Skip to content

Commit

Permalink
add /tmp emptyDir volume to connector pods (#10761)
Browse files Browse the repository at this point in the history
Some connectors (such as destination-s3) require to write some temporary data (generally to /tmp).
It is a good security practice to enforce read only root filesystem on Kubernetes pod, and, some productive Kubernetes clusters enforce that all pods run with read only root filesystem.
Therefore, in order to still allow connectors to write temporary data to /tmp with read only root fs, we must mount an emptyDir volume to /tmp.

The original PR was here: #9874 we decided to split it into 3 different PRs.

This limit for this will be done in https://github.com/airbytehq/airbyte/issues/11025.
  • Loading branch information
tbcdns committed Mar 10, 2022
1 parent c6caf14 commit 921f4a1
Showing 1 changed file with 14 additions and 2 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -113,6 +113,7 @@ public class KubePodProcess extends Process implements KubePod {
private static final String STDOUT_PIPE_FILE = PIPES_DIR + "/stdout";
private static final String STDERR_PIPE_FILE = PIPES_DIR + "/stderr";
public static final String CONFIG_DIR = "/config";
public static final String TMP_DIR = "/tmp";
private static final String TERMINATION_DIR = "/termination";
private static final String TERMINATION_FILE_MAIN = TERMINATION_DIR + "/main";
private static final String TERMINATION_FILE_CHECK = TERMINATION_DIR + "/check";
Expand Down Expand Up @@ -426,13 +427,24 @@ public KubePodProcess(final boolean isOrchestrator,
.withMountPath(TERMINATION_DIR)
.build();

final Volume tmpVolume = new VolumeBuilder()
.withName("tmp")
.withNewEmptyDir()
.endEmptyDir()
.build();

final VolumeMount tmpVolumeMount = new VolumeMountBuilder()
.withName("tmp")
.withMountPath(TMP_DIR)
.build();

final Container init = getInit(usesStdin, List.of(pipeVolumeMount, configVolumeMount), busyboxImage);
final Container main = getMain(
image,
imagePullPolicy,
usesStdin,
entrypointOverride,
List.of(pipeVolumeMount, configVolumeMount, terminationVolumeMount),
List.of(pipeVolumeMount, configVolumeMount, terminationVolumeMount, tmpVolumeMount),
resourceRequirements,
internalToExternalPorts,
envMap,
Expand Down Expand Up @@ -500,7 +512,7 @@ public KubePodProcess(final boolean isOrchestrator,
.withRestartPolicy("Never")
.withInitContainers(init)
.withContainers(containers)
.withVolumes(pipeVolume, configVolume, terminationVolume)
.withVolumes(pipeVolume, configVolume, terminationVolume, tmpVolume)
.endSpec()
.build();

Expand Down

0 comments on commit 921f4a1

Please sign in to comment.