From 4b89640470f949c186292003cfc1350b6def53f8 Mon Sep 17 00:00:00 2001 From: Dmitrii Zolotukhin Date: Wed, 15 Jan 2025 18:30:19 +0100 Subject: [PATCH 01/10] Added documentation for new Mx4PC features. --- .../private-cloud-cluster/_index.md | 17 +++++++++++++++++ .../private-cloud/private-cloud-operator.md | 2 ++ .../private-cloud-upgrade-guide.md | 7 +++++++ .../deployment/mendix-for-private-cloud.md | 11 ++++++++++- 4 files changed, 36 insertions(+), 1 deletion(-) diff --git a/content/en/docs/deployment/private-cloud/private-cloud-cluster/_index.md b/content/en/docs/deployment/private-cloud/private-cloud-cluster/_index.md index b02d86d3456..f7cb0501477 100644 --- a/content/en/docs/deployment/private-cloud/private-cloud-cluster/_index.md +++ b/content/en/docs/deployment/private-cloud/private-cloud-cluster/_index.md @@ -938,6 +938,23 @@ In most cases, this option is only needed when an app is partially scaled down ( Some container runtimes or network configurations prevent a terminating pod from receiving traffic or opening new connections. The Mendix Runtime can still use its existing database connections from the connection pool and keep processing any running microflows and requests, but uploading files or calling external REST services may fail. {{% /alert %}} +### Read-only RootFS {#readonlyrootfs} + +Mendix app container images are locked down quite well out of the box - they run as a non-root user, cannot request elevated permissions, and file ownership make all system and non-critical paths read-only. + +Kubernetes allows to lock down containers even further, by mounting the container filesystem as read-only - if the container's security context specifies [readOnlyRootFilesystem: true](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/). +With this option enabled, any files and paths from the container image are impossible to modify by any user. + +Starting from Mendix Operator version 2.21.0, all system containers and pods use `readOnlyRootFilesystem` by default, and it's possible to specify if an environment's app container should also have a read-only filesystem. + +For Mendix apps, the `readOnlyRootFilesystem` option is off by default, as some Java actions in marketplace modules might expect some paths to be writable. + +By enabling the `runtimeReadOnlyRootFilesystem` option in the MendixApp CRD (for standalone clusters) or in the Private Cloud Portal, the Mendix app container will also use a read-only root filesystem. +As Mendix apps needs certain paths to be writable, an [emptyDir](https://kubernetes.io/docs/concepts/storage/volumes/#emptydir) will be used for writable paths. +Each path is mounted as a separate `subPath` to keep data separated. +The `emptyDir` size is set to the `ephemeral-storage` [resource limit](#advanced-resource-customization). +In addition to internal Mendix Runtime paths, `/tmp` is mounted for any temporary files that might be created through Java actions; for Java actions to work correctly, please make sure they only create files in `/tmp`, for example by using `File.createTempFile` or `File.createTempDirectory` Java methods. + ### GKE Autopilot Workarounds {#gke-autopilot-workarounds} In GKE Autopilot, one of the key features is its ability to automatically adjust resource settings based on the observed resource utilization of the containers. GKE Autopilot verifies the resource allocations and limits for all containers, and makes adjustments to deployments when the resources are not as per its requirements. diff --git a/content/en/docs/deployment/private-cloud/private-cloud-operator.md b/content/en/docs/deployment/private-cloud/private-cloud-operator.md index f28908c2225..f5ae1cf9f00 100644 --- a/content/en/docs/deployment/private-cloud/private-cloud-operator.md +++ b/content/en/docs/deployment/private-cloud/private-cloud-operator.md @@ -173,6 +173,7 @@ spec: rollingUpdate: maxSurge: 0 maxUnavailable: 50% + runtimeReadOnlyRootFilesystem: true # Optional: specify if the Mendix Runtime container should use a read-only root filesystem ``` You need to make the following changes: @@ -230,6 +231,7 @@ You need to make the following changes: * **customPodLabels** - specify additional pod labels (please avoid using labels that start with the `privatecloud.mendix.com/` prefix) * **general** - specify additional labels for all pods of the app * **deploymentStrategy** - specify parameters for the deployment strategy; for more information, see the reduced downtime deployment documentation. +* **runtimeReadOnlyRootFilesystem** - specify if the Runtime container should mount the root filesystem in [read-only mode](/developerportal/deploy/private-cloud-cluster/#readonlyrootfs). #### Setting App Constants{#set-app-constants} diff --git a/content/en/docs/deployment/private-cloud/private-cloud-upgrade-guide.md b/content/en/docs/deployment/private-cloud/private-cloud-upgrade-guide.md index 