Skip to content

[Feature] Pod Security Context #601

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 8 commits into from
Jul 22, 2020
Merged

[Feature] Pod Security Context #601

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
ae0d038
Pod Security Context
ajanikow Jul 21, 2020
9b004a0
Fix README
ajanikow Jul 21, 2020
98bbac9
Update README
ajanikow Jul 22, 2020
876e9ef
Update README
ajanikow Jul 22, 2020
7d0a3ec
Update README
ajanikow Jul 22, 2020
ae2205c
Update README
ajanikow Jul 22, 2020
7d61adc
Finalize
ajanikow Jul 22, 2020
4e5b1f8
Fix UT
ajanikow Jul 22, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,10 @@
- Allow to customize Security Context in pods
- Remove dead Coordinators in Cluster mode
- Add AutoRecovery flag to recover cluster in case of deadlock
- Add Operator Single mode
- Improve SecurityContext settings
- Update k8s dependency to 1.15.11
- Add Scope parameter to Operator

## [1.0.3](https://github.com/arangodb/kube-arangodb/tree/1.0.3) (2020-05-25)
- Prevent deletion of not known PVC's
Expand Down
11 changes: 9 additions & 2 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -226,7 +226,7 @@ endif
.PHONY: update-vendor
update-vendor:
@rm -Rf $(VENDORDIR)/k8s.io/code-generator
@git clone --branch kubernetes-1.14.1 https://github.com/kubernetes/code-generator.git $(VENDORDIR)/k8s.io/code-generator
@git clone --branch kubernetes-1.15.11 https://github.com/kubernetes/code-generator.git $(VENDORDIR)/k8s.io/code-generator
@rm -Rf $(VENDORDIR)/k8s.io/code-generator/.git


Expand Down Expand Up @@ -581,8 +581,15 @@ ifdef PUSHIMAGES
endif
$(ROOTDIR)/scripts/kube_run_sync_tests.sh $(DEPLOYMENTNAMESPACE) '$(ARANGODIMAGE)' '$(ARANGOSYNCIMAGE)' '$(ARANGOSYNCTESTIMAGE)' '$(ARANGOSYNCTESTCTRLIMAGE)' '$(TESTOPTIONS)'

.PHONY: tidy
tidy:
@go mod tidy

.PHONY: deps-reload
deps-reload: tidy init

.PHONY: init
init: tools vendor
init: tools update-generated $(GHRELEASE) $(RELEASE) $(TESTBIN) $(BIN) vendor

.PHONY: tools
tools:
Expand Down
69 changes: 45 additions & 24 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,36 +28,57 @@ state for individual new features, since we expect that new
features will first be released with an "alpha" or "beta" readiness
state and over time move to full "production readiness".

Operator will supports versions supported on providers and maintained by Kubernetes.
Once version is not supported anymore it will go into "Deprecating" state and will be marked as deprecated on Minor release.

The following table has the general readiness state, the table below
covers individual newer features separately.

| Platform | Kubernetes Version | ArangoDB Version | ArangoDB Operator Version | State | Remarks | Provider Remarks |
|---------------------|--------------------|------------------|---------------------------|-------------|-----------------------|------------------------------------|
| Google GKE | 1.14 | >= 3.3.13 | | Production | Don't use micro nodes | |
| Google GKE | 1.15 | >= 3.3.13 | | Production | Don't use micro nodes | |
| Azure AKS | 1.14 | >= 3.3.13 | | Production | | |
| Azure AKS | 1.15 | >= 3.3.13 | | Production | | |
| Amazon EKS | 1.14 | >= 3.3.13 | | Production | | [Amazon EKS](./docs/providers/eks) |
| IBM Cloud | 1.14 | >= 3.4.6.1 | >= 0.3.11 | Production | | |
| OpenShift | 3.11 | >= 3.3.13 | | Production | | |
| OpenShift | 4.2 | >= 3.3.13 | | In Progress | | |
| BareMetal (kubeadm) | 1.14 | >= 3.3.13 | | Production | | |
| Minikube | 1.14 | >= 3.3.13 | | Devel Only | | |
| Other | 1.14 | >= 3.3.13 | | Devel Only | | |
| Platform | Kubernetes Version | ArangoDB Version | ArangoDB Operator Version | State | Remarks | Provider Remarks |
|---------------------|--------------------|------------------|---------------------------|--------------------------|-----------------------|------------------------------------|
| Google GKE | 1.14 | >= 3.3.13 | | Production (Deprecating) | Don't use micro nodes | |
| Google GKE | 1.15 | >= 3.3.13 | | Production (Deprecating) | Don't use micro nodes | |
| Google GKE | 1.16 | >= 3.3.13 | | Production | Don't use micro nodes | |
| Google GKE | 1.17 | >= 3.3.13 | | Production | Don't use micro nodes | |
| Azure AKS | 1.14 | >= 3.3.13 | | Production (Deprecating) | | |
| Azure AKS | 1.15 | >= 3.3.13 | | Production (Deprecating) | | |
| Azure AKS | 1.16 | >= 3.3.13 | | Production | | |
| Azure AKS | 1.17 | >= 3.3.13 | | Production | | |
| Amazon EKS | 1.14 | >= 3.3.13 | | Production (Deprecating) | | [Amazon EKS](./docs/providers/eks) |
| Amazon EKS | 1.15 | >= 3.3.13 | | Production (Deprecating) | | [Amazon EKS](./docs/providers/eks) |
| Amazon EKS | 1.16 | >= 3.3.13 | | Production | | [Amazon EKS](./docs/providers/eks) |
| Amazon EKS | 1.17 | >= 3.3.13 | | Production | | [Amazon EKS](./docs/providers/eks) |
| IBM Cloud | 1.14 | >= 3.4.6.1 | >= 0.3.11 | Production | | |
| OpenShift | 3.11 | >= 3.3.13 | | Production | | |
| OpenShift | 4.2 | >= 3.3.13 | | In Progress | | |
| BareMetal (kubeadm) | 1.14 | >= 3.3.13 | | Production (Deprecating) | | |
| BareMetal (kubeadm) | 1.15 | >= 3.3.13 | | Production (Deprecating) | | |
| BareMetal (kubeadm) | 1.16 | >= 3.3.13 | | Production | | |
| BareMetal (kubeadm) | 1.17 | >= 3.3.13 | | Production | | |
| Minikube | 1.14+ | >= 3.3.13 | | Devel Only | | |
| Other | 1.14+ | >= 3.3.13 | | Devel Only | | |

