers | nindent 8 }} diff --git a/bitnami/redis-cluster/values.yaml b/bitnami/redis-cluster/values.yaml index 57b6a0d7e..b14395d5f 100644 --- a/bitnami/redis-cluster/values.yaml +++ b/bitnami/redis-cluster/values.yaml @@ -348,6 +348,15 @@ volumePermissions: ## - myRegistryKeySecretName ## pullSecrets: [] + ## Containers Security Context + ## @param volumePermissions.containerSecurityContext.enabled Enable Containers' Security Context + ## @param volumePermissions.containerSecurityContext.runAsUser User ID for the containers. + ## @param volumePermissions.containerSecurityContext.privileged Run container as privileged + ## + containerSecurityContext: + enabled: true + runAsUser: 0 + privileged: false ## Container resource requests and limits ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ ## @param volumePermissions.resources.limits The resources limits for the container @@ -975,6 +984,15 @@ sysctlImage: ## @param sysctlImage.mountHostSys Mount the host `/sys` folder to `/host-sys` ## mountHostSys: false + ## Containers Security Context + ## @param sysctlImage.containerSecurityContext.enabled Enable Containers' Security Context + ## @param sysctlImage.containerSecurityContext.runAsUser User ID for the containers. + ## @param sysctlImage.containerSecurityContext.privileged Run privileged as privileged + ## + containerSecurityContext: + enabled: true + runAsUser: 0 + privileged: true ## Container resource requests and limits ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ ## @param sysctlImage.resources.limits The resources limits for the container