44117a4c4d7..fa72b47229b 100644 --- a/content/en/docs/deployment/private-cloud/private-cloud-upgrade-guide.md +++ b/content/en/docs/deployment/private-cloud/private-cloud-upgrade-guide.md @@ -12,11 +12,18 @@ This document describes how an existing installation of Mendix for Private Cloud This procedure allows you to upgrade to any supported (v1.9.0 and later) version of the Mendix for Private Cloud Operator. {{% alert color="warning" %}} +Read this carefully when + +* using the `mxpc-cli` installation and configuration tool version 2.20.1 or earlier; +* or manually installing or upgrading CRDs with `kubectl apply`. + Upgrading the Mendix for Private Cloud Operator in a namespace will modify global resources such as Mendix Custom Resource Definitions in the cluster. [Custom Resource Definitions](https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/) allow Mendix applications to be managed with Kubernetes APIs and tools such as `kubectl` and `oc`. Once you have installed a particular version of the Mendix Operator into any namespace in the cluster, you should not install older versions of the Mendix Operator into the same cluster, even if they are in other namespaces. This is because all the CRDs are global resources and operators in all namespaces use the same one, which may not be compatible across versions. + +Starting from `mxpc-cli` version 2.21.0, the installation or upgrade process will check to see if the cluster has a newer CRD version than the CRDs bundled with `mxpc-cli`. If the cluster has newer CRDs, `mxpc-cli` will skip the CRD installation step - and avoid downgrading CRDs. {{% /alert %}} If you are using your own private registry, follow the [Migrating to Your Own Registry](/developerportal/deploy/private-cloud-migrating/) guide first diff --git a/content/en/docs/releasenotes/deployment/mendix-for-private-cloud.md b/content/en/docs/releasenotes/deployment/mendix-for-private-cloud.md index 3ea0173cebe..b481e8d32a7 100644 --- a/content/en/docs/releasenotes/deployment/mendix-for-private-cloud.md +++ b/content/en/docs/releasenotes/deployment/mendix-for-private-cloud.md @@ -28,6 +28,15 @@ For information on the current status of deployment to Mendix for Private Cloud ## 2024 +### January ???, 2025 + +#### Mendix Operator v2.21.0 {#2.21.0} + +* We have switched all system containers to use a read-only root filesystem, and added an option to run Mendix app containers with a read-only rootfs. +* We have added a check in `mxpc-cli` to prevent CRD downgrades; starting from `mxpc-cli` version 2.21.0, the installation or upgrade process will keep cluster CRDs unchanged if the cluster has newer CRDs (compared to what is included with the installer). +* We have updated components to use the latest dependency versions in order to improve security score ratings for container images. +* Upgrading to Mendix Operator v2.21.0 from a previous version will restart environments managed by that version of the Operator. Environments with 2 or more replicas and a **PreferRolling** update strategy will be restarted without downtime. + ### December 16, 2024 #### Mendix Operator v2.20.1 {#2.20.1} @@ -38,7 +47,7 @@ For information on the current status of deployment to Mendix for Private Cloud * We have updated a library used to validate licenses to the latest non-alpha version. * We have updated documentation that OpenShift 4.17 and Postgres 17 are supported by the Mendix Operator. * We have addressed a rare deadlock situation which could prevent a failing environment from restarting. -* Upgrading to Mendix Operator v2.20.0 from a previous version will restart environments managed by that version of the Operator. Environments with 2 or more replicas and a **PreferRolling** update strategy will be restarted without downtime. +* Upgrading to Mendix Operator v2.20.1 from a previous version will restart environments managed by that version of the Operator. Environments with 2 or more replicas and a **PreferRolling** update strategy will be restarted without downtime. #### Known Limitations From 7887ec60b3b1256749aae78be9128ed3ebfbf824 Mon Sep 17 00:00:00 2001 From: Dmitrii Zolotukhin Date: Thu, 16 Jan 2025 14:51:13 +0100 Subject: [PATCH 02/10] Added note to always enable readonlyrootfs whenever possible. --- .../deployment/private-cloud/private-cloud-cluster/_index.