Skip to content

Commit 2bd002e

Browse files
ajanikowajanikow
authored
[Feature] Expose core.PodSecurityContext Sysctl options (#1360)
1 parent 8b6395a commit 2bd002e

11 files changed

+439
-88
lines changed

‎.gitattributes

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,3 @@
11
pkg/generated/** linguist-generated
2-
**/zz_generated.deepcopy.go linguist-generated
2+
**/zz_generated.deepcopy.go linguist-generated
3+
pkg/api/** linguist-generated

‎CHANGELOG.md

+1
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
- (Feature) Backup lifetime - remove Backup once its lifetime has been reached
55
- (Feature) Add Feature dependency
66
- (Feature) Run secured containers as a feature
7+
- (Feature) Expose core.PodSecurityContext Sysctl options
78

89
## [1.2.31](https://github.com/arangodb/kube-arangodb/tree/1.2.31) (2023-07-14)
910
- (Improvement) Block traffic on the services if there is more than 1 active leader in ActiveFailover mode

‎docs/api/ArangoDeployment.V1.md

+231-84
Large diffs are not rendered by default.

‎pkg/apis/deployment/v1/server_group_security_context_spec.go

+34
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,10 @@
2121
package v1
2222

2323
import (
24+
"sort"
25+
2426
core "k8s.io/api/core/v1"
27+
"k8s.io/apimachinery/pkg/util/intstr"
2528

2629
"github.com/arangodb/kube-arangodb/pkg/util"
2730
)
@@ -51,6 +54,17 @@ type ServerGroupSpecSecurityContext struct {
5154
SupplementalGroups []int64 `json:"supplementalGroups,omitempty"`
5255
FSGroup *int64 `json:"fsGroup,omitempty"`
5356

57+
// Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
58+
// sysctls (by the container runtime) might fail to launch.
59+
// Map Value can be String or Int
60+
// +doc/example: sysctls:
61+
// +doc/example: "kernel.shm_rmid_forced": "0"
62+
// +doc/example: "net.core.somaxconn": 1024
63+
// +doc/example: "kernel.msgmax": "65536"
64+
// +doc/type: map[string]intstr.IntOrString
65+
// +doc/link: Documentation|https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/
66+
Sysctls map[string]intstr.IntOrString `json:"sysctls,omitempty"`
67+
5468
// SeccompProfile defines a pod/container's seccomp profile settings. Only one profile source may be set.
5569
// +doc/type: core.SeccompProfile
5670
// +doc/link: Documentation of core.SeccompProfile|https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.26/#seccompprofile-v1-core
@@ -96,6 +110,26 @@ func (s *ServerGroupSpecSecurityContext) NewPodSecurityContext(secured bool) *co
96110
}
97111
}
98112

113+
if s != nil && len(s.Sysctls) > 0 {
114+
var sysctls []core.Sysctl
115+
for k, v := range s.Sysctls {
116+
sysctls = append(sysctls, core.Sysctl{
117+
Name: k,
118+
Value: v.String(),
119+
})
120+
}
121+
122+
sort.Slice(sysctls, func(i, j int) bool {
123+
return sysctls[i].Name < sysctls[j].Name
124+
})
125+
126+
if psc == nil {
127+
psc = &core.PodSecurityContext{}
128+
}
129+
130+
psc.Sysctls = sysctls
131+
}
132+
99133
if secured {
100134
if psc == nil {
101135
psc = &core.PodSecurityContext{}

‎pkg/apis/deployment/v1/server_group_security_context_spec_test.go

+59
Original file line numberDiff line numberDiff line change
@@ -21,10 +21,13 @@
2121
package v1
2222

2323
import (
24+
"encoding/json"
2425
"testing"
2526

2627
"github.com/stretchr/testify/assert"
28+
"github.com/stretchr/testify/require"
2729
core "k8s.io/api/core/v1"
30+
"k8s.io/apimachinery/pkg/util/intstr"
2831

2932
"github.com/arangodb/kube-arangodb/pkg/util"
3033
)
@@ -76,6 +79,27 @@ func TestServerGroupSpecSecurityContext_NewPodSecurityContext(t *testing.T) {
7679
SupplementalGroups: []int64{1},
7780
},
7881
},
82+
"pass sysctl opts": {
83+
sc: &ServerGroupSpecSecurityContext{
84+
Sysctls: map[string]intstr.IntOrString{
85+
"opt.1": intstr.FromInt(1),
86+
"opt.2": intstr.FromString("2"),
87+
},
88+
},
89+
secured: false,
90+
want: &core.PodSecurityContext{
91+
Sysctls: []core.Sysctl{
92+
{
93+
Name: "opt.1",
94+
Value: "1",
95+
},
96+
{
97+
Name: "opt.2",
98+
Value: "2",
99+
},
100+
},
101+
},
102+
},
79103
}
80104

