Skip to content

Commit 4eba6ae

Browse files
EliMoshkovichEliMoshkovich
authored
PER-12459-openshift-support (#68)
* PER-12459-openshift-support * path changes * without tmp path * wip values * postgres env removed
1 parent 95b75ed commit 4eba6ae

5 files changed

Lines changed: 162 additions & 4 deletions

File tree

‎templates/deployment-client.yaml‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,14 @@ spec:
2121
imagePullSecrets:
2222
{{- toYaml . | nindent 8 }}
2323
{{- end }}
24+
{{- if or .Values.openshift.enabled .Values.client.securityContext }}
25+
securityContext:
26+
{{- if .Values.client.securityContext }}
27+
{{- toYaml .Values.client.securityContext | nindent 8 }}
28+
{{- else if .Values.openshift.enabled }}
29+
{{- toYaml .Values.openshift.securityContext | nindent 8 }}
30+
{{- end }}
31+
{{- end }}
2432
{{- if .Values.client.opaStartupData }}
2533
volumes:
2634
- name: opa-startup-data
@@ -32,6 +40,14 @@ spec:
3240
- name: opal-client
3341
image: {{ include "opal.clientImage" . | quote }}
3442
imagePullPolicy: {{ .Values.client.imagePullPolicy | default "IfNotPresent" | quote }}
43+
{{- if or .Values.openshift.enabled .Values.client.containerSecurityContext }}
44+
securityContext:
45+
{{- if .Values.client.containerSecurityContext }}
46+
{{- toYaml .Values.client.containerSecurityContext | nindent 12 }}
47+
{{- else if .Values.openshift.enabled }}
48+
{{- toYaml .Values.openshift.containerSecurityContext | nindent 12 }}
49+
{{- end }}
50+
{{- end }}
3551
ports:
3652
- name: http
3753
containerPort: {{ .Values.client.port }}
@@ -95,4 +111,4 @@ spec:
95111
{{- toYaml .Values.client.resources | nindent 12 }}
96112
{{- end }}
97113
{{- end }}
98-
{{- end }}
114+
{{- end }}

‎templates/deployment-pgsql.yaml‎

Lines changed: 37 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,10 +20,36 @@ spec:
2020
imagePullSecrets:
2121
{{- toYaml . | nindent 8 }}
2222
{{- end }}
23+
{{- if or .Values.openshift.enabled .Values.postgresql.securityContext }}
24+
securityContext:
25+
{{- if .Values.postgresql.securityContext }}
26+
{{- toYaml .Values.postgresql.securityContext | nindent 8 }}
27+
{{- else if .Values.openshift.enabled }}
28+
{{- toYaml .Values.openshift.securityContext | nindent 8 }}
29+
{{- end }}
30+
{{- end }}
31+
{{- if .Values.openshift.enabled }}
32+
volumes:
33+
- name: postgres-data
34+
emptyDir: {}
35+
{{- end }}
2336
containers:
2437
- name: pgsql
2538
image: {{ include "opal.pgsqlImage" . | quote }}
2639
imagePullPolicy: IfNotPresent
40+
{{- if or .Values.openshift.enabled .Values.postgresql.containerSecurityContext }}
41+
securityContext:
42+
{{- if .Values.postgresql.containerSecurityContext }}
43+
{{- toYaml .Values.postgresql.containerSecurityContext | nindent 12 }}
44+
{{- else if .Values.openshift.enabled }}
45+
{{- toYaml .Values.openshift.containerSecurityContext | nindent 12 }}
46+
{{- end }}
47+
{{- end }}
48+
{{- if .Values.openshift.enabled }}
49+
volumeMounts:
50+
- mountPath: /var/lib/postgresql/data
51+
name: postgres-data
52+
{{- end }}
2753
ports:
2854
- name: pgsql
2955
containerPort: 5432
@@ -35,5 +61,15 @@ spec:
3561
value: postgres
3662
- name: POSTGRES_PASSWORD
3763
value: postgres
64+
{{- if .Values.openshift.enabled }}
65+
- name: PGDATA
66+
value: "/var/lib/postgresql/data/pgdata"
67+
{{- end }}
68+
{{- if .Values.postgresql.extraEnv }}
69+
{{- range $name, $value := .Values.postgresql.extraEnv }}
70+
- name: {{ $name }}
71+
value: {{ $value | quote }}
72+
{{- end }}
73+
{{- end }}
3874
{{- end }}
39-
{{- end }}
75+
{{- end }}