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/content/en/docs/deployment/private-cloud/private-cloud-cluster/_index.md b/content/en/docs/deployment/private-cloud/private-cloud-cluster/_index.md index f7cb0501477..57e93ab4476 100644 --- a/content/en/docs/deployment/private-cloud/private-cloud-cluster/_index.md +++ b/content/en/docs/deployment/private-cloud/private-cloud-cluster/_index.md @@ -955,6 +955,11 @@ Each path is mounted as a separate `subPath` to keep data separated. The `emptyDir` size is set to the `ephemeral-storage` [resource limit](#advanced-resource-customization). In addition to internal Mendix Runtime paths, `/tmp` is mounted for any temporary files that might be created through Java actions; for Java actions to work correctly, please make sure they only create files in `/tmp`, for example by using `File.createTempFile` or `File.createTempDirectory` Java methods. +{{% alert color="info" %}} +If your app works without issues when read-only root filesystem is enabled, it's best to enable it wherever possible. +We recommend using a non-production environment to validate that your app keeps working correctly. +{{% /alert %}} + ### GKE Autopilot Workarounds {#gke-autopilot-workarounds} In GKE Autopilot, one of the key features is its ability to automatically adjust resource settings based on the observed resource utilization of the containers. GKE Autopilot verifies the resource allocations and limits for all containers, and makes adjustments to deployments when the resources are not as per its requirements. From d296412abe356f2ae2d83840d7b9d8a61f1d2b2e Mon Sep 17 00:00:00 2001 From: Dmitrii Zolotukhin Date: Wed, 12 Feb 2025 10:34:27 +0100 Subject: [PATCH 03/10] Updated release notes. --- .../deployment/mendix-for-private-cloud.md | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/content/en/docs/releasenotes/deployment/mendix-for-private-cloud.md b/content/en/docs/releasenotes/deployment/mendix-for-private-cloud.md index b481e8d32a7..5c99bddad1a 100644 --- a/content/en/docs/releasenotes/deployment/mendix-for-private-cloud.md +++ b/content/en/docs/releasenotes/deployment/mendix-for-private-cloud.md @@ -12,6 +12,16 @@ For information on the current status of deployment to Mendix for Private Cloud ## 2025 +### February 19, 2025 + +#### Mendix Operator v2.21.0 {#2.21.0} + +* We have switched all system containers to use a read-only root filesystem, and added an option to run Mendix app containers with a read-only rootfs. +* We have added a check in `mxpc-cli` to prevent CRD downgrades; starting from `mxpc-cli` version 2.21.0, the installation or upgrade process will keep cluster CRDs unchanged if the cluster has newer CRDs (compared to what is included with the installer). +* We have updated components to use the latest dependency versions in order to improve security score ratings for container images. +* We have fixed a _Failed to determine if DDL migration needs approval_ error message that sometimes appeared when using a **Recreate** deployment strategy. This error message doesn't mean there's an issue and can be ignored. +* Upgrading to Mendix Operator v2.21.0 from a previous version will restart environments managed by that version of the Operator. Environments with 2 or more replicas and a **PreferRolling** update strategy will be restarted without downtime. + ### February 12, 2025 #### Documentation Updates @@ -28,15 +38,6 @@ For information on the current status of deployment to Mendix for Private Cloud ## 2024 -### January ???, 2025 - -#### Mendix Operator v2.21.0 {#2.21.0} - -* We have switched all system containers to use a read-only root filesystem, and added an option to run Mendix app containers with a read-only rootfs. -* We have added a check in `mxpc-cli` to prevent CRD downgrades; starting from `mxpc-cli` version 2.21.0, the installation or upgrade process will keep cluster CRDs unchanged if the cluster has newer CRDs (compared to what is included with the installer). -* We have updated components to use the latest dependency versions in order to improve security score ratings for container images. -* Upgrading to Mendix Operator v2.21.0 from a previous version will restart environments managed by that version of the Operator. Environments with 2 or more replicas and a **PreferRolling** update strategy will be restarted without downtime. - ### December 16, 2024 #### Mendix Operator v2.20.1 {#2.20.1} From ca0b1fa3e3c011647c43d40d24274a3242de9fad Mon Sep 17 00:00:00 2001 From: Dmitrii Zolotukhin Date: Fri, 14 Feb 2025 15:54:04 +0100 Subject: [PATCH 04/10] Documented that ephemeral-storage limits might need adjustment after upgrading. Added default ephemeral-storage values in examples. --- .../private-cloud-cluster/_index.md | 16 ++++++++++++++++ .../deployment/mendix-for-private-cloud.md | 7 +++++++ 2 files changed, 23 insertions(+) diff --git a/content/en/docs/deployment/private-cloud/private-cloud-cluster/_index.md b/content/en/docs/deployment/private-cloud/private-cloud-cluster/_index.md index 57e93ab4476..1ad44f8d2a9 100644 --- a/content/en/docs/deployment/private-cloud/private-cloud-cluster/_index.md +++ b/content/en/docs/deployment/private-cloud/private-cloud-cluster/_index.md @@ -439,9 +439,11 @@ spec: limits: cpu: 1 memory: 512Mi + ephemeral-storage: 4Mi requests: cpu: 100m memory: 512Mi + ephemeral-storage: 4Mi # ... # omitted lines for brevity # ... @@ -462,30 +464,38 @@ spec: limits: cpu: 250m memory: 32Mi + ephemeral-storage: 4Mi