You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@polaris.apache.org by ad...@apache.org on 2025/01/07 13:23:09 UTC
(polaris) branch main updated: Add securityContext to initContainers (#602)
This is an automated email from the ASF dual-hosted git repository.
adutra pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/polaris.git
The following commit(s) were added to refs/heads/main by this push:
new f898b2c9 Add securityContext to initContainers (#602)
f898b2c9 is described below
commit f898b2c9f37b780b66bdcfcc174c80ef57ec0adb
Author: Gerrit-K <Ge...@users.noreply.github.com>
AuthorDate: Tue Jan 7 14:23:03 2025 +0100
Add securityContext to initContainers (#602)
---
helm/polaris/templates/deployment.yaml | 4 ++++
helm/polaris/templates/job.yaml | 4 ++++
helm/polaris/tests/deployment_test.yaml | 24 ++++++++++++++++++++++++
helm/polaris/tests/job_test.yaml | 26 ++++++++++++++++++++++++++
4 files changed, 58 insertions(+)
diff --git a/helm/polaris/templates/deployment.yaml b/helm/polaris/templates/deployment.yaml
index 463e9f2f..286baafd 100644
--- a/helm/polaris/templates/deployment.yaml
+++ b/helm/polaris/templates/deployment.yaml
@@ -56,6 +56,10 @@ spec:
imagePullPolicy: {{ tpl .Values.toolsImage.pullPolicy . }}
command: ["jar"]
args: ["-cf", "/eclipselink-config/conf.jar", "-C", "/secret", "persistence.xml"]
+ {{- if .Values.securityContext}}
+ securityContext:
+ {{- tpl (toYaml .Values.securityContext) . | nindent 12 }}
+ {{- end }}
volumeMounts:
- name: eclipselink-config-volume
mountPath: /eclipselink-config
diff --git a/helm/polaris/templates/job.yaml b/helm/polaris/templates/job.yaml
index 5709f5c4..5dc54b2b 100644
--- a/helm/polaris/templates/job.yaml
+++ b/helm/polaris/templates/job.yaml
@@ -50,6 +50,10 @@ spec:
imagePullPolicy: {{ tpl .Values.toolsImage.pullPolicy . }}
command: ["jar"]
args: ["-cf", "/eclipselink-config/conf.jar", "-C", "/secret", "persistence.xml"]
+ {{- if .Values.securityContext}}
+ securityContext:
+ {{- tpl (toYaml .Values.securityContext) . | nindent 12 }}
+ {{- end }}
volumeMounts:
- name: eclipselink-config-volume
mountPath: /eclipselink-config
diff --git a/helm/polaris/tests/deployment_test.yaml b/helm/polaris/tests/deployment_test.yaml
index b87177fb..161f2738 100644
--- a/helm/polaris/tests/deployment_test.yaml
+++ b/helm/polaris/tests/deployment_test.yaml
@@ -299,6 +299,30 @@ tests:
content:
runAsUser: 1000
+ # spec.template.spec.containers[0].securityContext
+ - it: should not set initContainer securityContext by default
+ set:
+ persistenceConfigSecret: polaris-persistence-secret
+ polarisServerConfig:
+ metaStoreManager:
+ conf-file: /eclipselink-config/conf.jar!/persistence.xml
+ asserts:
+ - notExists:
+ path: spec.template.spec.initContainers[0].securityContext
+ - it: should set initContainer securityContext
+ set:
+ persistenceConfigSecret: polaris-persistence-secret
+ polarisServerConfig:
+ metaStoreManager:
+ conf-file: /eclipselink-config/conf.jar!/persistence.xml
+ securityContext:
+ runAsUser: 1000
+ asserts:
+ - isSubset:
+ path: spec.template.spec.initContainers[0].securityContext
+ content:
+ runAsUser: 1000
+
# spec.template.spec.containers[0].image
- it: should set container image
set:
diff --git a/helm/polaris/tests/job_test.yaml b/helm/polaris/tests/job_test.yaml
index 09e7f1df..4c83e7e2 100644
--- a/helm/polaris/tests/job_test.yaml
+++ b/helm/polaris/tests/job_test.yaml
@@ -296,6 +296,32 @@ tests:
content:
runAsUser: 1000
+ # spec.template.spec.containers[0].securityContext (with bootstrapMetastoreManager enabled)
+ - it: should not set initContainer securityContext by default
+ set:
+ bootstrapMetastoreManager: true
+ persistenceConfigSecret: polaris-persistence-secret
+ polarisServerConfig:
+ metaStoreManager:
+ conf-file: /eclipselink-config/conf.jar!/persistence.xml
+ asserts:
+ - notExists:
+ path: spec.template.spec.initContainers[0].securityContext
+ - it: should set initContainer securityContext
+ set:
+ bootstrapMetastoreManager: true
+ persistenceConfigSecret: polaris-persistence-secret
+ polarisServerConfig:
+ metaStoreManager:
+ conf-file: /eclipselink-config/conf.jar!/persistence.xml
+ securityContext:
+ runAsUser: 1000
+ asserts:
+ - isSubset:
+ path: spec.template.spec.initContainers[0].securityContext
+ content:
+ runAsUser: 1000
+
# spec.template.spec.containers[0].image (with bootstrapMetastoreManager enabled)
- it: should set container image
set: