Skip to content

Commit 59afd9d

Browse files
pedrohdzpedrohdz
authored
Adding podSecurityContextOverride (#204)
1 parent c4ad23c commit 59afd9d

9 files changed

Lines changed: 149 additions & 16 deletions

‎charts/jenkins/CHANGELOG.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,12 @@ Use the following links to reference issues, PRs, and commits prior to v2.6.0.
1212
The change log until v1.5.7 was auto-generated based on git commits.
1313
Those entries include a reference to the git commit to be able to get more details.
1414

15+
16+
## 3.1.0
17+
18+
* Added `.Values.controller.podSecurityContextOverride` and `.Values.backup.podSecurityContextOverride`.
19+
* Added simple default values tests for `jenkins-backup-cronjob.yaml`.
20+
1521
## 3.0.14
1622

1723
Enable to only backup job folder instead of whole jenkins

‎charts/jenkins/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
apiVersion: v2
22
name: jenkins
33
home: https://jenkins.io/
4-
version: 3.0.14
4+
version: 3.1.0
55
appVersion: 2.263.1
66
description: Jenkins - Build great things at any scale! The leading open source automation server, Jenkins provides hundreds of plugins to support building, deploying and automating any project.
77
sources:

‎charts/jenkins/README.md‎

Lines changed: 32 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -292,8 +292,38 @@ See additional `persistence` values using [configuration commands](#configuratio
292292
#### Existing PersistentVolumeClaim
293293

294294
1. Create the PersistentVolume
295-
1. Create the PersistentVolumeClaim
296-
1. [Install](#install-chart) the chart, setting `persistence.existingClaim` to `PVC_NAME`
295+
2. Create the PersistentVolumeClaim
296+
3. [Install](#install-chart) the chart, setting `persistence.existingClaim` to `PVC_NAME`
297+
298+
#### Long Volume Attach/Mount Times
299+
300+
Certain volume type and filesystem format combinations may experience long
301+
attach/mount times, [10 or more minutes][K8S_VOLUME_TIMEOUT], when using
302+
`fsGroup`. This issue may result in the following entries in the pod's event
303+
history:
304+
305+
```console
306+
Warning FailedMount 38m kubelet, aks-default-41587790-2 Unable to attach or mount volumes: unmounted volumes=[jenkins-home], unattached volumes=[plugins plugin-dir jenkins-token-rmq2g sc-config-volume tmp jenkins-home jenkins-config secrets-dir]: timed out waiting for the condition
307+
```
308+
309+
In these cases, experiment with replacing `fsGroup` with
310+
`supplementalGroups` in the pod's `securityContext`. This can be achieved by
311+
setting the `controller.podSecurityContextOverride` Helm chart value to
312+
something like:
313+
314+
```yaml
315+
controller:
316+
podSecurityContextOverride:
317+
runAsNonRoot: true
318+
runAsUser: 1000
319+
supplementalGroups: [1000]
320+
```
321+
322+
This issue has been reported on [azureDisk with ext4][K8S_VOLUME_TIMEOUT] and
323+
on [Alibaba cloud][K8S_VOLUME_TIMEOUT_ALIBABA].
324+
325+
[K8S_VOLUME_TIMEOUT]: https://github.com/kubernetes/kubernetes/issues/67014
326+
[K8S_VOLUME_TIMEOUT_ALIBABA]: https://github.com/kubernetes/kubernetes/issues/67014#issuecomment-698770511
297327