requests: cpu: 100m memory: 16Mi + ephemeral-storage: 4Mi metricsSidecarResources: limits: cpu: 100m memory: 32Mi + ephemeral-storage: 4Mi requests: cpu: 100m memory: 16Mi + ephemeral-storage: 4Mi buildResources: limits: cpu: '1' memory: 256Mi + ephemeral-storage: 2Gi requests: cpu: 250m memory: 64Mi + ephemeral-storage: 2Gi runtimeResources: limits: cpu: 1000m memory: 512Mi + ephemeral-storage: 256Mi requests: cpu: 100m memory: 512Mi + ephemeral-storage: 256Mi runtimeLivenessProbe: initialDelaySeconds: 60 periodSeconds: 15 @@ -629,9 +639,11 @@ resources: limits: cpu: 1 memory: 512Mi + ephemeral-storage: 256Mi requests: cpu: 100m memory: 512Mi + ephemeral-storage: 256Mi ``` This section allows the configuration of the lower and upper resource boundaries, the `requests` and `limits` respectively. @@ -976,16 +988,20 @@ spec: limits: cpu: "1" memory: 256Mi + ephemeral-storage: 2Gi requests: cpu: "1" memory: 256Mi + ephemeral-storage: 2Gi metricsSidecarResources: limits: cpu: 100m memory: 32Mi + ephemeral-storage: 4Mi requests: cpu: 100m memory: 32Mi + ephemeral-storage: 4Mi ``` Run the following command in order to update the core resources in the `OperatorConfiguration`: diff --git a/content/en/docs/releasenotes/deployment/mendix-for-private-cloud.md b/content/en/docs/releasenotes/deployment/mendix-for-private-cloud.md index 5c99bddad1a..17202f4d4dc 100644 --- a/content/en/docs/releasenotes/deployment/mendix-for-private-cloud.md +++ b/content/en/docs/releasenotes/deployment/mendix-for-private-cloud.md @@ -17,11 +17,18 @@ For information on the current status of deployment to Mendix for Private Cloud #### Mendix Operator v2.21.0 {#2.21.0} * We have switched all system containers to use a read-only root filesystem, and added an option to run Mendix app containers with a read-only rootfs. +* We have added a default on ephemeral storage usage - to ensure that temporary file storage is reserved and is limited, so that a container gets a guaranteed amount of temporary file storage that cannot be exceeded. * We have added a check in `mxpc-cli` to prevent CRD downgrades; starting from `mxpc-cli` version 2.21.0, the installation or upgrade process will keep cluster CRDs unchanged if the cluster has newer CRDs (compared to what is included with the installer). * We have updated components to use the latest dependency versions in order to improve security score ratings for container images. * We have fixed a _Failed to determine if DDL migration needs approval_ error message that sometimes appeared when using a **Recreate** deployment strategy. This error message doesn't mean there's an issue and can be ignored. * Upgrading to Mendix Operator v2.21.0 from a previous version will restart environments managed by that version of the Operator. Environments with 2 or more replicas and a **PreferRolling** update strategy will be restarted without downtime. +#### Known Issue + +With the introduction of ephemeral storage requests and limits, building an app requires at least 2GB of ephemeral storage available on the Kubernetes node. +If your nodes don't have enough temporary storage, build pods won't be able to start and will stay in a `Pending` phase. +To resolve this issue, you can lower the valus for `ephemeral-storage` in the [buildResources](/developerportal/deploy/private-cloud-cluster/#resource-definition-ocm) configuration. + ### February 12, 2025 #### Documentation Updates From ebe3b544683846f24b81b67edfb3adf8f0ff7dff Mon Sep 17 00:00:00 2001 From: Dmitrii Zolotukhin Date: Fri, 14 Feb 2025 16:01:35 +0100 Subject: [PATCH 05/10] Rephrased readonlyrootfs docs. Added ephemeral-storage limits/examples for standalone users. --- .../private-cloud/private-cloud-cluster/_index.md | 6 +++--- .../docs/deployment/private-cloud/private-cloud-operator.md | 2 ++ 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/content/en/docs/deployment/private-cloud/private-cloud-cluster/_index.md b/content/en/docs/deployment/private-cloud/private-cloud-cluster/_index.md index 1ad44f8d2a9..3c2d92be165 100644 --- a/content/en/docs/deployment/private-cloud/private-cloud-cluster/_index.md +++ b/content/en/docs/deployment/private-cloud/private-cloud-cluster/_index.md @@ -952,10 +952,10 @@ Some container runtimes or network configurations prevent a terminating pod from ### Read-only RootFS {#readonlyrootfs} -Mendix app container images are locked down quite well out of the box - they run as a non-root user, cannot request elevated permissions, and file ownership make all system and non-critical paths read-only. +Mendix app container images are locked down reasonably well out of the box - they run as a non-root user, cannot request elevated permissions, and file ownership and permissions prevent modification of system and critical paths. Kubernetes allows to lock down containers even further, by mounting the container filesystem as read-only - if the