Defaulting RunAsGroup (#1134)

Signed-off-by: Arnob kumar saha <arnob@appscode.com>
kubedb · Jan 26, 2024 · ef7f62f · ef7f62f
1 parent e08f63b
commit ef7f62f
Show file tree

Hide file tree

Showing 11 changed files with 83 additions and 25 deletions.
diff --git a/apis/kubedb/v1alpha2/elasticsearch_helpers.go b/apis/kubedb/v1alpha2/elasticsearch_helpers.go
@@ -639,8 +639,13 @@ func (e *Elasticsearch) SetDefaults(esVersion *catalog.ElasticsearchVersion, top
 
 func (e *Elasticsearch) SetMetricsExporterDefaults(esVersion *catalog.ElasticsearchVersion) {
 	e.Spec.Monitor.SetDefaults()
-	if e.Spec.Monitor != nil && e.Spec.Monitor.Prometheus != nil && e.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsUser == nil {
-		e.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsUser = esVersion.Spec.SecurityContext.RunAsUser
+	if e.Spec.Monitor != nil && e.Spec.Monitor.Prometheus != nil {
+		if e.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsUser == nil {
+			e.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsUser = esVersion.Spec.SecurityContext.RunAsUser
+		}
+		if e.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsGroup == nil {
+			e.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsGroup = esVersion.Spec.SecurityContext.RunAsUser
+		}
 	}
 }
 

diff --git a/apis/kubedb/v1alpha2/ferretdb_helpers.go b/apis/kubedb/v1alpha2/ferretdb_helpers.go
@@ -211,10 +211,16 @@ func (f *FerretDB) SetDefaults() {
 			ExternallyManaged: f.Spec.Backend.ExternallyManaged,
 		}
 	}
-	if f.Spec.Monitor != nil && f.Spec.Monitor.Prometheus.Exporter.Port == 0 {
-		// 56790 is default port for Prometheus operator.
-		f.Spec.Monitor.Prometheus.Exporter.Port = 56790
+	f.Spec.Monitor.SetDefaults()
+	if f.Spec.Monitor != nil && f.Spec.Monitor.Prometheus != nil {
+		if f.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsUser == nil {
+			f.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsUser = frVersion.Spec.SecurityContext.RunAsUser
+		}
+		if f.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsGroup == nil {
+			f.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsGroup = frVersion.Spec.SecurityContext.RunAsUser
+		}
 	}
+
 	defaultVersion := "13.13"
 	if !f.Spec.Backend.ExternallyManaged && f.Spec.Backend.Postgres == nil {
 		f.Spec.Backend.Postgres = &PostgresRef{

diff --git a/apis/kubedb/v1alpha2/kafka_helpers.go b/apis/kubedb/v1alpha2/kafka_helpers.go
@@ -320,8 +320,13 @@ func (k *Kafka) SetDefaults() {
 	}
 
 	k.Spec.Monitor.SetDefaults()
-	if k.Spec.Monitor != nil && k.Spec.Monitor.Prometheus != nil && k.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsUser == nil {
-		k.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsUser = kfVersion.Spec.SecurityContext.RunAsUser
+	if k.Spec.Monitor != nil && k.Spec.Monitor.Prometheus != nil {
+		if k.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsUser == nil {
+			k.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsUser = kfVersion.Spec.SecurityContext.RunAsUser
+		}
+		if k.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsGroup == nil {
+			k.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsGroup = kfVersion.Spec.SecurityContext.RunAsUser
+		}
 	}
 
 	if k.Spec.Topology != nil {

diff --git a/apis/kubedb/v1alpha2/mariadb_helpers.go b/apis/kubedb/v1alpha2/mariadb_helpers.go
@@ -219,13 +219,19 @@ func (m *MariaDB) SetDefaults(mdVersion *v1alpha1.MariaDBVersion, topology *core
 
 	m.setDefaultContainerSecurityContext(mdVersion, &m.Spec.PodTemplate)
 