81105
for testName, testCase := range testCases {
@@ -86,6 +110,41 @@ func TestServerGroupSpecSecurityContext_NewPodSecurityContext(t *testing.T) {
86110
}
87111
}
88112

113+
func TestServerGroupSpecSecurityContext_NewPodSecurityContextFromJSON(t *testing.T) {
114+
testCases := map[string]struct {
115+
sc string
116+
secured bool
117+
want *core.PodSecurityContext
118+
}{
119+
"pass sysctl opts": {
120+
sc: `{"sysctls":{"opt.1":1, "opt.2":"2"}}`,
121+
secured: false,
122+
want: &core.PodSecurityContext{
123+
Sysctls: []core.Sysctl{
124+
{
125+
Name: "opt.1",
126+
Value: "1",
127+
},
128+
{
129+
Name: "opt.2",
130+
Value: "2",
131+
},
132+
},
133+
},
134+
},
135+
}
136+
137+
for testName, testCase := range testCases {
138+
t.Run(testName, func(t *testing.T) {
139+
var p ServerGroupSpecSecurityContext
140+
require.NoError(t, json.Unmarshal([]byte(testCase.sc), &p))
141+
142+
actual := p.NewPodSecurityContext(testCase.secured)
143+
assert.Equalf(t, testCase.want, actual, "NewPodSecurityContext(%v)", testCase.secured)
144+
})
145+
}
146+
}
147+
89148
func TestServerGroupSpecSecurityContext_NewSecurityContext(t *testing.T) {
90149
tests := map[string]struct {
91150
sc *ServerGroupSpecSecurityContext

‎pkg/apis/deployment/v1/timeouts.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
//
22
// DISCLAIMER
33
//
4-
// Copyright 2016-2022 ArangoDB GmbH, Cologne, Germany
4+
// Copyright 2016-2023 ArangoDB GmbH, Cologne, Germany
55
//
66
// Licensed under the Apache License, Version 2.0 (the "License");
77
// you may not use this file except in compliance with the License.

‎pkg/apis/deployment/v1/zz_generated.deepcopy.go

+8
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/apis/deployment/v2alpha1/server_group_security_context_spec.go

+34
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,10 @@
2121
package v2alpha1
2222

2323
import (
24+
"sort"
25+
2426
core "k8s.io/api/core/v1"
27+
"k8s.io/apimachinery/pkg/util/intstr"
2528

2629
"github.com/arangodb/kube-arangodb/pkg/util"
2730
)
@@ -51,6 +54,17 @@ type ServerGroupSpecSecurityContext struct {
5154
SupplementalGroups []int64 `json:"supplementalGroups,omitempty"`
5255
FSGroup *int64 `json:"fsGroup,omitempty"`
5356

57+
// Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported
58+
// sysctls (by the container runtime) might fail to launch.
59+
// Map Value can be String or Int
60+
// +doc/example: sysctls:
61+
// +doc/example: "kernel.shm_rmid_forced": "0"
62+
// +doc/example: "net.core.somaxconn": 1024
63+
// +doc/example: "kernel.msgmax": "65536"
64+
// +doc/type: map[string]intstr.IntOrString
65+
// +doc/link: Documentation|https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/
66+
Sysctls map[string]intstr.IntOrString `json:"sysctls,omitempty"`
67+
5468
// SeccompProfile defines a pod/container's seccomp profile settings. Only one profile source may be set.
5569
// +doc/type: core.SeccompProfile
5670
// +doc/link: Documentation of core.SeccompProfile|https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.26/#seccompprofile-v1-core
@@ -96,6 +110,26 @@ func (s *ServerGroupSpecSecurityContext) NewPodSecurityContext(secured bool) *co
96110
}
97111
}
98112

113+
if s != nil && len(s.Sysctls) > 0 {
114+
var sysctls []core.Sysctl
115+
for k, v := range s.Sysctls {
116+
sysctls = append(sysctls, core.Sysctl{
117+
Name: k,
118+
Value: v.String(),
119+
})
120+
}
121+
122+
sort.Slice(sysctls, func(i, j int) bool {
123+
return sysctls[i].Name < sysctls[j].Name
124+
})
125+
126+
if psc == nil {
127+
psc = &core.PodSecurityContext{}
128+
}
129+
130+
psc.Sysctls = sysctls
131+
}
132+
99133
if secured {
100134
if psc == nil {
101135
psc = &core.PodSecurityContext{}