298328
#### Storage Class
299329

‎charts/jenkins/VALUES_SUMMARY.md‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -99,9 +99,10 @@ The following tables list the configurable parameters of the Jenkins chart and t
9999
| `controller.resources` | Resources allocation (Requests and Limits) | `{requests: {cpu: 50m, memory: 256Mi}, limits: {cpu: 2000m, memory: 4096Mi}}`|
100100
| `controller.initContainerEnv` | Environment variables for Init Container | Not set |
101101
| `controller.containerEnv` | Environment variables for Jenkins Container | Not set |
102-
| `controller.usePodSecurityContext` | Enable pod security context (must be `true` if `runAsUser` or `fsGroup` are set) | `true` |
103-
| `controller.runAsUser` | uid that jenkins runs with | `1000` |
104-
| `controller.fsGroup` | uid that will be used for persistent volume | `1000` |
102+
| `controller.usePodSecurityContext` | Enable pod security context (must be `true` if `runAsUser`, `fsGroup`, or `podSecurityContextOverride` are set) | `true` |
103+
| `controller.runAsUser` | Deprecated in favor of `controller.podSecurityContextOverride`. uid that jenkins runs with. | `1000` |
104+
| `controller.fsGroup` | Deprecated in favor of `controller.podSecurityContextOverride`. uid that will be used for persistent volume. | `1000` |
105+
| `controller.podSecurityContextOverride` | Completely overwrites the contents of the pod security context, ignoring the values provided for `runAsUser`, and `fsGroup`. | Not set |
105106
| `controller.hostAliases` | Aliases for IPs in `/etc/hosts` | `[]` |
106107
| `controller.serviceAnnotations` | Service annotations | `{}` |
107108
| `controller.serviceType` | k8s service type | `ClusterIP` |
@@ -337,3 +338,7 @@ The following tables list the configurable parameters of the Jenkins chart and t
337338
| `backup.resources` | Backup CPU/Memory resource requests/limits | Memory: `1Gi`, CPU: `1` |
338339
| `backup.destination` | Destination to store backup artifacts | `s3://jenkins-data/backup` |
339340
| `backup.onlyJobs` | Only backup the job folder | `false` |
341+
| `backup.usePodSecurityContext` | Enable backup pod's security context (must be `true` if `runAsUser`, `fsGroup`, or `podSecurityContextOverride` are set) | `true` |
342+
| `backup.runAsUser` | Deprecated in favor of `backup.podSecurityContextOverride`. uid that jenkins runs with. | `1000` |
343+
| `backup.fsGroup` | Deprecated in favor of `backup.podSecurityContextOverride`. uid that will be used for persistent volume. | `1000` |
344+
| `backup.podSecurityContextOverride` | Completely overwrites the contents of the backup pod's security context, ignoring the values provided for `runAsUser`, and `fsGroup`. | Not set |

‎charts/jenkins/templates/jenkins-backup-cronjob.yaml‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -36,15 +36,19 @@ spec:
3636
serviceAccountName: {{ template "jenkins.fullname" . }}-backup
3737
{{- if .Values.backup.usePodSecurityContext }}
3838
securityContext:
39+
{{- if hasKey .Values.backup "podSecurityContextOverride" }}
40+
{{- tpl (toYaml .Values.backup.podSecurityContextOverride | nindent 12) . }}
41+
{{- else }}
3942
runAsUser: {{ default 0 .Values.backup.runAsUser }}
40-
{{- if and (.Values.backup.runAsUser) (.Values.backup.fsGroup) }}
41-
{{- if not (eq (int .Values.backup.runAsUser) 0) }}
43+
{{- if and (.Values.backup.runAsUser) (.Values.backup.fsGroup) }}
44+
{{- if not (eq (int .Values.backup.runAsUser) 0) }}
4245
fsGroup: {{ .Values.backup.fsGroup }}
46+
{{- end }}
4347
{{- end }}
44-
{{- end }}
45-
{{- if .Values.backup.securityContextCapabilities }}
48+
{{- if .Values.backup.securityContextCapabilities }}
4649
capabilities:
47-
{{- toYaml .Values.backup.securityContextCapabilities | nindent 12 }}
50+
{{- toYaml .Values.backup.securityContextCapabilities | nindent 12 }}
51+
{{- end }}
4852
{{- end }}
4953
{{- end }}
5054
containers:

‎charts/jenkins/templates/jenkins-controller-statefulset.yaml‎

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -68,15 +68,24 @@ spec:
6868
{{- end }}
6969
{{- if .Values.controller.usePodSecurityContext }}
7070
securityContext:
71+
{{- if hasKey .Values.controller "podSecurityContextOverride" }}
72+
{{- tpl (toYaml .Values.controller.podSecurityContextOverride | nindent 8) . -}}
73+
{{- else }}
74+
{{/* The rest of this section should be replaced with the contents of this comment one the runAsUser, fsGroup, and securityContextCapabilities Helm chart values have been removed:
75+
runAsUser: 1000
76+
fsGroup: 1000
77+
runAsNonRoot: true
78+
*/}}
7179
runAsUser: {{ default 0 .Values.controller.runAsUser }}
72-
{{- if and (.Values.controller.runAsUser) (.Values.controller.fsGroup) }}
73-
{{- if not (eq (int .Values.controller.runAsUser) 0) }}
80+
{{- if and (.Values.controller.runAsUser) (.Values.controller.fsGroup) }}
81+
{{- if not (eq (int .Values.controller.runAsUser) 0) }}
7482
fsGroup: {{ .Values.controller.fsGroup }}
7583
runAsNonRoot: true
76-
{{- end }}
77-
{{- if .Values.controller.securityContextCapabilities }}
84+
{{- end }}
85+
{{- if .Values.controller.securityContextCapabilities }}
7886
capabilities:
7987
{{- toYaml .Values.controller.securityContextCapabilities | nindent 10 }}
88+
{{- end }}
8089
{{- end }}
8190
{{- end }}
8291
{{- end }}

