marker/shuffle-cracked
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(k8s): allow to set security contexts for worker and apps

Browse Source 
Signed-off-by: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com>
This commit is contained in:
Pascal Sthamer
2025-04-17 09:59:37 +02:00
parent 319c939c1f
commit 9fa02c15b1
6 changed files with 442 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
functions/kubernetes/charts/shuffle/README.md
+62 -30
View File
@@ -477,39 +477,69 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia
### worker Parameters ### worker Parameters
| Name | Description | Value | | Name | Description | Value |
| ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ | | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ |
| `worker.image.registry` | worker image registry | `ghcr.io` | | `worker.image.registry` | worker image registry | `ghcr.io` |
| `worker.image.repository` | worker image repository | `shuffle/shuffle-worker` | | `worker.image.repository` | worker image repository | `shuffle/shuffle-worker` |
| `worker.image.tag` | worker image tag (immutable tags are recommended, defaults to appVersion) | `""` | | `worker.image.tag` | worker image tag (immutable tags are recommended, defaults to appVersion) | `""` |
| `worker.image.digest` | worker image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) | `""` | | `worker.image.digest` | worker image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) | `""` |
| `worker.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | | `worker.podSecurityContext.enabled` | Enable worker pods' Security Context | `true` |
| `worker.serviceAccount.name` | The name of the ServiceAccount to use. | `""` | | `worker.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy for worker pods | `Always` |
| `worker.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` | | `worker.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface for worker pods | `[]` |
| `worker.serviceAccount.automountServiceAccountToken` | Automount service account token for the worker service account | `true` | | `worker.podSecurityContext.supplementalGroups` | Set filesystem extra groups for worker pods | `[]` |
| `worker.serviceAccount.imagePullSecrets` | Add image pull secrets to the worker service account | `[]` | | `worker.podSecurityContext.fsGroup` | Set fsGroup in worker pods' Security Context | `1001` |
| `worker.rbac.create` | Specifies whether RBAC resources should be created | `true` | | `worker.containerSecurityContext.enabled` | Enabled worker container' Security Context | `true` |
| `worker.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` | | `worker.containerSecurityContext.seLinuxOptions` | Set SELinux options in worker container | `{}` |
| `worker.networkPolicy.allowExternal` | Don't require server label for connections | `true` | | `worker.containerSecurityContext.runAsUser` | Set runAsUser in worker container' Security Context | `1001` |
| `worker.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` | | `worker.containerSecurityContext.runAsGroup` | Set runAsGroup in worker container' Security Context | `1001` |
| `worker.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` | | `worker.containerSecurityContext.runAsNonRoot` | Set runAsNonRoot in worker container' Security Context | `true` |
| `worker.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` | | `worker.containerSecurityContext.readOnlyRootFilesystem` | Set readOnlyRootFilesystem in worker container' Security Context | `true` |
| `worker.containerSecurityContext.privileged` | Set privileged in worker container' Security Context | `false` |
| `worker.containerSecurityContext.allowPrivilegeEscalation` | Set allowPrivilegeEscalation in worker container' Security Context | `false` |
| `worker.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped in worker container | `["ALL"]` |
| `worker.containerSecurityContext.seccompProfile.type` | Set seccomp profile in worker container | `RuntimeDefault` |
| `worker.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
| `worker.serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
| `worker.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` |
| `worker.serviceAccount.automountServiceAccountToken` | Automount service account token for the worker service account | `true` |
| `worker.serviceAccount.imagePullSecrets` | Add image pull secrets to the worker service account | `[]` |
| `worker.rbac.create` | Specifies whether RBAC resources should be created | `true` |
| `worker.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` |
| `worker.networkPolicy.allowExternal` | Don't require server label for connections | `true` |
| `worker.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` |
| `worker.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` |
| `worker.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` |
### app Parameters ### app Parameters
| Name | Description | Value | | Name | Description | Value |
| ------------------------------------------------- | ---------------------------------------------------------------------------------- | ------ | | ------------------------------------------------------- | ---------------------------------------------------------------------------------- | ---------------- |
| `app.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | | `app.podSecurityContext.enabled` | Enable app pods' Security Context | `true` |
| `app.serviceAccount.name` | The name of the ServiceAccount to use. | `""` | | `app.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy for app pods | `Always` |
