You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "philthynz (via GitHub)" <gi...@apache.org> on 2024/08/21 06:00:00 UTC
[I] Helm chart can't remove .securityContexts for Openshift compatibility [airflow]
philthynz opened a new issue, #41630:
URL: https://github.com/apache/airflow/issues/41630
### Official Helm Chart version
1.15.0 (latest released)
### Apache Airflow version
2.9.3
### Kubernetes Version
v1.26.15+4818370
### Helm Chart configuration
```
securityContexts: {}
```
### Docker Image customizations
_No response_
### What happened
.securityContexts should allow us to remove the block entirely for openshift compatibility. Bitnami have done the same in their image https://github.com/bitnami/charts/blob/f7bd58e4b2842e0bf1bf2dcd0288beea98dd87a9/bitnami/airflow/values.yaml#L29
This is needed when users like myself do not have cluster admin rights to assign scc's to service accounts.
### What you think should happen instead
Allow .securityContexts to be removed
### How to reproduce
In an openshift cluster, try to deploy as a project admin.
### Anything else
_No response_
### Are you willing to submit PR?
- [ ] Yes I am willing to submit a PR!
### Code of Conduct
- [X] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Helm chart can't remove .securityContexts.runAsUser and securityContexts.fsGroup for Openshift compatibility [airflow]
Posted by "deveshgoyal1000 (via GitHub)" <gi...@apache.org>.
deveshgoyal1000 commented on issue #41630:
URL: https://github.com/apache/airflow/issues/41630#issuecomment-2781113427
Thanks for the feedback! I’ll start working on the suggested updates
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Helm chart can't remove .securityContexts.runAsUser and securityContexts.fsGroup for Openshift compatibility [airflow]
Posted by "sre42 (via GitHub)" <gi...@apache.org>.
sre42 commented on issue #41630:
URL: https://github.com/apache/airflow/issues/41630#issuecomment-2527290668
Hi @deveshgoyal1000 , Do we have a PR in progress for this? We use openshift and are looking forward to these changes being added in 🙂
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Helm chart can't remove .securityContexts.runAsUser and securityContexts.fsGroup for Openshift compatibility [airflow]
Posted by "philthynz (via GitHub)" <gi...@apache.org>.
philthynz commented on issue #41630:
URL: https://github.com/apache/airflow/issues/41630#issuecomment-2307809232
Hey @deveshgoyal1000 many thanks for this.
I would take the bitnami approach. Because users still may want to specify other attributes in the security context that Openshift would allow.
See here: https://blog.bitnami.com/2024/04/bitnami-helm-charts-are-now-more-secure.html?m=1
The runAsUser, runAsGroup, and fsGroup ahould be automatically removed. I.e, not set.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Helm chart can't remove .securityContexts for Openshift compatibility [airflow]
Posted by "philthynz (via GitHub)" <gi...@apache.org>.
philthynz commented on issue #41630:
URL: https://github.com/apache/airflow/issues/41630#issuecomment-2303898254
Actually, a good fix would be to just remove the hard coded runAsUser and fsGroup. Openshift by default will apply the restricted-v2 SCC policy, which doesn't allow this template to be deployed. Openshift will add those values.
Security context block would also be good if it can be removed entirely for other clusters that apply SCC rules.
Maybe a bool and condition for runAsUser and fsGroup that are omitted when openshift=true?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Helm chart can't remove .securityContexts.runAsUser and securityContexts.fsGroup for Openshift compatibility [airflow]
Posted by "deveshgoyal1000 (via GitHub)" <gi...@apache.org>.
deveshgoyal1000 commented on issue #41630:
URL: https://github.com/apache/airflow/issues/41630#issuecomment-2308552569
Oh, that's nice! Thanks for confirming.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Helm chart can't remove .securityContexts for Openshift compatibility [airflow]
Posted by "eladkal (via GitHub)" <gi...@apache.org>.
eladkal commented on issue #41630:
URL: https://github.com/apache/airflow/issues/41630#issuecomment-2303860807
cc @nevcohen maybe you be intreated in fixing this one?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Helm chart can't remove .securityContexts.runAsUser and securityContexts.fsGroup for Openshift compatibility [airflow]
Posted by "Avihais12344 (via GitHub)" <gi...@apache.org>.