Feature-wise production readiness table:

| Feature | ArangoDB K8s Operator Version | Production Readiness | Remarks |
|------------------------------|---------------------------------------|---------------------------|-------------------|
| Pod Disruption Budgets | 0.3.10 | new - alpha | |
| | 0.3.11 | beta | |
| Volume Resizing | 0.3.10 | new - beta | |
| | 0.3.11 | beta | |
| Disabling of liveness probes | 0.3.10 | new - beta | |
| | 0.3.11 | production ready | |
| Volume Claim Templates | 0.3.11 | new - alpha | |
| Prometheus Metrics export | 0.3.11 | new - alpha | needs Prometheus |
| User sidecar containers | 0.3.11 | new - alpha | |
| Feature | Operator Version | ArangoDB Version | ArangoDB Edition | State | Enabled | Flag | Remarks |
|---------------------------------|------------------|------------------|-----------------------|------------|---------|------------------------------------------|--------------------------------------------------------------------------|
| Pod Disruption Budgets | 0.3.10 | Any | Community, Enterprise | Alpha | True | N/A | N/A |
| Pod Disruption Budgets | 0.3.11 | Any | Community, Enterprise | Production | True | N/A | N/A |
| Volume Resizing | 0.3.10 | Any | Community, Enterprise | Alpha | True | N/A | N/A |
| Volume Resizing | 0.3.11 | Any | Community, Enterprise | Production | True | N/A | N/A |
| Disabling of liveness probes | 0.3.10 | Any | Community, Enterprise | Alpha | True | N/A | N/A |
| Disabling of liveness probes | 0.3.11 | Any | Community, Enterprise | Production | True | N/A | N/A |
| Volume Claim Templates | 0.3.11 | Any | Community, Enterprise | Alpha | True | N/A | N/A |
| Volume Claim Templates | 1.0.0 | Any | Community, Enterprise | Production | True | N/A | N/A |
| Prometheus Metrics Exporter | 0.3.11 | Any | Community, Enterprise | Alpha | True | N/A | Prometheus required |
| Prometheus Metrics Exporter | 1.0.0 | Any | Community, Enterprise | Production | True | N/A | Prometheus required |
| Sidecar Containers | 0.3.11 | Any | Community, Enterprise | Alpha | True | N/A | N/A |
| Sidecar Containers | 1.0.0 | Any | Community, Enterprise | Production | True | N/A | N/A |
| Operator Single Mode | 1.0.4 | Any | Community, Enterprise | Production | False | --mode.single | Only 1 instance of Operator allowed in namespace when feature is enabled |
| TLS SNI Support | 1.0.3 | >= 3.7.0 | Enterprise | Production | True | --deployment.feature.tls-sni | N/A |
| TLS Runtime Rotation Support | 1.0.4 | > 3.7.0 | Enterprise | Alpha | False | --deployment.feature.tls-rotation | N/A |
| JWT Rotation Support | 1.0.4 | > 3.7.0 | Enterprise | Alpha | False | --deployment.feature.jwt-rotation | N/A |
| Encryption Key Rotation Support | 1.0.4 | > 3.7.0 | Enterprise | Alpha | False | --deployment.feature.encryption-rotation | N/A |

## Release notes for 0.3.16

Expand Down
9 changes: 9 additions & 0 deletions chart/kube-arangodb/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,15 @@ List of the Image Pull Secrets for Operator images.

