Skip to content

Commit 7cb8747

Browse files
author
OpenShift Bot
authored
Merge pull request #12951 from mfojtik/registry-groups
Merged by openshift-bot
2 parents a56aa94 + ef3fc41 commit 7cb8747

File tree

7 files changed

+76
-0
lines changed

7 files changed

+76
-0
lines changed

‎contrib/completions/bash/oadm

+4
Original file line numberDiff line numberDiff line change
@@ -4669,6 +4669,8 @@ _oadm_registry()
46694669
local_nonpersistent_flags+=("--dry-run")
46704670
flags+=("--enforce-quota")
46714671
local_nonpersistent_flags+=("--enforce-quota")
4672+
flags+=("--fs-group=")
4673+
local_nonpersistent_flags+=("--fs-group=")
46724674
flags+=("--images=")
46734675
local_nonpersistent_flags+=("--images=")
46744676
flags+=("--labels=")
@@ -4690,6 +4692,8 @@ _oadm_registry()
46904692
local_nonpersistent_flags+=("--selector=")
46914693
flags+=("--service-account=")
46924694
local_nonpersistent_flags+=("--service-account=")
4695+
flags+=("--supplemental-groups=")
4696+
local_nonpersistent_flags+=("--supplemental-groups=")
46934697
flags+=("--tls-certificate=")
46944698
local_nonpersistent_flags+=("--tls-certificate=")
46954699
flags+=("--tls-key=")

‎contrib/completions/bash/oc

+4
Original file line numberDiff line numberDiff line change
@@ -4674,6 +4674,8 @@ _oc_adm_registry()
46744674
local_nonpersistent_flags+=("--dry-run")
46754675
flags+=("--enforce-quota")
46764676
local_nonpersistent_flags+=("--enforce-quota")
4677+
flags+=("--fs-group=")
4678+
local_nonpersistent_flags+=("--fs-group=")
46774679
flags+=("--images=")
46784680
local_nonpersistent_flags+=("--images=")
46794681
flags+=("--labels=")
@@ -4695,6 +4697,8 @@ _oc_adm_registry()
46954697
local_nonpersistent_flags+=("--selector=")
46964698
flags+=("--service-account=")
46974699
local_nonpersistent_flags+=("--service-account=")
4700+
flags+=("--supplemental-groups=")
4701+
local_nonpersistent_flags+=("--supplemental-groups=")
46984702
flags+=("--tls-certificate=")
46994703
local_nonpersistent_flags+=("--tls-certificate=")
47004704
flags+=("--tls-key=")

‎contrib/completions/bash/openshift

+8
Original file line numberDiff line numberDiff line change
@@ -4669,6 +4669,8 @@ _openshift_admin_registry()
46694669
local_nonpersistent_flags+=("--dry-run")
46704670
flags+=("--enforce-quota")
46714671
local_nonpersistent_flags+=("--enforce-quota")
4672+
flags+=("--fs-group=")
4673+
local_nonpersistent_flags+=("--fs-group=")
46724674
flags+=("--images=")
46734675
local_nonpersistent_flags+=("--images=")
46744676
flags+=("--labels=")
@@ -4690,6 +4692,8 @@ _openshift_admin_registry()
46904692
local_nonpersistent_flags+=("--selector=")
46914693
flags+=("--service-account=")
46924694
local_nonpersistent_flags+=("--service-account=")
4695+
flags+=("--supplemental-groups=")
4696+
local_nonpersistent_flags+=("--supplemental-groups=")
46934697
flags+=("--tls-certificate=")
46944698
local_nonpersistent_flags+=("--tls-certificate=")
46954699
flags+=("--tls-key=")
@@ -9752,6 +9756,8 @@ _openshift_cli_adm_registry()
97529756
local_nonpersistent_flags+=("--dry-run")
97539757
flags+=("--enforce-quota")
97549758
local_nonpersistent_flags+=("--enforce-quota")
9759+
flags+=("--fs-group=")
9760+
local_nonpersistent_flags+=("--fs-group=")
97559761
flags+=("--images=")
97569762
local_nonpersistent_flags+=("--images=")
97579763
flags+=("--labels=")
@@ -9773,6 +9779,8 @@ _openshift_cli_adm_registry()
97739779
local_nonpersistent_flags+=("--selector=")
97749780
flags+=("--service-account=")
97759781
local_nonpersistent_flags+=("--service-account=")
9782+
flags+=("--supplemental-groups=")
9783+
local_nonpersistent_flags+=("--supplemental-groups=")
97769784
flags+=("--tls-certificate=")
97779785
local_nonpersistent_flags+=("--tls-certificate=")
97789786
flags+=("--tls-key=")

