Skip to content

Commit 1f7e109

Browse files
AsgavarAsgavar
committed
Allow chart users to specify a Security Context
1 parent aa31d45 commit 1f7e109

File tree

9 files changed

+52
-2
lines changed

9 files changed

+52
-2
lines changed

‎cockroachdb/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
apiVersion: v1
22
name: cockroachdb
33
home: https://www.cockroachlabs.com
4-
version: 7.0.0
4+
version: 7.1.0
55
appVersion: 21.2.6
66
description: CockroachDB is a scalable, survivable, strongly-consistent SQL database.
77
icon: https://raw.githubusercontent.com/cockroachdb/cockroach/master/docs/media/cockroach_db.png

‎cockroachdb/README.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -343,6 +343,7 @@ For details see the [`values.yaml`](values.yaml) file.
343343
| `statefulset.resources` | Resource requests and limits for StatefulSet Pods | `{}` |
344344
| `statefulset.customLivenessProbe` | Custom Liveness probe | `{}` |
345345
| `statefulset.customReadinessProbe` | Custom Rediness probe | `{}` |
346+
| `statefulset.securityContext` | Security context for containers | `{}` |
346347
| `service.ports.grpc.external.port` | CockroachDB primary serving port in Services | `26257` |
347348
| `service.ports.grpc.external.name` | CockroachDB primary serving port name in Services | `grpc` |
348349
| `service.ports.grpc.internal.port` | CockroachDB inter-communication port in Services | `26257` |
@@ -379,6 +380,7 @@ For details see the [`values.yaml`](values.yaml) file.
379380
| `init.nodeSelector` | Node labels for init Job Pod assignment | `{}` |
380381
| `init.tolerations` | Node taints to tolerate by init Job Pod | `[]` |
381382
| `init.resources` | Resource requests and limits for the Pod of init Job | `{}` |
383+
| `init.securityContext` | Security context for the init job containers | `{}` |
382384
| `tls.enabled` | Whether to run securely using TLS certificates | `no` |
383385
| `tls.serviceAccount.create` | Whether to create a new RBAC service account | `yes` |
384386
| `tls.serviceAccount.name` | Name of RBAC service account to use | `""` |
@@ -407,9 +409,11 @@ For details see the [`values.yaml`](values.yaml) file.
407409
| `tls.selfSigner.image.tag` | Image tag to use for self signing TLS certificates | `0.1` |
408410
| `tls.selfSigner.image.pullPolicy` | Self signing TLS certificates container pull policy | `IfNotPresent` |
409411
| `tls.selfSigner.image.credentials` | `registry`, `user` and `pass` credentials to pull private image | `{}` |
412+
| `tls.selfSigner.securityContext` | Security context applied to selfSigner containers | `{}` |
410413
| `networkPolicy.enabled` | Enable NetworkPolicy for CockroachDB's Pods | `no` |
411414
| `networkPolicy.ingress.grpc` | Whitelist resources to access gRPC port of CockroachDB's Pods | `[]` |
412415
| `networkPolicy.ingress.http` | Whitelist resources to access gRPC port of CockroachDB's Pods | `[]` |
416+
| `securityContext` | Security context applied to Pods | `{}` |
413417

414418

415419
Override the default parameters using the `--set key=value[,key=value]` argument to `helm install`.

‎cockroachdb/templates/cronjob-ca-certSelfSigner.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,10 @@ spec:
2222
- name: cert-rotate-job
2323
image: "{{ .Values.tls.selfSigner.image.registry }}/{{ .Values.tls.selfSigner.image.repository }}:{{ .Values.tls.selfSigner.image.tag }}"
2424
imagePullPolicy: "{{ .Values.tls.selfSigner.image.pullPolicy }}"
25+
{{- if .Values.tls.selfSigner.securityContext }}
26+
securityContext:
27+
{{- toYaml .Values.tls.selfSigner.securityContext | nindent 14 }}
28+
{{- end }}
2529
args:
2630
- rotate
2731
- --ca

‎cockroachdb/templates/cronjob-client-node-certSelfSigner.yaml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,10 @@ spec:
2121
- name: cert-rotate-job
2222
image: "{{ .Values.tls.selfSigner.image.registry }}/{{ .Values.tls.selfSigner.image.repository }}:{{ .Values.tls.selfSigner.image.tag }}"
2323
imagePullPolicy: "{{ .Values.tls.selfSigner.image.pullPolicy }}"
24+
{{- if .Values.tls.selfSigner.securityContext }}
25+
securityContext:
26+
{{- toYaml .Values.tls.selfSigner.securityContext | nindent 14 }}
27+
{{- end }}
2428
args:
2529
- rotate
2630
{{- if .Values.tls.certs.selfSigner.caProvided }}
@@ -46,4 +50,4 @@ spec:
4650
- name: CLUSTER_DOMAIN
4751
value: {{ .Values.clusterDomain}}
4852
serviceAccountName: {{ template "rotatecerts.fullname" . }}
49-
{{- end}}
53+
{{- end}}