| `app.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` | | `app.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface for app pods | `[]` |
| `app.serviceAccount.automountServiceAccountToken` | Automount service account token for the app service account | `true` | | `app.podSecurityContext.supplementalGroups` | Set filesystem extra groups for app pods | `[]` |
| `app.serviceAccount.imagePullSecrets` | Add image pull secrets to the app service account | `[]` | | `app.podSecurityContext.fsGroup` | Set fsGroup in app pods' Security Context | `1001` |
| `app.rbac.create` | Specifies whether RBAC resources should be created | `true` | | `app.containerSecurityContext.enabled` | Enabled app container' Security Context | `true` |
| `app.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` | | `app.containerSecurityContext.seLinuxOptions` | Set SELinux options in app container | `{}` |
| `app.networkPolicy.allowExternal` | Don't require server label for connections | `true` | | `app.containerSecurityContext.runAsUser` | Set runAsUser in app container' Security Context | `1001` |
| `app.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` | | `app.containerSecurityContext.runAsGroup` | Set runAsGroup in app container' Security Context | `1001` |
| `app.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` | | `app.containerSecurityContext.runAsNonRoot` | Set runAsNonRoot in app container' Security Context | `true` |
| `app.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` | | `app.containerSecurityContext.readOnlyRootFilesystem` | Set readOnlyRootFilesystem in app container' Security Context | `true` |
| `app.containerSecurityContext.privileged` | Set privileged in app container' Security Context | `false` |
| `app.containerSecurityContext.allowPrivilegeEscalation` | Set allowPrivilegeEscalation in app container' Security Context | `false` |
| `app.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped in app container | `["ALL"]` |
| `app.containerSecurityContext.seccompProfile.type` | Set seccomp profile in app container | `RuntimeDefault` |
| `app.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
| `app.serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
| `app.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` |
| `app.serviceAccount.automountServiceAccountToken` | Automount service account token for the app service account | `true` |
| `app.serviceAccount.imagePullSecrets` | Add image pull secrets to the app service account | `[]` |
| `app.rbac.create` | Specifies whether RBAC resources should be created | `true` |
| `app.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` |
| `app.networkPolicy.allowExternal` | Don't require server label for connections | `true` |
| `app.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` |
| `app.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` |
| `app.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` |
### Traffic Exposure Parameters ### Traffic Exposure Parameters
@@ -607,3 +637,5 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia
### Other Parameters ### Other Parameters
functions/kubernetes/charts/shuffle/templates/orborus/orborus-dpl.yaml
+16
View File
@@ -88,8 +88,24 @@ spec:
value: "true" value: "true"
- name: SHUFFLE_WORKER_SERVICE_ACCOUNT_NAME - name: SHUFFLE_WORKER_SERVICE_ACCOUNT_NAME
value: {{ include "shuffle.worker.serviceAccount.name" . }} value: {{ include "shuffle.worker.serviceAccount.name" . }}
{{- if .Values.worker.podSecurityContext.enabled }}
- name: SHUFFLE_WORKER_POD_SECURITY_CONTEXT
value: {{ omit .Values.worker.podSecurityContext "enabled" | mustToJson | quote }}
{{- end }}
{{- if .Values.worker.containerSecurityContext.enabled }}
- name: SHUFFLE_WORKER_CONTAINER_SECURITY_CONTEXT
value: {{ include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.worker.containerSecurityContext "context" $) | fromYaml | mustToJson | quote }}
{{- end }}
- name: SHUFFLE_APP_SERVICE_ACCOUNT_NAME - name: SHUFFLE_APP_SERVICE_ACCOUNT_NAME
value: {{ include "shuffle.app.serviceAccount.name" . }} value: {{ include "shuffle.app.serviceAccount.name" . }}
{{- if .Values.app.podSecurityContext.enabled }}
- name: SHUFFLE_APP_POD_SECURITY_CONTEXT
value: {{ omit .Values.app.podSecurityContext "enabled" | mustToJson | quote }}
{{- end }}
{{- if .Values.app.containerSecurityContext.enabled }}
- name: SHUFFLE_APP_CONTAINER_SECURITY_CONTEXT
value: {{ include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.app.containerSecurityContext "context" $) | fromYaml | mustToJson | quote }}
{{- end }}
{{- if .Values.orborus.extraEnvVars }} {{- if .Values.orborus.extraEnvVars }}
{{- include "common.tplvalues.render" (dict "value" .Values.orborus.extraEnvVars "context" $) | nindent 12 }} {{- include "common.tplvalues.render" (dict "value" .Values.orborus.extraEnvVars "context" $) | nindent 12 }}
{{- end }} {{- end }}
functions/kubernetes/charts/shuffle/values.schema.json
+194
View File
@@ -2074,6 +2074,103 @@
} }
} }
}, },
"podSecurityContext": {
"type": "object",
"properties": {
"enabled": {
"type": "boolean",
"description": "Enable worker pods' Security Context",
"default": true
},
"fsGroupChangePolicy": {
"type": "string",
"description": "Set filesystem group change policy for worker pods",
"default": "Always"
},
"sysctls": {
"type": "array",
"description": "Set kernel settings using the sysctl interface for worker pods",
"default": [],
"items": {}
},
"supplementalGroups": {
"type": "array",
"description": "Set filesystem extra groups for worker pods",
"default": [],
"items": {}
},
"fsGroup": {
"type": "number",
"description": "Set fsGroup in worker pods' Security Context",
"default": 1001
}
}
},
"containerSecurityContext": {
