Skip to content

Commit b60c2db

Browse files
ianrobertsianroberts
committed
[bitnami/elasticsearch] remove copyTlsCerts init container
Remove the initContainer that copies TLS certificates from the secret to the emptyDir volume and revert to mounting the secret directly into the various statefulset pods. This fixes #31872, but will break #25280 until bitnami/containers#77525 is fixed Signed-off-by: Ian Roberts <[email protected]>
1 parent 9d1b911 commit b60c2db

File tree

8 files changed

+10
-209
lines changed

8 files changed

+10
-209
lines changed

‎bitnami/elasticsearch/README.md

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -952,13 +952,6 @@ You can enable this initContainer by setting `volumePermissions.enabled` to `tru
952952
| `sysctlImage.pullSecrets` | Kernel settings modifier image pull secrets | `[]` |
953953
| `sysctlImage.resourcesPreset` | Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if sysctlImage.resources is set (sysctlImage.resources is recommended for production). | `nano` |
954954
| `sysctlImage.resources` | Set container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` |
955-
| `copyTlsCerts.image.registry` | Copy TLS certificates image registry | `REGISTRY_NAME` |
956-
| `copyTlsCerts.image.repository` | Copy TLS certificates image repository | `REPOSITORY_NAME/os-shell` |
957-
| `copyTlsCerts.image.digest` | Copy TLS certificates image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` |
958-
| `copyTlsCerts.image.pullPolicy` | Copy TLS certificates image pull policy | `IfNotPresent` |
959-
| `copyTlsCerts.image.pullSecrets` | Copy TLS certificates image pull secrets | `[]` |
960-
| `copyTlsCerts.resourcesPreset` | Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if copyTlsCerts.resources is set (copyTlsCerts.resources is recommended for production). | `nano` |
961-
| `copyTlsCerts.resources` | Set container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` |
962955

963956
### Kibana Parameters
964957

‎bitnami/elasticsearch/templates/NOTES.txt

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -135,11 +135,10 @@ In order to replicate the container startup scripts execute this command:
135135

136136
{{- include "common.warnings.rollingTag" .Values.image }}
137137
{{- include "common.warnings.rollingTag" .Values.volumePermissions.image }}
138-
{{- include "common.warnings.rollingTag" .Values.copyTlsCerts.image }}
139138
{{- include "common.warnings.rollingTag" .Values.sysctlImage }}
140139

141140
{{- end }}
142141
{{ include "elasticsearch.validateValues" . }}
143-
{{- include "common.warnings.resources" (dict "sections" (list "coordinating" "copyTlsCerts" "data" "ingest" "master" "metrics" "sysctlImage" "volumePermissions") "context" $) }}
144-
{{- include "common.warnings.modifiedImages" (dict "images" (list .Values.image .Values.copyTlsCerts.image .Values.metrics.image .Values.volumePermissions.image .Values.sysctlImage ) "context" $) }}
145-
{{- include "common.errors.insecureImages" (dict "images" (list .Values.image .Values.copyTlsCerts.image .Values.metrics.image .Values.volumePermissions.image .Values.sysctlImage ) "context" $) }}
142+
{{- include "common.warnings.resources" (dict "sections" (list "coordinating" "data" "ingest" "master" "metrics" "sysctlImage" "volumePermissions") "context" $) }}
143+
{{- include "common.warnings.modifiedImages" (dict "images" (list .Values.image .Values.metrics.image .Values.volumePermissions.image .Values.sysctlImage ) "context" $) }}
144+
{{- include "common.errors.insecureImages" (dict "images" (list .Values.image .Values.metrics.image .Values.volumePermissions.image .Values.sysctlImage ) "context" $) }}

‎bitnami/elasticsearch/templates/_helpers.tpl

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -40,13 +40,6 @@ Return the proper image name (for the init container volume-permissions image)
4040
{{ include "common.images.image" (dict "imageRoot" .Values.volumePermissions.image "global" .Values.global) }}
4141
{{- end -}}
4242

43-
{{/*
44-
Return the proper Copy TLS Certificates image name
45-
*/}}
46-
{{- define "elasticsearch.copyTlsCerts.image" -}}
47-
{{ include "common.images.image" (dict "imageRoot" .Values.copyTlsCerts.image "global" .Values.global) }}
48-
{{- end -}}
49-
5043
{{/*
5144
Name for the Elasticsearch service
5245
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).

