Skip to content

Commit fe410e4

Browse files
alex-aricaalex-arica
authored
Merge pull request #178 from CasperGN/ContainerSecurityContext
Add support for Container SecurityContext to enable Kubegres to run in pod security standard enforced namespace
2 parents fe7cc2b + fd9e7c9 commit fe410e4

File tree

10 files changed

+902
-71
lines changed

10 files changed

+902
-71
lines changed

Diff for: ‎api/v1/kubegres_types.go

+16-15
Original file line numberDiff line numberDiff line change
@@ -62,21 +62,22 @@ type Probe struct {
6262
}
6363

6464
type KubegresSpec struct {
65-
Replicas *int32 `json:"replicas,omitempty"`
66-
Image string `json:"image,omitempty"`
67-
Port int32 `json:"port,omitempty"`
68-
ImagePullSecrets []v1.LocalObjectReference `json:"imagePullSecrets,omitempty"`
69-
CustomConfig string `json:"customConfig,omitempty"`
70-
Database KubegresDatabase `json:"database,omitempty"`
71-
Failover KubegresFailover `json:"failover,omitempty"`
72-
Backup KubegresBackUp `json:"backup,omitempty"`
73-
Env []v1.EnvVar `json:"env,omitempty"`
74-
Scheduler KubegresScheduler `json:"scheduler,omitempty"`
75-
Resources v1.ResourceRequirements `json:"resources,omitempty"`
76-
Volume Volume `json:"volume,omitempty"`
77-
SecurityContext *v1.PodSecurityContext `json:"securityContext,omitempty"`
78-
Probe Probe `json:"probe,omitempty"`
79-
ServiceAccountName string `json:"serviceAccountName,omitempty"`
65+
Replicas *int32 `json:"replicas,omitempty"`
66+
Image string `json:"image,omitempty"`
67+
Port int32 `json:"port,omitempty"`
68+
ImagePullSecrets []v1.LocalObjectReference `json:"imagePullSecrets,omitempty"`
69+
CustomConfig string `json:"customConfig,omitempty"`
70+
Database KubegresDatabase `json:"database,omitempty"`
71+
Failover KubegresFailover `json:"failover,omitempty"`
72+
Backup KubegresBackUp `json:"backup,omitempty"`
73+
Env []v1.EnvVar `json:"env,omitempty"`
74+
Scheduler KubegresScheduler `json:"scheduler,omitempty"`
75+
Resources v1.ResourceRequirements `json:"resources,omitempty"`
76+
Volume Volume `json:"volume,omitempty"`
77+
SecurityContext *v1.PodSecurityContext `json:"securityContext,omitempty"`
78+
ContainerSecurityContext *v1.SecurityContext `json:"containerSecurityContext,omitempty"`
79+
Probe Probe `json:"probe,omitempty"`
80+
ServiceAccountName string `json:"serviceAccountName,omitempty"`
8081
}
8182

8283
// ----------------------- STATUS -----------------------------------------

Diff for: ‎config/crd/bases/kubegres.reactive-tech.io_kubegres.yaml

+473-54
Large diffs are not rendered by default.

Diff for: ‎config/localresource/custom-namespace/kubegres.yaml

+17
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,23 @@ spec:
2828
# pvcName: backup
2929
# volumeMount: /tmp/mypostgres
3030

31+
#containerSecurityContext:
32+
# allowPrivilegeEscalation: false
33+
# capabilities:
34+
# drop:
35+
# - ALL
36+
# seccompProfile:
37+
# type: RuntimeDefault
38+
# runAsNonRoot: true
39+
# readOnlyRootFilesystem: false
40+
# privileged: false
41+
42+
#securityContext:
43+
# runAsUser: 1001
44+
# runAsGroup: 1001
45+
# fsGroup: 1001
46+
# runAsNonRoot: true
47+
3148
env:
3249
- name: POSTGRES_PASSWORD
3350
valueFrom:

