Merge pull request #1121 from stashed/baseline-psp

Co-authored-by: Tamal Saha <tamal@appscode.com>

Author: tamalsaha

pkg/cmds/server/options.go

@@ -17,7 +17,6 @@ limitations under the License.
 package server
 
 import (
-	"flag"
 	"fmt"
 	"time"
 
@@ -46,6 +45,9 @@ type ExtraOptions struct {
 	ResyncPeriod            time.Duration
 	EnableValidatingWebhook bool
 	EnableMutatingWebhook   bool
+	CronJobPSPNames         []string
+	BackupJobPSPNames       []string
+	RestoreJobPSPNames      []string
 }
 
 func NewExtraOptions() *ExtraOptions {
@@ -61,7 +63,7 @@ func NewExtraOptions() *ExtraOptions {
 	}
 }
 
-func (s *ExtraOptions) AddGoFlags(fs *flag.FlagSet) {
+func (s *ExtraOptions) AddFlags(fs *pflag.FlagSet) {
 	fs.StringVar(&s.ScratchDir, "scratch-dir", s.ScratchDir, "Directory used to store temporary files. Use an `emptyDir` in Kubernetes.")
 	fs.StringVar(&s.StashImageTag, "image-tag", s.StashImageTag, "Image tag for sidecar, init-container, check-job and recovery-job")
 	fs.StringVar(&s.DockerRegistry, "docker-registry", s.DockerRegistry, "Docker image registry for sidecar, init-container, check-job, recovery-job and kubectl-job")
@@ -72,12 +74,10 @@ func (s *ExtraOptions) AddGoFlags(fs *flag.FlagSet) {
 
 	fs.BoolVar(&s.EnableMutatingWebhook, "enable-mutating-webhook", s.EnableMutatingWebhook, "If true, enables mutating webhooks for KubeDB CRDs.")
 	fs.BoolVar(&s.EnableValidatingWebhook, "enable-validating-webhook", s.EnableValidatingWebhook, "If true, enables validating webhooks for KubeDB CRDs.")
-}
 
-func (s *ExtraOptions) AddFlags(fs *pflag.FlagSet) {
-	pfs := flag.NewFlagSet("stash", flag.ExitOnError)
-	s.AddGoFlags(pfs)
-	fs.AddGoFlagSet(pfs)
+	fs.StringSliceVar(&s.CronJobPSPNames, "cron-job-psp", s.CronJobPSPNames, "Name of the PSPs for backup triggering CronJob. Use comma to separate multiple PSP names.")
+	fs.StringSliceVar(&s.BackupJobPSPNames, "backup-job-psp", s.BackupJobPSPNames, "Name of the PSPs for backup job. Use comma to separate multiple PSP names.")
+	fs.StringSliceVar(&s.RestoreJobPSPNames, "restore-job-psp", s.RestoreJobPSPNames, "Name of the PSPs for restore job. Use comma to separate multiple PSP names.")
 }
 
 func (s *ExtraOptions) ApplyTo(cfg *controller.Config) error {
@@ -93,6 +93,10 @@ func (s *ExtraOptions) ApplyTo(cfg *controller.Config) error {
 	cfg.EnableMutatingWebhook = s.EnableMutatingWebhook
 	cfg.EnableValidatingWebhook = s.EnableValidatingWebhook
 
+	cfg.CronJobPSPNames = s.CronJobPSPNames
+	cfg.BackupJobPSPNames = s.BackupJobPSPNames
+	cfg.RestoreJobPSPNames = s.RestoreJobPSPNames
+
 	if cfg.KubeClient, err = kubernetes.NewForConfig(cfg.ClientConfig); err != nil {
 		return err
 	}

pkg/controller/config.go

@@ -52,6 +52,9 @@ type config struct {
 	ResyncPeriod            time.Duration
 	EnableValidatingWebhook bool
 	EnableMutatingWebhook   bool
+	CronJobPSPNames         []string
+	BackupJobPSPNames       []string
+	RestoreJobPSPNames      []string
 }
 
 type Config struct {

pkg/controller/psp.go

@@ -24,21 +24,15 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
-const (
-	DefaultBackupSessionCronJobPSPName = "stash-backupsession-cron"
-	DefaultBackupJobPSPName            = "stash-backup-job"
-	DefaultRestoreJobPSPName           = "stash-restore-job"
-)
-
 func (c *StashController) getBackupSessionCronJobPSPNames() []string {
 	// BackupSession cron does not need any custom PSP. So, default minimum privileged
-	return []string{DefaultBackupSessionCronJobPSPName}
+	return c.CronJobPSPNames
 }
 
 func (c *StashController) getBackupJobPSPNames(taskRef api_v1beta1.TaskRef) ([]string, error) {
 	// if task field is empty then return default backup job psp
 	if taskRef.Name == "" {
-		return []string{DefaultBackupJobPSPName}, nil
+		return c.BackupJobPSPNames, nil
 	}
 
 	// find out task and then functions. finally, get psp names from the functions
@@ -63,13 +57,13 @@ func (c *StashController) getBackupJobPSPNames(taskRef api_v1beta1.TaskRef) ([]s
 	}
 
 	// if no PSP name is specified, then return default PSP for backup job
-	return []string{DefaultBackupJobPSPName}, nil
+	return c.BackupJobPSPNames, nil
 }
 
 func (c *StashController) getRestoreJobPSPNames(restoreSession *api_v1beta1.RestoreSession) ([]string, error) {
 	// if task field is empty then return default restore job psp
 	if restoreSession.Spec.Task.Name == "" {
-		return []string{DefaultRestoreJobPSPName}, nil
+		return c.RestoreJobPSPNames, nil
 	}
 
 	// find out task and then functions. finally, get psp names from the functions
@@ -94,5 +88,5 @@ func (c *StashController) getRestoreJobPSPNames(restoreSession *api_v1beta1.Rest
 	}
 
 	// if no PSP name is specified, then return default PSP for restore job
-	return []string{DefaultRestoreJobPSPName}, nil
+	return c.RestoreJobPSPNames, nil
 }