Default: `[]string`

### `operator.scope`

Scope on which Operator will be configured.

Default: `legacy`

Supported modes:
- `legacy` - mode with limited cluster scope access

### `operator.service.type`

Type of the Operator service.
Expand Down
6 changes: 6 additions & 0 deletions chart/kube-arangodb/templates/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,8 @@
{{- if eq .Values.operator.scope "legacy" -}}
# Scope "legacy" selected
{{ else -}}
{{ fail (printf "Operator Scope %s is not supported!" .Values.operator.scope) }}
{{- end -}}
apiVersion: apps/v1
kind: Deployment
metadata:
Expand Down Expand Up @@ -72,6 +77,7 @@ spec:
imagePullPolicy: {{ .Values.operator.imagePullPolicy }}
image: {{ .Values.operator.image }}
args:
- --scope={{ .Values.operator.scope }}
{{- if .Values.operator.features.deployment }}
- --operator.deployment
{{- end -}}
Expand Down
2 changes: 2 additions & 0 deletions chart/kube-arangodb/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,8 @@ operator:
imagePullPolicy: IfNotPresent
imagePullSecrets: []

scope: legacy

args: []

service:
Expand Down
27 changes: 14 additions & 13 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,15 +8,20 @@ replace (
github.com/stretchr/testify => github.com/stretchr/testify v1.5.1
github.com/ugorji/go => github.com/ugorji/go v0.0.0-20181209151446-772ced7fd4c2

k8s.io/api => k8s.io/api v0.15.9
k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.15.9
k8s.io/apimachinery => k8s.io/apimachinery v0.15.9
k8s.io/client-go => k8s.io/client-go v0.15.9
k8s.io/api => k8s.io/api v0.15.11
k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.15.11
k8s.io/apimachinery => k8s.io/apimachinery v0.15.11
k8s.io/apiserver => k8s.io/apiserver v0.15.11
k8s.io/client-go => k8s.io/client-go v0.15.11
k8s.io/cloud-provider => k8s.io/cloud-provider v0.15.11
k8s.io/cluster-bootstrap => k8s.io/cluster-bootstrap v0.15.11
k8s.io/code-generator => ./deps/k8s.io/code-generator
k8s.io/component-base => k8s.io/component-base v0.15.11
k8s.io/kubernetes => k8s.io/kubernetes v1.15.11
k8s.io/metrics => k8s.io/metrics v0.15.11
)

require (
github.com/aktau/github-release v0.8.1 // indirect
github.com/arangodb-helper/go-certificates v0.0.0-20180821055445-9fca24fc2680
github.com/arangodb/arangosync-client v0.6.3
github.com/arangodb/go-driver v0.0.0-20191002124627-11b6bfc64f67
Expand All @@ -30,13 +35,10 @@ require (
github.com/ghodss/yaml v1.0.0
github.com/gin-contrib/sse v0.0.0-20190301062529-5545eab6dad3 // indirect
github.com/gin-gonic/gin v1.3.0
github.com/github-release/github-release v0.8.1 // indirect
github.com/google/addlicense v0.0.0-20200422172452-68a83edd47bc // indirect
github.com/inconshreveable/log15 v0.0.0-20200109203555-b30bc20e4fd1 // indirect
github.com/google/addlicense v0.0.0-20200622132530-df58acafd6d5 // indirect
github.com/jessevdk/go-assets v0.0.0-20160921144138-4f4301a06e15
github.com/jessevdk/go-assets-builder v0.0.0-20130903091706-b8483521738f
github.com/julienschmidt/httprouter v1.3.0
github.com/kevinburke/rest v0.0.0-20200429221318-0d2892b400f8 // indirect
github.com/magiconair/properties v1.8.0
github.com/mattn/go-isatty v0.0.12 // indirect
github.com/pkg/errors v0.8.1
Expand All @@ -46,11 +48,10 @@ require (
github.com/spf13/cobra v0.0.5
github.com/spf13/pflag v1.0.5
github.com/stretchr/testify v1.5.1
github.com/tomnomnom/linkheader v0.0.0-20180905144013-02ca5825eb80 // indirect
github.com/ugorji/go/codec v0.0.0-20181209151446-772ced7fd4c2 // indirect
github.com/voxelbrain/goptions v0.0.0-20180630082107-58cddc247ea2 // indirect
golang.org/x/net v0.0.0-20200226121028-0de0cce0169b
golang.org/x/sys v0.0.0-20200116001909-b77594299b42
golang.org/x/net v0.0.0-20200625001655-4c5254603344
golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd
golang.org/x/tools v0.0.0-20200721223218-6123e77877b2 // indirect
gopkg.in/go-playground/assert.v1 v1.2.1 // indirect
gopkg.in/go-playground/validator.v8 v8.18.2 // indirect
k8s.io/api v0.17.3
Expand Down
Loading