‎charts/jenkins/tests/jenkins-backup-cronjob-test.yaml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
suite: Jenkins Backup Cronjob
2+
release:
3+
name: my-release
4+
namespace: my-namespace
5+
templates:
6+
- jenkins-backup-cronjob.yaml
7+
tests:
8+
- it: test default values
9+
set:
10+
backup:
11+
enabled: true
12+
asserts:
13+
- isKind:
14+
of: CronJob
15+
- equal:
16+
path: spec.jobTemplate.spec.template.spec.securityContext
17+
value:
18+
fsGroup: 1000
19+
runAsUser: 1000
20+
- it: test empty backup.podSecurityContextOverride
21+
set:
22+
backup:
23+
enabled: true
24+
podSecurityContextOverride: {}
25+
asserts:
26+
- equal:
27+
path: spec.jobTemplate.spec.template.spec.securityContext
28+
value: {}
29+
- it: test backup.podSecurityContextOverride
30+
set:
31+
backup:
32+
enabled: true
33+
podSecurityContextOverride:
34+
runAsNonRoot: true
35+
runAsUser: 4444
36+
supplementalGroups: [5555]
37+
asserts:
38+
- equal:
39+
path: spec.jobTemplate.spec.template.spec.securityContext
40+
value:
41+
runAsNonRoot: true
42+
runAsUser: 4444
43+
supplementalGroups:
44+
- 5555

‎charts/jenkins/tests/jenkins-controller-statefulset-test.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -349,3 +349,26 @@ tests:
349349
name: JENKINS_OPTS
350350
value: >-
351351
-Dtest="custom: 'true'"
352+
- it: test empty controller.podSecurityContextOverride
353+
set:
354+
controller:
355+
podSecurityContextOverride: {}
356+
asserts:
357+
- equal:
358+
path: spec.template.spec.securityContext
359+
value: {}
360+
- it: test controller.podSecurityContextOverride
361+
set:
362+
controller:
363+
podSecurityContextOverride:
364+
runAsNonRoot: true
365+
runAsUser: 4444
366+
supplementalGroups: [5555]
367+
asserts:
368+
- equal:
369+
path: spec.template.spec.securityContext
370+
value:
371+
runAsNonRoot: true
372+
runAsUser: 4444
373+
supplementalGroups:
374+
- 5555

‎charts/jenkins/values.yaml‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,8 +78,10 @@ controller:
7878
# jenkinsUrl: ""
7979
# If you set this prefix and use ingress controller then you might want to set the ingress path below
8080
# jenkinsUriPrefix: "/jenkins"
81-
# Enable pod security context (must be `true` if runAsUser or fsGroup are set)
81+
# Enable pod security context (must be `true` if podSecurityContextOverride, runAsUser or fsGroup are set)
8282
usePodSecurityContext: true
83+
# Note that `runAsUser`, `fsGroup`, and `securityContextCapabilities` are
84+
# being deprecated and replaced by `podSecurityContextOverride`.
8385
# Set runAsUser to 1000 to let Jenkins run as non-root user 'jenkins' which exists in 'jenkins/jenkins' docker image.
8486
# When setting runAsUser to a different value than 0 also set fsGroup to the same value:
8587
runAsUser: 1000
@@ -88,6 +90,16 @@ controller:
8890
securityContextCapabilities: {}
8991
# drop:
9092
# - NET_RAW
93+
# Completely overwrites the contents of the `securityContext`, ignoring the
94+
# values provided for the deprecated fields: `runAsUser`, `fsGroup`, and
95+
# `securityContextCapabilities`. In the case of mounting an ext4 filesystem,
96+
# it might be desirable to use `supplementalGroups` instead of `fsGroup` in
97+
# the `securityContext` block: https://github.com/kubernetes/kubernetes/issues/67014#issuecomment-589915496
98+
# podSecurityContextOverride:
99+
# runAsUser: 1000
100+
# runAsNonRoot: true
101+
# supplementalGroups: [1000]
102+
# # capabilities: {}
91103
servicePort: 8080
92104
targetPort: 8080
93105
# For minikube, set this to NodePort, elsewhere use LoadBalancer

0 commit comments

Comments
 (0)