‎bitnami/elasticsearch/templates/coordinating/statefulset.yaml

Lines changed: 2 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -105,40 +105,6 @@ spec:
105105
resources: {{- include "common.resources.preset" (dict "type" .Values.sysctlImage.resourcesPreset) | nindent 12 }}
106106
{{- end }}
107107
{{- end }}
108-
{{- if .Values.security.enabled }}
109-
- name: copy-tls-certificates
110-
image: {{ include "elasticsearch.copyTlsCerts.image" . }}
111-
imagePullPolicy: {{ .Values.copyTlsCerts.image.pullPolicy | quote }}
112-
command:
113-
- /bin/sh
114-
- -c
115-
- |
116-
ls -l /
117-
ls -l /certs
118-
for file in /certs/*; do
119-
if [ -f "$file" ]; then
120-
filename=$(basename "$file")
121-
dst_file="/tmp/$filename"
122-
cat "$file" > "$dst_file"
123-
echo "Copied $file to $dst_file"
124-
fi
125-
done
126-
echo "All files have been copied."
127-
volumeMounts:
128-
- name: elasticsearch-certificates
129-
mountPath: /certs
130-
- name: empty-dir
131-
mountPath: /tmp
132-
subPath: certs
133-
{{- if .Values.coordinating.containerSecurityContext.enabled }}
134-
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.coordinating.containerSecurityContext "context" $) | nindent 12 }}
135-
{{- end }}
136-
{{- if .Values.copyTlsCerts.resources }}
137-
resources: {{- toYaml .Values.copyTlsCerts.resources | nindent 12 }}
138-
{{- else if ne .Values.copyTlsCerts.resourcesPreset "none" }}
139-
resources: {{- include "common.resources.preset" (dict "type" .Values.copyTlsCerts.resourcesPreset) | nindent 12 }}
140-
{{- end }}
141-
{{- end }}
142108
- name: copy-default-plugins
143109
image: {{ include "elasticsearch.image" . }}
144110
imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
@@ -328,9 +294,9 @@ spec:
328294
subPath: my_elasticsearch.yml
329295
{{- end }}
330296
{{- if .Values.security.enabled }}
331-
- name: empty-dir
297+
- name: elasticsearch-certificates
332298
mountPath: /opt/bitnami/elasticsearch/config/certs
333-
subPath: certs
299+
readOnly: true
334300
{{- end }}
335301
{{- if .Values.initScripts }}
336302
- name: custom-init-scripts

‎bitnami/elasticsearch/templates/data/statefulset.yaml

Lines changed: 2 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -130,40 +130,6 @@ spec:
130130
- name: data
131131
mountPath: /bitnami/elasticsearch/data
132132
{{- end }}
133-
{{- if .Values.security.enabled }}
134-
- name: copy-tls-certificates
135-
image: {{ include "elasticsearch.copyTlsCerts.image" . }}
136-
imagePullPolicy: {{ .Values.copyTlsCerts.image.pullPolicy | quote }}
137-
command:
138-
- /bin/sh
139-
- -c
140-
- |
141-
ls -l /
142-
ls -l /certs
143-
for file in /certs/*; do
144-
if [ -f "$file" ]; then
145-
filename=$(basename "$file")
146-
dst_file="/tmp/$filename"
147-
cat "$file" > "$dst_file"
148-
echo "Copied $file to $dst_file"
149-
fi
150-
done
151-
echo "All files have been copied."
152-
volumeMounts:
153-
- name: elasticsearch-certificates
154-
mountPath: /certs
155-
- name: empty-dir
156-
mountPath: /tmp
157-
subPath: certs
158-
{{- if .Values.data.containerSecurityContext.enabled }}
159-
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.data.containerSecurityContext "context" $) | nindent 12 }}
160-
{{- end }}
161-
{{- if .Values.copyTlsCerts.resources }}
162-
resources: {{- toYaml .Values.copyTlsCerts.resources | nindent 12 }}
163-
{{- else if ne .Values.copyTlsCerts.resourcesPreset "none" }}
164-
resources: {{- include "common.resources.preset" (dict "type" .Values.copyTlsCerts.resourcesPreset) | nindent 12 }}
165-
{{- end }}
166-
{{- end }}
167133
- name: copy-default-plugins
168134
image: {{ include "elasticsearch.image" . }}
169135
imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
@@ -357,9 +323,9 @@ spec:
357323
subPath: my_elasticsearch.yml
358324
{{- end }}
359325
{{- if .Values.security.enabled }}
360-
- name: empty-dir
326+
- name: elasticsearch-certificates
361327
mountPath: /opt/bitnami/elasticsearch/config/certs
362-
subPath: certs
328+
readOnly: true
363329
{{- end }}
364330
{{- if .Values.initScripts }}
365331
- name: custom-init-scripts