‎pkg/apis/deployment/v2alpha1/server_group_security_context_spec_test.go

+59
Original file line numberDiff line numberDiff line change
@@ -21,10 +21,13 @@
2121
package v2alpha1
2222

2323
import (
24+
"encoding/json"
2425
"testing"
2526

2627
"github.com/stretchr/testify/assert"
28+
"github.com/stretchr/testify/require"
2729
core "k8s.io/api/core/v1"
30+
"k8s.io/apimachinery/pkg/util/intstr"
2831

2932
"github.com/arangodb/kube-arangodb/pkg/util"
3033
)
@@ -76,6 +79,27 @@ func TestServerGroupSpecSecurityContext_NewPodSecurityContext(t *testing.T) {
7679
SupplementalGroups: []int64{1},
7780
},
7881
},
82+
"pass sysctl opts": {
83+
sc: &ServerGroupSpecSecurityContext{
84+
Sysctls: map[string]intstr.IntOrString{
85+
"opt.1": intstr.FromInt(1),
86+
"opt.2": intstr.FromString("2"),
87+
},
88+
},
89+
secured: false,
90+
want: &core.PodSecurityContext{
91+
Sysctls: []core.Sysctl{
92+
{
93+
Name: "opt.1",
94+
Value: "1",
95+
},
96+
{
97+
Name: "opt.2",
98+
Value: "2",
99+
},
100+
},
101+
},
102+
},
79103
}
80104

81105
for testName, testCase := range testCases {
@@ -86,6 +110,41 @@ func TestServerGroupSpecSecurityContext_NewPodSecurityContext(t *testing.T) {
86110
}
87111
}
88112

113+
func TestServerGroupSpecSecurityContext_NewPodSecurityContextFromJSON(t *testing.T) {
114+
testCases := map[string]struct {
115+
sc string
116+
secured bool
117+
want *core.PodSecurityContext
118+
}{
119+
"pass sysctl opts": {
120+
sc: `{"sysctls":{"opt.1":1, "opt.2":"2"}}`,
121+
secured: false,
122+
want: &core.PodSecurityContext{
123+
Sysctls: []core.Sysctl{
124+
{
125+
Name: "opt.1",
126+
Value: "1",
127+
},
128+
{
129+
Name: "opt.2",
130+
Value: "2",
131+
},
132+
},
133+
},
134+
},
135+
}
136+
137+
for testName, testCase := range testCases {
138+
t.Run(testName, func(t *testing.T) {
139+
var p ServerGroupSpecSecurityContext
140+
require.NoError(t, json.Unmarshal([]byte(testCase.sc), &p))
141+
142+
actual := p.NewPodSecurityContext(testCase.secured)
143+
assert.Equalf(t, testCase.want, actual, "NewPodSecurityContext(%v)", testCase.secured)
144+
})
145+
}
146+
}
147+
89148
func TestServerGroupSpecSecurityContext_NewSecurityContext(t *testing.T) {
90149
tests := map[string]struct {
91150
sc *ServerGroupSpecSecurityContext

‎pkg/apis/deployment/v2alpha1/timeouts.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
//
22
// DISCLAIMER
33
//
4-
// Copyright 2016-2022 ArangoDB GmbH, Cologne, Germany
4+
// Copyright 2016-2023 ArangoDB GmbH, Cologne, Germany
55
//
66
// Licensed under the Apache License, Version 2.0 (the "License");
77
// you may not use this file except in compliance with the License.
@@ -35,7 +35,7 @@ type Timeouts struct {
3535
// MaintenanceGracePeriod action timeout
3636
MaintenanceGracePeriod *Timeout `json:"maintenanceGracePeriod,omitempty"`
3737

38-
// Actions keep list of the actions timeouts.
38+
// Actions keep map of the actions timeouts.
3939
// +doc/type: map[string]meta.Duration
4040
// +doc/link: List of supported action names|/docs/generated/actions.md
4141
// +doc/link: Definition of meta.Duration|https://github.com/kubernetes/apimachinery/blob/v0.26.6/pkg/apis/meta/v1/duration.go

‎pkg/apis/deployment/v2alpha1/zz_generated.deepcopy.go

+8
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)