container's security context specifies [readOnlyRootFilesystem: true](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/). -With this option enabled, any files and paths from the container image are impossible to modify by any user. +With this option enabled, any files and paths from the container image cannot be modified by any user. Starting from Mendix Operator version 2.21.0, all system containers and pods use `readOnlyRootFilesystem` by default, and it's possible to specify if an environment's app container should also have a read-only filesystem. @@ -969,7 +969,7 @@ In addition to internal Mendix Runtime paths, `/tmp` is mounted for any temporar {{% alert color="info" %}} If your app works without issues when read-only root filesystem is enabled, it's best to enable it wherever possible. -We recommend using a non-production environment to validate that your app keeps working correctly. +We recommend using a non-production environment to validate that your app keeps working correctly with a read-only RootFS. {{% /alert %}} ### GKE Autopilot Workarounds {#gke-autopilot-workarounds} diff --git a/content/en/docs/deployment/private-cloud/private-cloud-operator.md b/content/en/docs/deployment/private-cloud/private-cloud-operator.md index f5ae1cf9f00..db0ad20ec52 100644 --- a/content/en/docs/deployment/private-cloud/private-cloud-operator.md +++ b/content/en/docs/deployment/private-cloud/private-cloud-operator.md @@ -79,9 +79,11 @@ spec: limits: # Upper limit - process will be stopped if it tries to use more cpu: 500m # 500 millicores - half of a vCPU memory: 512Mi # 512 megabytes - suitable for small-scale non-production apps + ephemeral-storage: 256Mi # 256 megabytes - for temporary files such as generated Excel documents requests: # Lower limit - needs at least these resources cpu: 250m memory: 256Mi + ephemeral-storage: 256Mi runtimeDeploymentPodAnnotations: # Optional, can be omitted : set custom annotations for Mendix Runtime Pods # example: inject the Linkerd proxy sidecar linkerd.io/inject: enabled From 2f6146ee55fdee803ced057e6774d78be9962da8 Mon Sep 17 00:00:00 2001 From: Dmitrii Zolotukhin Date: Mon, 17 Feb 2025 12:56:39 +0100 Subject: [PATCH 06/10] Addressed review comments. Added note that k8s 1.32 is supported. --- .../private-cloud/private-cloud-supported-environments.md | 4 ++-- .../releasenotes/deployment/mendix-for-private-cloud.md | 7 ++++--- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/content/en/docs/deployment/private-cloud/private-cloud-supported-environments.md b/content/en/docs/deployment/private-cloud/private-cloud-supported-environments.md index 7a2a7596dc5..8b2cd41e924 100644 --- a/content/en/docs/deployment/private-cloud/private-cloud-supported-environments.md +++ b/content/en/docs/deployment/private-cloud/private-cloud-supported-environments.md @@ -36,7 +36,7 @@ If deploying to Red Hat OpenShift, you need to specify that specifically when cr Mendix for Private Cloud Operator `v2.*.*` is the latest version which officially supports: -* Kubernetes versions 1.19 through 1.31 +* Kubernetes versions 1.19 through 1.32 * OpenShift 4.6 through 4.17 {{% alert color="warning" %}} @@ -65,7 +65,7 @@ To install the Mendix Operator, the cluster administrator will need permissions * Create roles in the target namespace or project * Create role bindings in the target namespace or project -The cluster should have at least 2 CPU cores and 2 GB memory *available*. This is enough to run one simple app - but does not include additional resources required by Kubernetes core components. +The cluster should have at least 2 CPU cores, 2 GB memory and 3GB ephemeral-storage *available* on a Kubernetes node. This is enough to run one simple app - but does not include additional resources required by Kubernetes core components. In OpenShift, the cluster administrator must have a `system:admin` role. diff --git a/content/en/docs/releasenotes/deployment/mendix-for-private-cloud.md b/content/en/docs/releasenotes/deployment/mendix-for-private-cloud.md index 17202f4d4dc..251886ce5f2 100644 --- a/content/en/docs/releasenotes/deployment/mendix-for-private-cloud.md +++ b/content/en/docs/releasenotes/deployment/mendix-for-private-cloud.md @@ -16,14 +16,15 @@ For information on the current status of deployment to Mendix for Private Cloud #### Mendix Operator v2.21.0 {#2.21.0} -* We have switched all system containers to use a read-only root filesystem, and added an option to run Mendix app containers with a read-only rootfs. +* We have switched all system containers to use a read-only root filesystem. For Mendix app containers, we added an option to use a read-only rootfs, which is disabled by default. * We have added a default on ephemeral storage usage - to ensure that temporary file storage is reserved and is limited, so that a container gets a guaranteed amount of temporary file storage that cannot be exceeded. * We