‎bitnami/elasticsearch/templates/ingest/statefulset.yaml

Lines changed: 2 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -105,40 +105,6 @@ spec:
105105
resources: {{- include "common.resources.preset" (dict "type" .Values.sysctlImage.resourcesPreset) | nindent 12 }}
106106
{{- end }}
107107
{{- end }}
108-
{{- if .Values.security.enabled }}
109-
- name: copy-tls-certificates
110-
image: {{ include "elasticsearch.copyTlsCerts.image" . }}
111-
imagePullPolicy: {{ .Values.copyTlsCerts.image.pullPolicy | quote }}
112-
command:
113-
- /bin/sh
114-
- -c
115-
- |
116-
ls -l /
117-
ls -l /certs
118-
for file in /certs/*; do
119-
if [ -f "$file" ]; then
120-
filename=$(basename "$file")
121-
dst_file="/tmp/$filename"
122-
cat "$file" > "$dst_file"
123-
echo "Copied $file to $dst_file"
124-
fi
125-
done
126-
echo "All files have been copied."
127-
volumeMounts:
128-
- name: elasticsearch-certificates
129-
mountPath: /certs
130-
- name: empty-dir
131-
mountPath: /tmp
132-
subPath: certs
133-
{{- if .Values.ingest.containerSecurityContext.enabled }}
134-
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.ingest.containerSecurityContext "context" $) | nindent 12 }}
135-
{{- end }}
136-
{{- if .Values.copyTlsCerts.resources }}
137-
resources: {{- toYaml .Values.copyTlsCerts.resources | nindent 12 }}
138-
{{- else if ne .Values.copyTlsCerts.resourcesPreset "none" }}
139-
resources: {{- include "common.resources.preset" (dict "type" .Values.copyTlsCerts.resourcesPreset) | nindent 12 }}
140-
{{- end }}
141-
{{- end }}
142108
- name: copy-default-plugins
143109
image: {{ include "elasticsearch.image" . }}
144110
imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
@@ -328,9 +294,9 @@ spec:
328294
subPath: my_elasticsearch.yml
329295
{{- end }}
330296
{{- if .Values.security.enabled }}
331-
- name: empty-dir
297+
- name: elasticsearch-certificates
332298
mountPath: /opt/bitnami/elasticsearch/config/certs
333-
subPath: certs
299+
readOnly: true
334300
{{- end }}
335301
{{- if .Values.initScripts }}
336302
- name: custom-init-scripts