Diff for: ‎config/localresource/custom-namespace/namespace.yaml

+3
Original file line numberDiff line numberDiff line change
@@ -2,3 +2,6 @@ apiVersion: v1
22
kind: Namespace
33
metadata:
44
name: custom
5+
#labels:
6+
# pod-security.kubernetes.io/enforce: restricted
7+
# pod-security.kubernetes.io/enforce-version: latest

Diff for: ‎go.mod

+2-2
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,10 @@ require (
77
github.com/lib/pq v1.10.9
88
github.com/onsi/ginkgo/v2 v2.11.0
99
github.com/onsi/gomega v1.27.10
10+
k8s.io/api v0.28.0
1011
k8s.io/apimachinery v0.28.0
1112
k8s.io/client-go v0.28.0
13+
k8s.io/utils v0.0.0-20230406110748-d93618cff8a2
1214
sigs.k8s.io/controller-runtime v0.16.0
1315
)
1416

@@ -62,12 +64,10 @@ require (
6264
gopkg.in/inf.v0 v0.9.1 // indirect
6365
gopkg.in/yaml.v2 v2.4.0 // indirect
6466
gopkg.in/yaml.v3 v3.0.1 // indirect
65-
k8s.io/api v0.28.0 // indirect
6667
k8s.io/apiextensions-apiserver v0.28.0 // indirect
6768
k8s.io/component-base v0.28.0 // indirect
6869
k8s.io/klog/v2 v2.100.1 // indirect
6970
k8s.io/kube-openapi v0.0.0-20230717233707-2695361300d9 // indirect
70-
k8s.io/utils v0.0.0-20230406110748-d93618cff8a2 // indirect
7171
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
7272
sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
7373
sigs.k8s.io/yaml v1.3.0 // indirect

Diff for: ‎go.sum

+45
Large diffs are not rendered by default.

Diff for: ‎internal/controller/ctx/resources/ResourcesContext.go

+2
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,7 @@ func addStatefulSetSpecEnforcers(rc *ResourcesContext) {
164164
tolerationsSpecEnforcer := statefulset_spec2.CreateTolerationsSpecEnforcer(rc.KubegresContext)
165165
resourcesSpecEnforcer := statefulset_spec2.CreateResourcesSpecEnforcer(rc.KubegresContext)
166166
volumeSpecEnforcer := statefulset_spec2.CreateVolumeSpecEnforcer(rc.KubegresContext)
167+
containerSecurityContextSpecEnforcer := statefulset_spec2.CreateContainerSecurityContextSpecEnforcer(rc.KubegresContext)
167168
securityContextSpecEnforcer := statefulset_spec2.CreateSecurityContextSpecEnforcer(rc.KubegresContext)
168169
livenessProbeSpecEnforcer := statefulset_spec2.CreateLivenessProbeSpecEnforcer(rc.KubegresContext)
169170
readinessProbeSpecEnforcer := statefulset_spec2.CreateReadinessProbeSpecEnforcer(rc.KubegresContext)
@@ -178,6 +179,7 @@ func addStatefulSetSpecEnforcers(rc *ResourcesContext) {
178179
rc.StatefulSetsSpecsEnforcer.AddSpecEnforcer(&tolerationsSpecEnforcer)
179180
rc.StatefulSetsSpecsEnforcer.AddSpecEnforcer(&resourcesSpecEnforcer)
180181
rc.StatefulSetsSpecsEnforcer.AddSpecEnforcer(&volumeSpecEnforcer)
182+
rc.StatefulSetsSpecsEnforcer.AddSpecEnforcer(&containerSecurityContextSpecEnforcer)
181183
rc.StatefulSetsSpecsEnforcer.AddSpecEnforcer(&securityContextSpecEnforcer)
182184
rc.StatefulSetsSpecsEnforcer.AddSpecEnforcer(&livenessProbeSpecEnforcer)
183185
rc.StatefulSetsSpecsEnforcer.AddSpecEnforcer(&readinessProbeSpecEnforcer)

