Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion manifests/templates/deployment/rbac.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ rules:

---

## Bind the cluster role granting access to ArangoLocalStorage resources
## Bind the cluster role granting access to ArangoDeployment resources
## to the default service account of the configured namespace.
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: RoleBinding
Expand Down
13 changes: 7 additions & 6 deletions pkg/apis/deployment/v1alpha/deployment.go
Original file line number Diff line number Diff line change
Expand Up @@ -52,12 +52,13 @@ type ArangoDeployment struct {
func (d *ArangoDeployment) AsOwner() metav1.OwnerReference {
trueVar := true
return metav1.OwnerReference{
APIVersion: SchemeGroupVersion.String(),
Kind: ArangoDeploymentResourceKind,
Name: d.Name,
UID: d.UID,
Controller: &trueVar,
BlockOwnerDeletion: &trueVar,
APIVersion: SchemeGroupVersion.String(),
Kind: ArangoDeploymentResourceKind,
Name: d.Name,
UID: d.UID,
Controller: &trueVar,
// For now BlockOwnerDeletion does not work on OpenShift, so we leave it out.
//BlockOwnerDeletion: &trueVar,
}
}

Expand Down
2 changes: 2 additions & 0 deletions pkg/deployment/images.go
Original file line number Diff line number Diff line change
Expand Up @@ -167,6 +167,8 @@ func (ib *imagesBuilder) fetchArangoDBImageIDAndVersion(ctx context.Context, ima
args := []string{
"--server.authentication=false",
fmt.Sprintf("--server.endpoint=tcp://[::]:%d", k8sutil.ArangoPort),

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

does this imply that the connection will never be ssl? and never use authentication?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For the ID pod : Yes.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The ID pod is run very quickly to fetch version information for a given image name.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It will never be accessible from outside, nor will it store any data or live longer than a few seconds

"--database.directory=" + k8sutil.ArangodVolumeMountDir,
"--log.output=+",
}
terminationGracePeriod := time.Second * 30
tolerations := make([]v1.Toleration, 0, 2)
Expand Down