Add autodetect option to security context configuration #5150
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Update helm values with more documentation around setting default security context
pebrc
reviewed
Dec 15, 2021
barkbay
reviewed
Dec 15, 2021
Co-authored-by: Michael Morello <michael.morello@gmail.com>
Co-authored-by: Michael Morello <michael.morello@gmail.com>
remove erroneous logging line
…lse, auto-detect.
pebrc
requested changes
Jan 10, 2022
pebrc
reviewed
Jan 11, 2022
cmd/manager/main.go
Outdated
| return true, nil | ||
| } | ||
| } | ||
| // if the security.openshift.io group isn't found, we are not in openshift |
There was a problem hiding this comment.
as above let's stick with the official camel casing
naemono
added a commit
to naemono/cloud-on-k8s
that referenced
this pull request
Jan 13, 2022
* Add auto-detect option to setting security context Update helm values with more documentation around setting default security context * Refactor because of linter issues * return invalid security context errors. Co-authored-by: Michael Morello <michael.morello@gmail.com> * simplify logic when detecting openshift Co-authored-by: Michael Morello <michael.morello@gmail.com> * Move openshift detection logic into it's own function remove erroneous logging line * Update to only allow 3 options for setting security context: true, false, auto-detect. * catch api error "not found", and assume not on openshift cluster. * Add unit tests around checking how we set the default security context in/out of openshift. * Update comments per PR review * review changes * Move resources required for test to be directly after the test that uses them. Co-authored-by: Michael Morello <michael.morello@gmail.com>
fantapsody
pushed a commit
to fantapsody/cloud-on-k8s
that referenced
this pull request
Feb 7, 2023
* Add auto-detect option to setting security context Update helm values with more documentation around setting default security context * Refactor because of linter issues * return invalid security context errors. Co-authored-by: Michael Morello <michael.morello@gmail.com> * simplify logic when detecting openshift Co-authored-by: Michael Morello <michael.morello@gmail.com> * Move openshift detection logic into it's own function remove erroneous logging line * Update to only allow 3 options for setting security context: true, false, auto-detect. * catch api error "not found", and assume not on openshift cluster. * Add unit tests around checking how we set the default security context in/out of openshift. * Update comments per PR review * review changes * Move resources required for test to be directly after the test that uses them. Co-authored-by: Michael Morello <michael.morello@gmail.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
resolves #5061
This change adds an option to the
set-default-security-contextflag to help the user with settings that pertain to security context. It adds theauto-detectoption(which is triggered by simply not setting thewhich does the following when set:set-default-security-contextflag)set-default-security-contextflag is explicitly set to either true, or false, use this value.set-default-security-contextflag is set toauto-detect(the default value in helm charts) use openshift detection to determine whether or not we are running within an openshift cluster. If we determine we are on an openshift cluster then default to setting this flag tofalseto allow openshift to set the security context properly, otherwise set this flag totrueto allow the operator to set the security context appropriately.Any other set value will throw a syntax error.
testing
This was tested in both an openshift cluster, and vanilla cluster with the auto-detect option set and the results were as follows
vanilla cluster
Elasticsearch stateful set had the following settings
openshift cluster