‎bitnami/elasticsearch/templates/master/statefulset.yaml

Lines changed: 1 addition & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -105,40 +105,6 @@ spec:
105105
resources: {{- include "common.resources.preset" (dict "type" .Values.sysctlImage.resourcesPreset) | nindent 12 }}
106106
{{- end }}
107107
{{- end }}
108-
{{- if .Values.security.enabled }}
109-
- name: copy-tls-certificates
110-
image: {{ include "elasticsearch.copyTlsCerts.image" . }}
111-
imagePullPolicy: {{ .Values.copyTlsCerts.image.pullPolicy | quote }}
112-
command:
113-
- /bin/sh
114-
- -c
115-
- |
116-
ls -l /
117-
ls -l /certs
118-
for file in /certs/*; do
119-
if [ -f "$file" ]; then
120-
filename=$(basename "$file")
121-
dst_file="/tmp/$filename"
122-
cat "$file" > "$dst_file"
123-
echo "Copied $file to $dst_file"
124-
fi
125-
done
126-
echo "All files have been copied."
127-
volumeMounts:
128-
- name: elasticsearch-certificates
129-
mountPath: /certs
130-
- name: empty-dir
131-
mountPath: /tmp
132-
subPath: certs
133-
{{- if .Values.master.containerSecurityContext.enabled }}
134-
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.master.containerSecurityContext "context" $) | nindent 12 }}
135-
{{- end }}
136-
{{- if .Values.copyTlsCerts.resources }}
137-
resources: {{- toYaml .Values.copyTlsCerts.resources | nindent 12 }}
138-
{{- else if ne .Values.copyTlsCerts.resourcesPreset "none" }}
139-
resources: {{- include "common.resources.preset" (dict "type" .Values.copyTlsCerts.resourcesPreset) | nindent 12 }}
140-
{{- end }}
141-
{{- end }}
142108
{{- if and .Values.volumePermissions.enabled .Values.master.persistence.enabled }}
143109
- name: volume-permissions
144110
image: {{ include "elasticsearch.volumePermissions.image" . }}
@@ -358,6 +324,7 @@ spec:
358324
{{- if .Values.security.enabled }}
359325
- name: elasticsearch-certificates
360326
mountPath: /opt/bitnami/elasticsearch/config/certs
327+
readOnly: true
361328
{{- end }}
362329
{{- if .Values.initScripts }}
363330
- name: custom-init-scripts

‎bitnami/elasticsearch/values.yaml

Lines changed: 0 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -2707,55 +2707,6 @@ sysctlImage:
27072707
##
27082708
resources: {}
27092709

2710-
## copy-tls-certificates init container definition
2711-
##
2712-
copyTlsCerts:
2713-
## @param copyTlsCerts.image.registry [default: REGISTRY_NAME] Copy TLS certificates image registry
2714-
## @param copyTlsCerts.image.repository [default: REPOSITORY_NAME/os-shell] Copy TLS certificates image repository
2715-
## @skip copyTlsCerts.image.tag Copy TLS certificates image tag
2716-
## @param copyTlsCerts.image.digest Copy TLS certificates image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag
2717-
## @param copyTlsCerts.image.pullPolicy Copy TLS certificates image pull policy
2718-
## @param copyTlsCerts.image.pullSecrets Copy TLS certificates image pull secrets
2719-
##
2720-
image:
2721-
registry: docker.io
2722-
repository: bitnami/os-shell
2723-
tag: 12-debian-12-r40
2724-
digest: ""
2725-
## Specify a imagePullPolicy
2726-
## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images
2727-
##
2728-
pullPolicy: IfNotPresent
2729-
## Optionally specify an array of imagePullSecrets.
2730-
## Secrets must be manually created in the namespace.
2731-
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
2732-
## e.g:
2733-
## pullSecrets:
2734-
## - myRegistryKeySecretName
2735-
##
2736-
pullSecrets: []
2737-
## Init container' resource requests and limits
2738-
## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
2739-
## We usually recommend not to specify default resources and to leave this as a conscious
2740-
## choice for the user. This also increases chances charts run on environments with little
2741-
## resources, such as Minikube. If you do want to specify resources, uncomment the following
2742-
## lines, adjust them as necessary, and remove the curly braces after 'resources:'.
2743-
## @param copyTlsCerts.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if copyTlsCerts.resources is set (copyTlsCerts.resources is recommended for production).
2744-
## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15
2745-
##
2746-
resourcesPreset: "nano"
2747-
## @param copyTlsCerts.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)
2748-
## Example:
2749-
## resources:
2750-
## requests:
2751-
## cpu: 2
2752-
## memory: 512Mi
2753-
## limits:
2754-
## cpu: 3
2755-
## memory: 1024Mi
2756-
##
2757-
resources: {}
2758-
27592710
## @section Kibana Parameters
27602711

27612712
## Bundled Kibana parameters

0 commit comments

Comments
 (0)