-	m.Spec.Monitor.SetDefaults()
 	m.setDefaultAffinity(&m.Spec.PodTemplate, m.OffshootSelectors(), topology)
 	m.SetTLSDefaults()
 	m.SetHealthCheckerDefaults()
 	apis.SetDefaultResourceLimits(&m.Spec.PodTemplate.Spec.Resources, DefaultResources)
-	if m.Spec.Monitor != nil && m.Spec.Monitor.Prometheus != nil && m.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsUser == nil {
-		m.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsUser = mdVersion.Spec.SecurityContext.RunAsUser
+
+	m.Spec.Monitor.SetDefaults()
+	if m.Spec.Monitor != nil && m.Spec.Monitor.Prometheus != nil {
+		if m.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsUser == nil {
+			m.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsUser = mdVersion.Spec.SecurityContext.RunAsUser
+		}
+		if m.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsGroup == nil {
+			m.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsGroup = mdVersion.Spec.SecurityContext.RunAsUser
+		}
 	}
 }
 

diff --git a/apis/kubedb/v1alpha2/mysql_helpers.go b/apis/kubedb/v1alpha2/mysql_helpers.go
@@ -287,13 +287,18 @@ func (m *MySQL) SetDefaults(myVersion *v1alpha1.MySQLVersion, topology *core_uti
 
 	m.setDefaultContainerSecurityContext(myVersion, &m.Spec.PodTemplate)
 
-	m.Spec.Monitor.SetDefaults()
 	m.setDefaultAffinity(&m.Spec.PodTemplate, m.OffshootSelectors(), topology)
 	m.SetTLSDefaults()
 	m.SetHealthCheckerDefaults()
 	apis.SetDefaultResourceLimits(&m.Spec.PodTemplate.Spec.Resources, DefaultResources)
-	if m.Spec.Monitor != nil && m.Spec.Monitor.Prometheus != nil && m.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsUser == nil {
-		m.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsUser = myVersion.Spec.SecurityContext.RunAsUser
+	m.Spec.Monitor.SetDefaults()
+	if m.Spec.Monitor != nil && m.Spec.Monitor.Prometheus != nil {
+		if m.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsUser == nil {
+			m.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsUser = myVersion.Spec.SecurityContext.RunAsUser
+		}
+		if m.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsGroup == nil {
+			m.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsGroup = myVersion.Spec.SecurityContext.RunAsUser
+		}
 	}
 }
 

diff --git a/apis/kubedb/v1alpha2/perconaxtradb_helpers.go b/apis/kubedb/v1alpha2/perconaxtradb_helpers.go
@@ -231,12 +231,17 @@ func (p *PerconaXtraDB) SetDefaults(pVersion *v1alpha1.PerconaXtraDBVersion, top
 	// Otherwise, We will get write permission denied.
 	p.setDefaultContainerSecurityContext(pVersion, &p.Spec.PodTemplate)
 
-	p.Spec.Monitor.SetDefaults()
 	p.setDefaultAffinity(&p.Spec.PodTemplate, p.OffshootSelectors(), topology)
 	p.SetTLSDefaults()
 	apis.SetDefaultResourceLimits(&p.Spec.PodTemplate.Spec.Resources, DefaultResources)
-	if p.Spec.Monitor != nil && p.Spec.Monitor.Prometheus != nil && p.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsUser == nil {
-		p.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsUser = pVersion.Spec.SecurityContext.RunAsUser
+	p.Spec.Monitor.SetDefaults()
+	if p.Spec.Monitor != nil && p.Spec.Monitor.Prometheus != nil {
+		if p.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsUser == nil {
+			p.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsUser = pVersion.Spec.SecurityContext.RunAsUser
+		}
+		if p.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsGroup == nil {
+			p.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsGroup = pVersion.Spec.SecurityContext.RunAsUser
+		}
 	}
 }
 

diff --git a/apis/kubedb/v1alpha2/pgbouncer_helpers.go b/apis/kubedb/v1alpha2/pgbouncer_helpers.go
@@ -211,8 +211,13 @@ func (p *PgBouncer) SetDefaults(pgBouncerVersion *catalog.PgBouncerVersion, uses
 	}
 
 	p.Spec.Monitor.SetDefaults()
-	if p.Spec.Monitor != nil && p.Spec.Monitor.Prometheus != nil && p.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsUser == nil {
-		p.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsUser = pgBouncerVersion.Spec.SecurityContext.RunAsUser
+	if p.Spec.Monitor != nil && p.Spec.Monitor.Prometheus != nil {
+		if p.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsUser == nil {
+			p.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsUser = pgBouncerVersion.Spec.SecurityContext.RunAsUser
+		}
+		if p.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsGroup == nil {
+			p.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsGroup = pgBouncerVersion.Spec.SecurityContext.RunAsUser
+		}
 	}
 	apis.SetDefaultResourceLimits(&p.Spec.PodTemplate.Spec.Resources, DefaultResources)
 }