‎templates/deployment-server.yaml‎

Lines changed: 35 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,14 @@ spec:
2121
imagePullSecrets:
2222
{{- toYaml . | nindent 8 }}
2323
{{- end }}
24+
{{- if or .Values.openshift.enabled .Values.server.securityContext }}
25+
securityContext:
26+
{{- if .Values.server.securityContext }}
27+
{{- toYaml .Values.server.securityContext | nindent 8 }}
28+
{{- else if .Values.openshift.enabled }}
29+
{{- toYaml .Values.openshift.securityContext | nindent 8 }}
30+
{{- end }}
31+
{{- end }}
2432
{{- if .Values.e2e }}
2533
volumes:
2634
- name: e2e
@@ -29,11 +37,25 @@ spec:
2937
configMap:
3038
name: policy-repo-data
3139
defaultMode: 0755
40+
{{- else if .Values.openshift.enabled }}
41+
volumes:
42+
- name: jwks-dir
43+
emptyDir: {}
44+
{{- end }}
3245

46+
{{- if .Values.e2e }}
3347
initContainers:
3448
- name: git-init
3549
image: {{ include "opal.serverImage" . | quote }}
3650
imagePullPolicy: IfNotPresent
51+
{{- if or .Values.openshift.enabled .Values.server.containerSecurityContext }}
52+
securityContext:
53+
{{- if .Values.server.containerSecurityContext }}
54+
{{- toYaml .Values.server.containerSecurityContext | nindent 12 }}
55+
{{- else if .Values.openshift.enabled }}
56+
{{- toYaml .Values.openshift.containerSecurityContext | nindent 12 }}
57+
{{- end }}
58+
{{- end }}
3759
volumeMounts:
3860
- mountPath: /opt/e2e
3961
name: e2e
@@ -63,13 +85,25 @@ spec:
6385
- name: opal-server
6486
image: {{ include "opal.serverImage" . | quote }}
6587
imagePullPolicy: {{ .Values.server.imagePullPolicy | default "IfNotPresent" | quote }}
88+
{{- if or .Values.openshift.enabled .Values.server.containerSecurityContext }}
89+
securityContext:
90+
{{- if .Values.server.containerSecurityContext }}
91+
{{- toYaml .Values.server.containerSecurityContext | nindent 12 }}
92+
{{- else if .Values.openshift.enabled }}
93+
{{- toYaml .Values.openshift.containerSecurityContext | nindent 12 }}
94+
{{- end }}
95+
{{- end }}
6696
{{- if .Values.e2e }}
6797
volumeMounts:
6898
- mountPath: /opt/e2e/policy-repo-data
6999
name: policy-repo-data
70100
readOnly: true
71101
- mountPath: /opt/e2e
72102
name: e2e
103+
{{- else if .Values.openshift.enabled }}
104+
volumeMounts:
105+
- mountPath: /opal/jwks_dir
106+
name: jwks-dir
73107
{{- end }}
74108
ports:
75109
- name: http
@@ -139,4 +173,4 @@ spec:
139173
{{- toYaml .Values.server.resources | nindent 12 }}
140174
{{- end }}
141175
{{- end }}
142-
{{- end }}
176+
{{- end }}

‎values.schema.json‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,11 +28,44 @@
2828
},
2929
"external_source_url": {"type": "string", "title": "url to external data source"}
3030
}
31+
},
32+
"SecurityContext": {
33+
"type": "object",
34+
"title": "SecurityContext",
35+
"additionalProperties": true,
36+
"properties": {
37+
"runAsUser": { "type": "integer" },
38+
"runAsGroup": { "type": "integer" },
39+
"fsGroup": { "type": "integer" }
40+
}
41+
},
42+
"ContainerSecurityContext": {
43+
"type": "object",
44+
"title": "ContainerSecurityContext",
45+
"additionalProperties": true,
46+
"properties": {
47+
"runAsNonRoot": { "type": "boolean" },
48+
"allowPrivilegeEscalation": { "type": "boolean" }
49+
}
3150
}
3251
},
3352