have added a check in `mxpc-cli` to prevent CRD downgrades; starting from `mxpc-cli` version 2.21.0, the installation or upgrade process will keep cluster CRDs unchanged if the cluster has newer CRDs (compared to what is included with the installer). * We have updated components to use the latest dependency versions in order to improve security score ratings for container images. -* We have fixed a _Failed to determine if DDL migration needs approval_ error message that sometimes appeared when using a **Recreate** deployment strategy. This error message doesn't mean there's an issue and can be ignored. +* We have fixed a *Failed to determine if DDL migration needs approval* error message that sometimes appeared when using a **Recreate** deployment strategy. This error message doesn't mean there's an issue and can be ignored. +* We have updated documentation that Kubernetes 1.32 is supported by the Mendix Operator. * Upgrading to Mendix Operator v2.21.0 from a previous version will restart environments managed by that version of the Operator. Environments with 2 or more replicas and a **PreferRolling** update strategy will be restarted without downtime. -#### Known Issue +#### Important note for upgrading With the introduction of ephemeral storage requests and limits, building an app requires at least 2GB of ephemeral storage available on the Kubernetes node. If your nodes don't have enough temporary storage, build pods won't be able to start and will stay in a `Pending` phase. From f1d731a52490e3b2c54e3d928566c0282210f38e Mon Sep 17 00:00:00 2001 From: katarzyna-koltun-mx <108737161+katarzyna-koltun-mx@users.noreply.github.com> Date: Tue, 18 Feb 2025 16:37:06 +0100 Subject: [PATCH 07/10] Update mendix-for-private-cloud.md --- .../deployment/mendix-for-private-cloud.md | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/content/en/docs/releasenotes/deployment/mendix-for-private-cloud.md b/content/en/docs/releasenotes/deployment/mendix-for-private-cloud.md index 251886ce5f2..78a0ec3b7bb 100644 --- a/content/en/docs/releasenotes/deployment/mendix-for-private-cloud.md +++ b/content/en/docs/releasenotes/deployment/mendix-for-private-cloud.md @@ -17,18 +17,16 @@ For information on the current status of deployment to Mendix for Private Cloud #### Mendix Operator v2.21.0 {#2.21.0} * We have switched all system containers to use a read-only root filesystem. For Mendix app containers, we added an option to use a read-only rootfs, which is disabled by default. -* We have added a default on ephemeral storage usage - to ensure that temporary file storage is reserved and is limited, so that a container gets a guaranteed amount of temporary file storage that cannot be exceeded. -* We have added a check in `mxpc-cli` to prevent CRD downgrades; starting from `mxpc-cli` version 2.21.0, the installation or upgrade process will keep cluster CRDs unchanged if the cluster has newer CRDs (compared to what is included with the installer). +* We have added a default on ephemeral storage usage to ensure that temporary file storage is reserved and is limited, so that a container gets a guaranteed amount of temporary file storage that cannot be exceeded. +* We have added a check in `mxpc-cli` to prevent CRD downgrades; starting from `mxpc-cli` version 2.21.0, the installation or upgrade process will keep cluster CRDs unchanged if the cluster has newer CRDs than what is included with the installer. * We have updated components to use the latest dependency versions in order to improve security score ratings for container images. -* We have fixed a *Failed to determine if DDL migration needs approval* error message that sometimes appeared when using a **Recreate** deployment strategy. This error message doesn't mean there's an issue and can be ignored. -* We have updated documentation that Kubernetes 1.32 is supported by the Mendix Operator. +* We have fixed a *Failed to determine if DDL migration needs approval* error message that sometimes appeared when using a **Recreate** deployment strategy. This error message does not mean that there is an issue, and can therefore be ignored. +* We have updated documentation with information that Kubernetes 1.32 is supported by the Mendix Operator. * Upgrading to Mendix Operator v2.21.0 from a previous version will restart environments managed by that version of the Operator. Environments with 2 or more replicas and a **PreferRolling** update strategy will be restarted without downtime. -#### Important note for upgrading +#### Important Upgrade Information -With the introduction of ephemeral storage requests and limits, building an app requires at least 2GB of ephemeral storage available on the Kubernetes node. -If your nodes don't have enough temporary storage, build pods won't be able to start and will stay in a `Pending` phase. -To resolve this issue, you can lower the valus for `ephemeral-storage` in