Diff for: ‎internal/controller/spec/enforcer/statefulset_spec/ContainerSecurityContextSpecEnforcer.go

+56
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
package statefulset_spec
2+
3+
import (
4+
"reflect"
5+
6+
apps "k8s.io/api/apps/v1"
7+
v1 "k8s.io/api/core/v1"
8+
"reactive-tech.io/kubegres/internal/controller/ctx"
9+
)
10+
11+
type ContainerSecurityContextSpecEnforcer struct {
12+
KubegresContext ctx.KubegresContext
13+
}
14+
15+
func CreateContainerSecurityContextSpecEnforcer(kubegresContext ctx.KubegresContext) ContainerSecurityContextSpecEnforcer {
16+
return ContainerSecurityContextSpecEnforcer{KubegresContext: kubegresContext}
17+
}
18+
19+
func (r *ContainerSecurityContextSpecEnforcer) GetSpecName() string {
20+
return "ContainerSecurityContext"
21+
}
22+
23+
func (r *ContainerSecurityContextSpecEnforcer) CheckForSpecDifference(statefulSet *apps.StatefulSet) StatefulSetSpecDifference {
24+
current := statefulSet.Spec.Template.Spec.Containers[0].SecurityContext
25+
expected := r.KubegresContext.Kubegres.Spec.ContainerSecurityContext
26+
emptyContainerSecurityContext := &v1.SecurityContext{}
27+
28+
if expected == nil && reflect.DeepEqual(current, emptyContainerSecurityContext) {
29+
return StatefulSetSpecDifference{}
30+
}
31+
32+
if !reflect.DeepEqual(current, expected) {
33+
return StatefulSetSpecDifference{
34+
SpecName: r.GetSpecName(),
35+
Current: current.String(),
36+
Expected: expected.String(),
37+
}
38+
}
39+
40+
return StatefulSetSpecDifference{}
41+
}
42+
43+
func (r *ContainerSecurityContextSpecEnforcer) EnforceSpec(statefulSet *apps.StatefulSet) (wasSpecUpdated bool, err error) {
44+
45+
statefulSet.Spec.Template.Spec.Containers[0].SecurityContext = r.KubegresContext.Kubegres.Spec.ContainerSecurityContext
46+
47+
if len(statefulSet.Spec.Template.Spec.InitContainers) > 0 {
48+
statefulSet.Spec.Template.Spec.InitContainers[0].SecurityContext = r.KubegresContext.Kubegres.Spec.ContainerSecurityContext
49+
}
50+
51+
return true, nil
52+
}
53+
54+
func (r *ContainerSecurityContextSpecEnforcer) OnSpecEnforcedSuccessfully(statefulSet *apps.StatefulSet) error {
55+
return nil
56+
}

Diff for: ‎internal/controller/spec/template/ResourcesCreatorFromTemplate.go

+8
Original file line numberDiff line numberDiff line change
@@ -254,6 +254,14 @@ func (r *ResourcesCreatorFromTemplate) initStatefulSet(
254254
statefulSetTemplate.Spec.Template.Spec.Containers[0].VolumeMounts = append(statefulSetTemplate.Spec.Template.Spec.Containers[0].VolumeMounts, r.kubegresContext.Kubegres.Spec.Volume.VolumeMounts...)
255255
}
256256

257+
if postgresSpec.ContainerSecurityContext != nil {
258+
statefulSetTemplate.Spec.Template.Spec.Containers[0].SecurityContext = postgresSpec.ContainerSecurityContext
259+
260+
if len(statefulSetTemplate.Spec.Template.Spec.InitContainers) > 0 {
261+
statefulSetTemplate.Spec.Template.Spec.InitContainers[0].SecurityContext = postgresSpec.ContainerSecurityContext
262+
}
263+
}
264+
257265
if postgresSpec.SecurityContext != nil {
258266
statefulSetTemplate.Spec.Template.Spec.SecurityContext = postgresSpec.SecurityContext
259267
}

0 commit comments

Comments
 (0)