‎cockroachdb/templates/job-certSelfSigner.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,10 @@ spec:
3030
- name: cert-generate-job
3131
image: "{{ .Values.tls.selfSigner.image.registry }}/{{ .Values.tls.selfSigner.image.repository }}:{{ .Values.tls.selfSigner.image.tag }}"
3232
imagePullPolicy: "{{ .Values.tls.selfSigner.image.pullPolicy }}"
33+
{{- if .Values.tls.selfSigner.securityContext }}
34+
securityContext:
35+
{{- toYaml .Values.tls.selfSigner.securityContext | nindent 12 }}
36+
{{- end }}
3337
args:
3438
- generate
3539
{{- if .Values.tls.certs.selfSigner.caProvided }}

‎cockroachdb/templates/job-cleaner.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,10 @@ spec:
3030
- name: cleaner
3131
image: "{{ .Values.tls.selfSigner.image.registry }}/{{ .Values.tls.selfSigner.image.repository }}:{{ .Values.tls.selfSigner.image.tag }}"
3232
imagePullPolicy: "{{ .Values.tls.selfSigner.image.pullPolicy }}"
33+
{{- if .Values.tls.selfSigner.securityContext }}
34+
securityContext:
35+
{{- toYaml .Values.tls.selfSigner.securityContext | nindent 12 }}
36+
{{- end }}
3337
args:
3438
- cleanup
3539
- --namespace={{ .Release.Namespace }}

‎cockroachdb/templates/job.init.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,10 @@ spec:
3636
spec:
3737
restartPolicy: OnFailure
3838
terminationGracePeriodSeconds: 0
39+
{{- if .Values.securityContext }}
40+
securityContext:
41+
{{- toYaml .Values.securityContext | nindent 8 }}
42+
{{- end }}
3943
{{- if or .Values.image.credentials (and .Values.tls.enabled .Values.tls.selfSigner.image.credentials (not .Values.tls.certs.provided) (not .Values.tls.certs.certManager)) }}
4044
imagePullSecrets:
4145
{{- if .Values.image.credentials }}
@@ -51,6 +55,10 @@ spec:
5155
- name: copy-certs
5256
image: "busybox"
5357
imagePullPolicy: {{ .Values.tls.selfSigner.image.pullPolicy | quote }}
58+
{{- if .Values.init.securityContext }}
59+
securityContext:
60+
{{- toYaml .Values.init.securityContext | nindent 12 }}
61+
{{- end }}
5462
command:
5563
- /bin/sh
5664
- -c
@@ -79,6 +87,10 @@ spec:
7987
- name: cluster-init
8088
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
8189
imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
90+
{{- if .Values.init.securityContext }}
91+
securityContext:
92+
{{- toYaml .Values.init.securityContext | nindent 12 }}
93+
{{- end }}
8294
# Run the command in an `while true` loop because this Job is bound
8395
# to come up before the CockroachDB Pods (due to the time needed to
8496
# get PersistentVolumes attached to Nodes), and sleeping 5 seconds

‎cockroachdb/templates/statefulset.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,10 @@ spec:
4141
annotations: {{- toYaml . | nindent 8 }}
4242
{{- end }}
4343
spec:
44+
{{- if .Values.securityContext }}
45+
securityContext:
46+
{{- toYaml .Values.securityContext | nindent 8 }}
47+
{{- end }}
4448
{{- if or .Values.image.credentials (and .Values.tls.enabled .Values.tls.selfSigner.image.credentials (not .Values.tls.certs.provided) (not .Values.tls.certs.certManager)) }}
4549
imagePullSecrets:
4650
{{- if .Values.image.credentials }}
@@ -57,6 +61,10 @@ spec:
5761
- name: copy-certs
5862
image: "busybox"
5963
imagePullPolicy: {{ .Values.tls.selfSigner.image.pullPolicy | quote }}
64+
{{- if .Values.statefulset.securityContext }}
65+
securityContext:
66+
{{- toYaml .Values.statefulset.securityContext | nindent 12 }}
67+
{{- end }}
6068
command:
6169
- /bin/sh
6270
- -c
@@ -143,6 +151,10 @@ spec:
143151
- name: db
144152
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
145153
imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
154+
{{- if .Values.statefulset.securityContext }}
155+
securityContext:
156+
{{- toYaml .Values.statefulset.securityContext | nindent 12 }}
157+
{{- end }}
146158
args:
147159
- shell
148160
- -ecx

‎cockroachdb/values.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -168,6 +168,7 @@ statefulset:
168168
podManagementPolicy: Parallel
169169
budget:
170170
maxUnavailable: 1
171+
securityContext: {}
171172

172173
# List of additional command-line arguments you want to pass to the
173174
# `cockroach start` command.
@@ -389,6 +390,8 @@ init:
389390
# cpu: "10m"
390391
# memory: "128Mi"
391392

393+
securityContext: {}
394+
392395
provisioning:
393396
enabled: false
394397
# https://www.cockroachlabs.com/docs/stable/cluster-settings.html
@@ -491,6 +494,7 @@ tls:
491494
registry: gcr.io
492495
# username: john_doe
493496
# password: changeme
497+
securityContext: {}
494498

495499
networkPolicy:
496500
enabled: false
@@ -521,3 +525,5 @@ iap:
521525
# Create Google Cloud OAuth credentials and set client id and secret
522526
# clientId:
523527
# clientSecret:
528+
529+
securityContext: {}

0 commit comments

Comments
 (0)