3453
"type": "object", "required": ["image"],
3554
"properties": {
55+
"openshift": {
56+
"type": "object",
57+
"title": "OpenShift compatibility settings",
58+
"additionalProperties": false,
59+
"properties": {
60+
"enabled": {
61+
"type": "boolean",
62+
"title": "Enable OpenShift compatibility",
63+
"default": false
64+
},
65+
"securityContext": { "$ref": "#/definitions/SecurityContext" },
66+
"containerSecurityContext": { "$ref": "#/definitions/ContainerSecurityContext" }
67+
}
68+
},
3669
"image": {
3770
"type": "object", "title": "image", "additionalProperties": false,
3871
"required": ["server", "client", "pgsql"],
@@ -118,6 +151,8 @@
118151
"type": ["null", "object"], "additionalProperties": false, "title": "opal server settings",
119152
"required": ["port", "policyRepoUrl", "pollingInterval", "dataConfigSources", "broadcastPgsql", "uvicornWorkers", "replicas"],
120153
"properties": {
154+
"securityContext": { "$ref": "#/definitions/SecurityContext" },
155+
"containerSecurityContext": { "$ref": "#/definitions/ContainerSecurityContext" },
121156
"enabled": {
122157
"type": "boolean", "title": "enable server", "default": true
123158
},
@@ -181,6 +216,8 @@
181216
"type": ["null", "object"], "additionalProperties": false, "title": "opal client settings",
182217
"required": ["port", "opaPort", "replicas"],
183218
"properties": {
219+
"securityContext": { "$ref": "#/definitions/SecurityContext" },
220+
"containerSecurityContext": { "$ref": "#/definitions/ContainerSecurityContext" },
184221
"enabled": {
185222
"type": "boolean", "title": "enable client", "default": true
186223
},
@@ -220,6 +257,20 @@
220257
"title": "when kubelet should pull specified image"
221258
}
222259
}
260+
},
261+
"postgresql": {
262+
"type": ["null", "object"],
263+
"additionalProperties": false,
264+
"title": "PostgreSQL settings",
265+
"properties": {
266+
"securityContext": { "$ref": "#/definitions/SecurityContext" },
267+
"containerSecurityContext": { "$ref": "#/definitions/ContainerSecurityContext" },
268+
"extraEnv": {
269+
"type": "object",
270+
"title": "extra environment variables list",
271+
"default": {}
272+
}
273+
}
223274
}
224275
}
225276
}

‎values.yaml‎

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,13 @@
1+
openshift:
2+
enabled: false
3+
securityContext:
4+
runAsUser: 1010180000
5+
runAsGroup: 1010180000
6+
fsGroup: 1010180000
7+
containerSecurityContext:
8+
runAsNonRoot: true
9+
allowPrivilegeEscalation: false
10+
111
image:
212
client:
313
registry: docker.io
@@ -21,7 +31,7 @@ server:
2131
# Option #1 - No data sources
2232
config:
2333
entries: []
24-
34+
2535
# Option #2 - Dynamically get data sources
2636
# external_source_url: "https://your-api.com/path/to/api/endpoint"
2737

@@ -42,6 +52,8 @@ server:
4252
extraEnv: {
4353
# "CUSTOM_ENV_VAR": "VALUE"
4454
}
55+
securityContext: {}
56+
containerSecurityContext: {}
4557

4658
client:
4759
port: 7000
@@ -50,3 +62,12 @@ client:
5062
# If you need to specify a custom hostname for the opal-sever, configure the serverUrl property
5163
# serverUrl: http://custom-hostname-for-opal:opal-port
5264
extraEnv: {}
65+
securityContext: {}
66+
containerSecurityContext: {}
67+
68+
postgresql:
69+
securityContext: {}
70+
containerSecurityContext: {}
71+
extraEnv: {}
72+
73+
broadcastReplicas: 1

0 commit comments

Comments
 (0)