the [buildResources](/developerportal/deploy/private-cloud-cluster/#resource-definition-ocm) configuration. +With the introduction of ephemeral storage requests and limits, building an app requires at least 2 GB of ephemeral storage available on the Kubernetes node. If your nodes do not have enough temporary storage, the build pods cannot start and their status remains **Pending**. To resolve this issue, you can lower the values for `ephemeral-storage` in the [buildResources](/developerportal/deploy/private-cloud-cluster/#resource-definition-ocm) configuration. ### February 12, 2025 From f3e89d1122c4cb7244588042c75d69d3359f4ffb Mon Sep 17 00:00:00 2001 From: katarzyna-koltun-mx <108737161+katarzyna-koltun-mx@users.noreply.github.com> Date: Wed, 19 Feb 2025 10:40:04 +0100 Subject: [PATCH 08/10] Update private-cloud-upgrade-guide.md --- .../private-cloud/private-cloud-upgrade-guide.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/content/en/docs/deployment/private-cloud/private-cloud-upgrade-guide.md b/content/en/docs/deployment/private-cloud/private-cloud-upgrade-guide.md index fa72b47229b..0b96c7b8c60 100644 --- a/content/en/docs/deployment/private-cloud/private-cloud-upgrade-guide.md +++ b/content/en/docs/deployment/private-cloud/private-cloud-upgrade-guide.md @@ -12,10 +12,10 @@ This document describes how an existing installation of Mendix for Private Cloud This procedure allows you to upgrade to any supported (v1.9.0 and later) version of the Mendix for Private Cloud Operator. {{% alert color="warning" %}} -Read this carefully when +There are special considerations that you must be aware of in the following cases: -* using the `mxpc-cli` installation and configuration tool version 2.20.1 or earlier; -* or manually installing or upgrading CRDs with `kubectl apply`. +* when using the `mxpc-cli` installation and configuration tool version 2.20.1 or earlier. +* when manually installing or upgrading CRDs with `kubectl apply`. Upgrading the Mendix for Private Cloud Operator in a namespace will modify global resources such as Mendix Custom Resource Definitions in the cluster. @@ -23,7 +23,7 @@ Upgrading the Mendix for Private Cloud Operator in a namespace will modify globa Once you have installed a particular version of the Mendix Operator into any namespace in the cluster, you should not install older versions of the Mendix Operator into the same cluster, even if they are in other namespaces. This is because all the CRDs are global resources and operators in all namespaces use the same one, which may not be compatible across versions. -Starting from `mxpc-cli` version 2.21.0, the installation or upgrade process will check to see if the cluster has a newer CRD version than the CRDs bundled with `mxpc-cli`. If the cluster has newer CRDs, `mxpc-cli` will skip the CRD installation step - and avoid downgrading CRDs. +Starting from `mxpc-cli` version 2.21.0, the installation or upgrade process checks to see if the CRDs in the cluster are newer than the CRDs bundled with `mxpc-cli`. If the cluster has newer CRDs, `mxpc-cli` will skip the CRD installation step and avoid downgrading CRDs. {{% /alert %}} If you are using your own private registry, follow the [Migrating to Your Own Registry](/developerportal/deploy/private-cloud-migrating/) guide first From a60b0b8a468c0f4807b2347eb89aaf49a3a36c68 Mon Sep 17 00:00:00 2001 From: katarzyna-koltun-mx <108737161+katarzyna-koltun-mx@users.noreply.github.com> Date: Wed, 19 Feb 2025 10:40:40 +0100 Subject: [PATCH 09/10] Update private-cloud-supported-environments.md --- .../private-cloud/private-cloud-supported-environments.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/deployment/private-cloud/private-cloud-supported-environments.md b/content/en/docs/deployment/private-cloud/private-cloud-supported-environments.md index 8b2cd41e924..496530090ec 100644 --- a/content/en/docs/deployment/private-cloud/private-cloud-supported-environments.md +++ b/content/en/docs/deployment/private-cloud/private-cloud-supported-environments.md @@ -65,7 +65,7 @@ To install the Mendix Operator, the cluster administrator will need permissions * Create roles in the target namespace or project * Create role bindings in the target namespace or project -The cluster should have at least 2 CPU cores, 2 GB memory and 3GB ephemeral-storage *available* on a Kubernetes node. This is enough to run one simple app - but does not include additional resources required by Kubernetes core components. +The cluster should have at least 2 CPU cores, 2 GB memory and 3 GB ephemeral-storage available on a Kubernetes node. This is enough to run one simple app, but does not include additional resources required by Kubernetes core components. In OpenShift, the cluster administrator must have a `system:admin` role. From bed4e45d3f9d65e7e81dbb743e687bc17e7a6fe8 Mon Sep 17 00:00:00 2001 From: katarzyna-koltun-mx <108737161+katarzyna-koltun-mx@users.noreply.github.com> Date: Wed, 19 Feb 2025 10:46:16 +0100 Subject: [PATCH 10/10] Update _index.md --- .../private-cloud-cluster/_index.md | 18 +++++------------- 1 file changed, 5 insertions(+), 13 deletions(-) diff --git a/content/en/docs/deployment/private-cloud/private-cloud-cluster/_index.md b/content/en/docs/deployment/private-cloud/private-cloud-cluster/_index.md index 3c2d92be165..90588ef6961 100644 --- a/content/en/docs/deployment/private-cloud/private-cloud-cluster/_index.md +++ b/content/en/docs/deployment/private-cloud/private-cloud-cluster/_index.md @@ -952,24 +952,16 @@ Some container runtimes or network configurations prevent a terminating pod from ### Read-only RootFS {#readonlyrootfs} -Mendix app container images are locked down reasonably well out of the box - they run as a non-root user, cannot request elevated permissions, and file ownership and permissions prevent modification of system and critical paths. +Mendix app container images are locked down by default - they run as a non-root user, cannot request elevated permissions, and file ownership and permissions prevent modification of system and critical paths. Kubernetes allows you to lock down containers even further, by mounting the container filesystem as read-only if the container's security context specifies [readOnlyRootFilesystem: true](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/). With this option enabled, any files and paths from the container image cannot be modified by any user. -Kubernetes allows to lock down containers even further, by mounting the container filesystem as read-only - if the container's security context specifies [readOnlyRootFilesystem: true](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/). -With this option enabled, any files and paths from the container image cannot be modified by any user. +Starting from Mendix Operator version 2.21.0, all system containers and pods use `readOnlyRootFilesystem` by default. It is possible to specify if an environment's app container should also have a read-only filesystem. For Mendix apps, the `readOnlyRootFilesystem` option is off by default, as some Java actions in marketplace modules might expect some paths to be writable. -Starting from Mendix Operator version 2.21.0, all system containers and pods use `readOnlyRootFilesystem` by default, and it's possible to specify if an environment's app container should also have a read-only filesystem. +If you enable the `runtimeReadOnlyRootFilesystem` option in the MendixApp CRD (for standalone clusters) or in the Private Cloud Portal, the Mendix app container also uses a read-only root filesystem. As Mendix apps needs certain paths to be writable, an [emptyDir](https://kubernetes.io/docs/concepts/storage/volumes/#emptydir) is used for writable paths. Each path is mounted as a separate `subPath` to keep data separated. The `emptyDir` size is set to the `ephemeral-storage` [resource limit](#advanced-resource-customization). -For Mendix apps, the `readOnlyRootFilesystem` option is off by default, as some Java actions in marketplace modules might expect some paths to be writable. - -By enabling the `runtimeReadOnlyRootFilesystem` option in the MendixApp CRD (for standalone clusters) or in the Private Cloud Portal, the Mendix app container will also use a read-only root filesystem. -As Mendix apps needs certain paths to be writable, an [emptyDir](https://kubernetes.io/docs/concepts/storage/volumes/#emptydir) will be used for writable paths. -Each path is mounted as a separate `subPath` to keep data separated. -The `emptyDir` size is set to the `ephemeral-storage` [resource limit](#advanced-resource-customization). -In addition to internal Mendix Runtime paths, `/tmp` is mounted for any temporary files that might be created through Java actions; for Java actions to work correctly, please make sure they only create files in `/tmp`, for example by using `File.createTempFile` or `File.createTempDirectory` Java methods. +In addition to internal Mendix Runtime paths, `/tmp` is mounted for any temporary files that might be created through Java actions. For Java actions to work correctly, ensure that they only create files in `/tmp`, for example, by using the `File.createTempFile` or `File.createTempDirectory` Java methods. {{% alert color="info" %}} -If your app works without issues when read-only root filesystem is enabled, it's best to enable it wherever possible. -We recommend using a non-production environment to validate that your app keeps working correctly with a read-only RootFS. +If your app works without issues when read-only root filesystem is enabled, it is best to enable it wherever possible. We recommend using a non-production environment to validate that your app keeps working correctly with a read-only RootFS. {{% /alert %}} ### GKE Autopilot Workarounds {#gke-autopilot-workarounds}