Avihais12344 commented on issue #41630:
URL: https://github.com/apache/airflow/issues/41630#issuecomment-2325108688
Hello, I saw this conversation, and I saw that now you can go and configure the uids and gid to `""` in most places I have looked at. For example [at general](https://github.com/apache/airflow/blob/main/chart/values.yaml#L46), [statsd](https://github.com/apache/airflow/blob/main/chart/values.yaml#L2027) and [redis](https://github.com/apache/airflow/blob/main/chart/values.yaml#L2342). So maybe the only thing we need is to add to the docs?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Helm chart can't remove .securityContexts for Openshift compatibility [airflow]
Posted by "boring-cyborg[bot] (via GitHub)" <gi...@apache.org>.
boring-cyborg[bot] commented on issue #41630:
URL: https://github.com/apache/airflow/issues/41630#issuecomment-2301194334
Thanks for opening your first issue here! Be sure to follow the issue template! If you are willing to raise PR to address this issue please do so, no need to wait for approval.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Helm chart can't remove .securityContexts.runAsUser and securityContexts.fsGroup for Openshift compatibility [airflow]
Posted by "Miretpl (via GitHub)" <gi...@apache.org>.
Miretpl closed issue #41630: Helm chart can't remove .securityContexts.runAsUser and securityContexts.fsGroup for Openshift compatibility
URL: https://github.com/apache/airflow/issues/41630
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Helm chart can't remove .securityContexts for Openshift compatibility [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on issue #41630:
URL: https://github.com/apache/airflow/issues/41630#issuecomment-2302089363
Feel free to contribute it - otherwise it will have to wait for someone to pick it up (marked it as good-first-issue since there are some clear examples it can be based on)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Helm chart can't remove .securityContexts.runAsUser and securityContexts.fsGroup for Openshift compatibility [airflow]
Posted by "mateocolina (via GitHub)" <gi...@apache.org>.
mateocolina commented on issue #41630:
URL: https://github.com/apache/airflow/issues/41630#issuecomment-2675558545
Hi @deveshgoyal1000 any progress on this?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Helm chart can't remove .securityContexts.runAsUser and securityContexts.fsGroup for Openshift compatibility [airflow]
Posted by "deveshgoyal1000 (via GitHub)" <gi...@apache.org>.
deveshgoyal1000 commented on issue #41630:
URL: https://github.com/apache/airflow/issues/41630#issuecomment-2307194332
I can get this done 1-2 if but which approch should i do making runAsUser and fsGroup values to be null or Conditionally including or excluding the `securityContext` block based on this flag and the `adaptSecurityContext` setting. and updating
deployment templates with
```yaml
{{- if and (eq .Values.global.compatibility.openshift.adaptSecurityContext "auto") (eq .Values.global.compatibility.openshift.openshift true) }}
securityContext: {}
{{- else }}
securityContext:
runAsUser: {{ .Values.containerSecurityContext.runAsUser | default "" }}
fsGroup: {{ .Values.podSecurityContext.fsGroup | default "" }}
{{- end }}
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Helm chart can't remove .securityContexts.runAsUser and securityContexts.fsGroup for Openshift compatibility [airflow]
Posted by "philthynz (via GitHub)" <gi...@apache.org>.
philthynz commented on issue #41630:
URL: https://github.com/apache/airflow/issues/41630#issuecomment-2305423819
Hi @deveshgoyal1000 ,
Thanks for jumping in. I am well thanks.
Yes your plan will work. I thought it was more simple to allow runAsUser and fsGroup values to be null. Openshift would accept that too. As an example:
```
securityContexts: {
runAsUser:
fsGroup:
}
```
Blank values are accepted in restricted-v2.
But you're right. The underlying issue here is that the securityContexts block can't be fully omitted to allow Openshift to apply the default SCC config.
As a workaround we are using helm template and then a find and replace to make runAsUser and fsGroup blank.