‎contrib/completions/zsh/oadm

+4
Original file line numberDiff line numberDiff line change
@@ -4817,6 +4817,8 @@ _oadm_registry()
48174817
local_nonpersistent_flags+=("--dry-run")
48184818
flags+=("--enforce-quota")
48194819
local_nonpersistent_flags+=("--enforce-quota")
4820+
flags+=("--fs-group=")
4821+
local_nonpersistent_flags+=("--fs-group=")
48204822
flags+=("--images=")
48214823
local_nonpersistent_flags+=("--images=")
48224824
flags+=("--labels=")
@@ -4838,6 +4840,8 @@ _oadm_registry()
48384840
local_nonpersistent_flags+=("--selector=")
48394841
flags+=("--service-account=")
48404842
local_nonpersistent_flags+=("--service-account=")
4843+
flags+=("--supplemental-groups=")
4844+
local_nonpersistent_flags+=("--supplemental-groups=")
48414845
flags+=("--tls-certificate=")
48424846
local_nonpersistent_flags+=("--tls-certificate=")
48434847
flags+=("--tls-key=")

‎contrib/completions/zsh/oc

+4
Original file line numberDiff line numberDiff line change
@@ -4822,6 +4822,8 @@ _oc_adm_registry()
48224822
local_nonpersistent_flags+=("--dry-run")
48234823
flags+=("--enforce-quota")
48244824
local_nonpersistent_flags+=("--enforce-quota")
4825+
flags+=("--fs-group=")
4826+
local_nonpersistent_flags+=("--fs-group=")
48254827
flags+=("--images=")
48264828
local_nonpersistent_flags+=("--images=")
48274829
flags+=("--labels=")
@@ -4843,6 +4845,8 @@ _oc_adm_registry()
48434845
local_nonpersistent_flags+=("--selector=")
48444846
flags+=("--service-account=")
48454847
local_nonpersistent_flags+=("--service-account=")
4848+
flags+=("--supplemental-groups=")
4849+
local_nonpersistent_flags+=("--supplemental-groups=")
48464850
flags+=("--tls-certificate=")
48474851
local_nonpersistent_flags+=("--tls-certificate=")
48484852
flags+=("--tls-key=")

‎contrib/completions/zsh/openshift

+8
Original file line numberDiff line numberDiff line change
@@ -4817,6 +4817,8 @@ _openshift_admin_registry()
48174817
local_nonpersistent_flags+=("--dry-run")
48184818
flags+=("--enforce-quota")
48194819
local_nonpersistent_flags+=("--enforce-quota")
4820+
flags+=("--fs-group=")
4821+
local_nonpersistent_flags+=("--fs-group=")
48204822
flags+=("--images=")
48214823
local_nonpersistent_flags+=("--images=")
48224824
flags+=("--labels=")
@@ -4838,6 +4840,8 @@ _openshift_admin_registry()
48384840
local_nonpersistent_flags+=("--selector=")
48394841
flags+=("--service-account=")
48404842
local_nonpersistent_flags+=("--service-account=")
4843+
flags+=("--supplemental-groups=")
4844+
local_nonpersistent_flags+=("--supplemental-groups=")
48414845
flags+=("--tls-certificate=")
48424846
local_nonpersistent_flags+=("--tls-certificate=")
48434847
flags+=("--tls-key=")
@@ -9900,6 +9904,8 @@ _openshift_cli_adm_registry()
99009904
local_nonpersistent_flags+=("--dry-run")
99019905
flags+=("--enforce-quota")
99029906
local_nonpersistent_flags+=("--enforce-quota")
9907+
flags+=("--fs-group=")
9908+
local_nonpersistent_flags+=("--fs-group=")
99039909
flags+=("--images=")
99049910
local_nonpersistent_flags+=("--images=")
99059911
flags+=("--labels=")
@@ -9921,6 +9927,8 @@ _openshift_cli_adm_registry()
99219927
local_nonpersistent_flags+=("--selector=")
99229928
flags+=("--service-account=")
99239929
local_nonpersistent_flags+=("--service-account=")
9930+
flags+=("--supplemental-groups=")
9931+
local_nonpersistent_flags+=("--supplemental-groups=")
99249932
flags+=("--tls-certificate=")
99259933
local_nonpersistent_flags+=("--tls-certificate=")
99269934
flags+=("--tls-key=")

‎pkg/cmd/admin/registry/registry.go

+44
Original file line numberDiff line numberDiff line change
@@ -108,6 +108,11 @@ type RegistryConfig struct {
108108
DaemonSet bool
109109
EnforceQuota bool
110110

111+
// SupplementalGroups is list of int64, however cobra does not have appropriate func
112+
// for that type list.
113+
SupplementalGroups []string
114+
FSGroup string
115+
111116
ServingCertPath string
112117
ServingKeyPath string
113118

@@ -181,6 +186,8 @@ func NewCmdRegistry(f *clientcmd.Factory, parentName, name string, out, errout i
181186
cmd.Flags().StringVar(&cfg.Selector, "selector", cfg.Selector, "Selector used to filter nodes on deployment. Used to run registries on a specific set of nodes.")
182187
cmd.Flags().StringVar(&cfg.ServingCertPath, "tls-certificate", cfg.ServingCertPath, "An optional path to a PEM encoded certificate (which may contain the private key) for serving over TLS")
183188
cmd.Flags().StringVar(&cfg.ServingKeyPath, "tls-key", cfg.ServingKeyPath, "An optional path to a PEM encoded private key for serving over TLS")
189+
cmd.Flags().StringSliceVar(&cfg.SupplementalGroups, "supplemental-groups", cfg.SupplementalGroups, "Specify supplemental groups which is an array of ID's that grants group access to registry shared storage")
190+
cmd.Flags().StringVar(&cfg.FSGroup, "fs-group", "", "Specify fsGroup which is an ID that grants group access to registry block storage")
184191
cmd.Flags().BoolVar(&cfg.DaemonSet, "daemonset", cfg.DaemonSet, "If true, use a daemonset instead of a deployment config.")
185192
cmd.Flags().BoolVar(&cfg.EnforceQuota, "enforce-quota", cfg.EnforceQuota, "If true, the registry will refuse to write blobs if they exceed quota limits")
186193

@@ -224,6 +231,23 @@ func (opts *RegistryOptions) Complete(f *clientcmd.Factory, cmd *cobra.Command,
224231
opts.nodeSelector = valid
225232
}
226233

234+
if len(opts.Config.FSGroup) > 0 {
235+
if _, err := strconv.ParseInt(opts.Config.FSGroup, 10, 64); err != nil {
236+
return kcmdutil.UsageError(cmd, "invalid group ID %q specified for fsGroup (%v)", opts.Config.FSGroup, err)
237+
}
238+
}
239+
240+
if len(opts.Config.SupplementalGroups) > 0 {
241+
for _, v := range opts.Config.SupplementalGroups {
242+
if val, err := strconv.ParseInt(v, 10, 64); err != nil || val == 0 {
243+
return kcmdutil.UsageError(cmd, "invalid group ID %q specified for supplemental group (%v)", v, err)
244+
}
245+
}
246+
}
247+
if len(opts.Config.SupplementalGroups) > 0 && len(opts.Config.FSGroup) > 0 {
248+
return kcmdutil.UsageError(cmd, "fsGroup and supplemental groups cannot be specified both at the same time")
249+
}
250+
227251
var portsErr error
228252
if opts.ports, portsErr = app.ContainerPortsFromString(opts.Config.Ports); portsErr != nil {
229253
return portsErr
@@ -356,6 +380,7 @@ func (opts *RegistryOptions) RunCmdRegistry() error {
356380
VolumeSource: kapi.VolumeSource{},
357381
}),
358382
ServiceAccountName: opts.Config.ServiceAccount,
383+
SecurityContext: generateSecurityContext(opts.Config),
359384
},
360385
}
361386
if mountHost {
@@ -544,3 +569,22 @@ func generateSecretsConfig(
544569

545570
return secrets, volumes, mounts, extraEnv, len(defaultCrt) > 0, nil
546571
}
572+
573+
func generateSecurityContext(conf *RegistryConfig) *kapi.PodSecurityContext {
574+
result := &kapi.PodSecurityContext{}
575+
if len(conf.SupplementalGroups) > 0 {
576+
result.SupplementalGroups = []int64{}
577+
for _, val := range conf.SupplementalGroups {
578+
// The errors are handled by Complete()
579+
if groupID, err := strconv.ParseInt(val, 10, 64); err == nil {
580+
result.SupplementalGroups = append(result.SupplementalGroups, groupID)
581+
}
582+
}
583+
}
584+
if len(conf.FSGroup) > 0 {
585+
if groupID, err := strconv.ParseInt(conf.FSGroup, 10, 64); err == nil {
586+
result.FSGroup = &groupID
587+
}
588+
}
589+
return result
590+
}

0 commit comments

Comments
 (0)