diff --git a/apis/kubedb/v1alpha2/postgres_helpers.go b/apis/kubedb/v1alpha2/postgres_helpers.go
@@ -262,13 +262,19 @@ func (p *Postgres) SetDefaults(postgresVersion *catalog.PostgresVersion, topolog
 	// Otherwise, We will get write permission denied.
 	p.Spec.PodTemplate.Spec.SecurityContext.FSGroup = p.Spec.PodTemplate.Spec.ContainerSecurityContext.RunAsGroup
 	p.SetArbiterDefault()
-	p.Spec.Monitor.SetDefaults()
 	p.SetTLSDefaults()
 	p.SetHealthCheckerDefaults()
 	apis.SetDefaultResourceLimits(&p.Spec.PodTemplate.Spec.Resources, DefaultResources)
 	p.setDefaultAffinity(&p.Spec.PodTemplate, p.OffshootSelectors(), topology)
-	if p.Spec.Monitor != nil && p.Spec.Monitor.Prometheus != nil && p.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsUser == nil {
-		p.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsUser = postgresVersion.Spec.SecurityContext.RunAsUser
+
+	p.Spec.Monitor.SetDefaults()
+	if p.Spec.Monitor != nil && p.Spec.Monitor.Prometheus != nil {
+		if p.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsUser == nil {
+			p.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsUser = postgresVersion.Spec.SecurityContext.RunAsUser
+		}
+		if p.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsGroup == nil {
+			p.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsGroup = postgresVersion.Spec.SecurityContext.RunAsUser
+		}
 	}
 }
 

diff --git a/apis/kubedb/v1alpha2/redis_helpers.go b/apis/kubedb/v1alpha2/redis_helpers.go
@@ -241,8 +241,13 @@ func (r *Redis) SetDefaults(rdVersion *catalog.RedisVersion, topology *core_util
 	r.setDefaultAffinity(&r.Spec.PodTemplate, labels, topology)
 
 	r.Spec.Monitor.SetDefaults()
-	if r.Spec.Monitor != nil && r.Spec.Monitor.Prometheus != nil && r.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsUser == nil {
-		r.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsUser = rdVersion.Spec.SecurityContext.RunAsUser
+	if r.Spec.Monitor != nil && r.Spec.Monitor.Prometheus != nil {
+		if r.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsUser == nil {
+			r.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsUser = rdVersion.Spec.SecurityContext.RunAsUser
+		}
+		if r.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsGroup == nil {
+			r.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsGroup = rdVersion.Spec.SecurityContext.RunAsUser
+		}
 	}
 	r.SetTLSDefaults()
 	r.SetHealthCheckerDefaults()

diff --git a/apis/kubedb/v1alpha2/redis_sentinel_helpers.go b/apis/kubedb/v1alpha2/redis_sentinel_helpers.go
@@ -199,8 +199,13 @@ func (rs *RedisSentinel) SetDefaults(rdVersion *catalog.RedisVersion, topology *
 	rs.setDefaultAffinity(&rs.Spec.PodTemplate, rs.OffshootSelectors(), topology)
 
 	rs.Spec.Monitor.SetDefaults()
-	if rs.Spec.Monitor != nil && rs.Spec.Monitor.Prometheus != nil && rs.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsUser == nil {
-		rs.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsUser = rdVersion.Spec.SecurityContext.RunAsUser
+	if rs.Spec.Monitor != nil && rs.Spec.Monitor.Prometheus != nil {
+		if rs.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsUser == nil {
+			rs.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsUser = rdVersion.Spec.SecurityContext.RunAsUser
+		}
+		if rs.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsGroup == nil {
+			rs.Spec.Monitor.Prometheus.Exporter.SecurityContext.RunAsGroup = rdVersion.Spec.SecurityContext.RunAsUser
+		}
 	}
 	rs.SetTLSDefaults()
 	rs.SetHealthCheckerDefaults()

diff --git a/pkg/controller/initializer/restore/kubestash-restoresession.go b/pkg/controller/initializer/restore/kubestash-restoresession.go
@@ -44,6 +44,11 @@ func (r *RestoreSessionReconciler) Reconcile(ctx context.Context, req ctrl.Reque
 		return ctrl.Result{}, client.IgnoreNotFound(err)
 	}
 
+	// Ignore nil target restore sessions. e.g: manifest
+	if rs.Spec.Target == nil {
+		return ctrl.Result{}, nil
+	}
+
 	ri, err := r.ctrl.extractRestoreInfo(rs)
 	if err != nil {
 		klog.Errorln("failed to extract kubeStash invoker info. Reason: ", err)