Do you mind if I ask your time frame?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Helm chart can't remove .securityContexts.runAsUser and securityContexts.fsGroup for Openshift compatibility [airflow]
Posted by "deveshgoyal1000 (via GitHub)" <gi...@apache.org>.
deveshgoyal1000 commented on issue #41630:
URL: https://github.com/apache/airflow/issues/41630#issuecomment-2308526630
Hey @philthynz Thank you for pointing me to the Bitnami approach it looks great and aligns perfectly with our goals. I'll proceed with this method to ensure the Helm charts automatically remove runAsUser, runAsGroup, and fsGroup when deployed on OpenShift.
To ensure I’m on the right track, here’s the updated conditional logic that I’ll be applying :
``` yaml
{{- if and (eq .Values.global.compatibility.openshift.adaptSecurityContext "auto") (eq .Values.global.compatibility.openshift.enabled true) }}
containerSecurityContext: {}
podSecurityContext: {}
{{- else }}
containerSecurityContext:
runAsUser: {{ .Values.containerSecurityContext.runAsUser | default "" }}
runAsGroup: {{ .Values.containerSecurityContext.runAsGroup | default "" }}
podSecurityContext:
fsGroup: {{ .Values.podSecurityContext.fsGroup | default "" }}
{{- end }}
```
This approach separates the containerSecurityContext and podSecurityContext, ensuring that OpenShift-specific settings are handled correctly, while also allowing other Kubernetes environments to use the specified values.
Please let me know if this aligns with your expectations or if there are any further adjustments needed.
Thanks!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Helm chart can't remove .securityContexts.runAsUser and securityContexts.fsGroup for Openshift compatibility [airflow]
Posted by "deveshgoyal1000 (via GitHub)" <gi...@apache.org>.
deveshgoyal1000 commented on issue #41630:
URL: https://github.com/apache/airflow/issues/41630#issuecomment-2550531243
Hi yes,
> Hi @deveshgoyal1000 , Do we have a PR in progress for this? We use openshift and are looking forward to these changes being added in 🙂
Hi, Thanks for the reminder! It seems this slipped past me. I'll start working on it and have a PR ready shortly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Helm chart can't remove .securityContexts.runAsUser and securityContexts.fsGroup for Openshift compatibility [airflow]
Posted by "philthynz (via GitHub)" <gi...@apache.org>.
philthynz commented on issue #41630:
URL: https://github.com/apache/airflow/issues/41630#issuecomment-2308530649
Yea blank values will work. I've tested that. Many thanks.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Helm chart can't remove .securityContexts.runAsUser and securityContexts.fsGroup for Openshift compatibility [airflow]
Posted by "deveshgoyal1000 (via GitHub)" <gi...@apache.org>.
deveshgoyal1000 commented on issue #41630:
URL: https://github.com/apache/airflow/issues/41630#issuecomment-2304699465
Hi @philthynz ,
I hope you're doing well.
I am working on adapting the Helm chart to support OpenShift compatibility, particularly in relation to runAsUser and fsGroup settings. Based on your suggestion, I plan to make the following changes:
Add an openshift flag: This flag will determine whether to adapt the security context for OpenShift.
Conditional Inclusion of securityContext: In the Helm chart templates, I will conditionally include or exclude the securityContext block based on the openshift flag and adaptSecurityContext setting.
If openshift=true: The securityContext block will be omitted, allowing OpenShift to apply its default security settings.
For other Kubernetes environments: The securityContext block will include runAsUser and fsGroup settings if they are specified.
I’d like to confirm if this approach aligns with your expectations and the best practices for handling OpenShift compatibility. Additionally, if there are any other considerations or adjustments you recommend, please let me know.
Thanks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Helm chart can't remove .securityContexts.runAsUser and securityContexts.fsGroup for Openshift compatibility [airflow]
Posted by "JKrehling (via GitHub)" <gi...@apache.org>.
JKrehling commented on issue #41630:
URL: https://github.com/apache/airflow/issues/41630#issuecomment-2698659352
I do have a PR in place to add SC to all pods with minimal permissions.
https://github.com/apache/airflow/pull/47356
I can add logic to that as @deveshgoyal1000 above mentions from the same way bitnami does.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org