"type": "object",
"properties": {
"enabled": {
"type": "boolean",
"description": "Enabled worker container' Security Context",
"default": true
},
"runAsUser": {
"type": "number",
"description": "Set runAsUser in worker container' Security Context",
"default": 1001
},
"runAsGroup": {
"type": "number",
"description": "Set runAsGroup in worker container' Security Context",
"default": 1001
},
"runAsNonRoot": {
"type": "boolean",
"description": "Set runAsNonRoot in worker container' Security Context",
"default": true
},
"readOnlyRootFilesystem": {
"type": "boolean",
"description": "Set readOnlyRootFilesystem in worker container' Security Context",
"default": true
},
"privileged": {
"type": "boolean",
"description": "Set privileged in worker container' Security Context",
"default": false
},
"allowPrivilegeEscalation": {
"type": "boolean",
"description": "Set allowPrivilegeEscalation in worker container' Security Context",
"default": false
},
"capabilities": {
"type": "object",
"properties": {
"drop": {
"type": "array",
"description": "List of capabilities to be dropped in worker container",
"default": [
"ALL"
],
"items": {
"type": "string"
}
}
}
},
"seccompProfile": {
"type": "object",
"properties": {
"type": {
"type": "string",
"description": "Set seccomp profile in worker container",
"default": "RuntimeDefault"
}
}
}
}
},
"serviceAccount": { "serviceAccount": {
"type": "object", "type": "object",
"properties": { "properties": {
@@ -2152,6 +2249,103 @@
"app": { "app": {
"type": "object", "type": "object",
"properties": { "properties": {
"podSecurityContext": {
"type": "object",
"properties": {
"enabled": {
"type": "boolean",
"description": "Enable app pods' Security Context",
"default": true
},
"fsGroupChangePolicy": {
"type": "string",
"description": "Set filesystem group change policy for app pods",
"default": "Always"
},
"sysctls": {
"type": "array",
"description": "Set kernel settings using the sysctl interface for app pods",
"default": [],
"items": {}
},
"supplementalGroups": {
"type": "array",
"description": "Set filesystem extra groups for app pods",
"default": [],
"items": {}
},
"fsGroup": {
"type": "number",
"description": "Set fsGroup in app pods' Security Context",
"default": 1001
}
}
},
"containerSecurityContext": {
"type": "object",
"properties": {
"enabled": {
"type": "boolean",
"description": "Enabled app container' Security Context",
"default": true
},
"runAsUser": {
"type": "number",
"description": "Set runAsUser in app container' Security Context",
"default": 1001
},
"runAsGroup": {
"type": "number",
"description": "Set runAsGroup in app container' Security Context",
"default": 1001
},
"runAsNonRoot": {
"type": "boolean",
"description": "Set runAsNonRoot in app container' Security Context",
"default": true
},
"readOnlyRootFilesystem": {
"type": "boolean",
"description": "Set readOnlyRootFilesystem in app container' Security Context",
"default": true
},
"privileged": {
"type": "boolean",
"description": "Set privileged in app container' Security Context",
"default": false
},
"allowPrivilegeEscalation": {
"type": "boolean",
"description": "Set allowPrivilegeEscalation in app container' Security Context",
"default": false
},
"capabilities": {
"type": "object",
"properties": {
"drop": {
"type": "array",
"description": "List of capabilities to be dropped in app container",
"default": [
"ALL"
],
"items": {
"type": "string"
}
}
}
},
"seccompProfile": {
"type": "object",
"properties": {
"type": {
"type": "string",
"description": "Set seccomp profile in app container",
"default": "RuntimeDefault"
}
}
}
}
},
"serviceAccount": { "serviceAccount": {
"type": "object", "type": "object",
"properties": { "properties": {
functions/kubernetes/charts/shuffle/values.yaml
+84
View File
@@ -1328,6 +1328,48 @@ worker:
tag: "" tag: ""
digest: "" digest: ""
## Configure Pods Security Context
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
## @param worker.podSecurityContext.enabled Enable worker pods' Security Context
## @param worker.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy for worker pods
## @param worker.podSecurityContext.sysctls Set kernel settings using the sysctl interface for worker pods
## @param worker.podSecurityContext.supplementalGroups Set filesystem extra groups for worker pods
## @param worker.podSecurityContext.fsGroup Set fsGroup in worker pods' Security Context
##
podSecurityContext:
enabled: true
fsGroupChangePolicy: Always
sysctls: []
supplementalGroups: []
fsGroup: 1001
## Configure Container Security Context
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
## @param worker.containerSecurityContext.enabled Enabled worker container' Security Context
## @param worker.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in worker container
## @param worker.containerSecurityContext.runAsUser Set runAsUser in worker container' Security Context
## @param worker.containerSecurityContext.runAsGroup Set runAsGroup in worker container' Security Context
## @param worker.containerSecurityContext.runAsNonRoot Set runAsNonRoot in worker container' Security Context
## @param worker.containerSecurityContext.readOnlyRootFilesystem Set readOnlyRootFilesystem in worker container' Security Context
## @param worker.containerSecurityContext.privileged Set privileged in worker container' Security Context
## @param worker.containerSecurityContext.allowPrivilegeEscalation Set allowPrivilegeEscalation in worker container' Security Context
## @param worker.containerSecurityContext.capabilities.drop List of capabilities to be dropped in worker container
## @param worker.containerSecurityContext.seccompProfile.type Set seccomp profile in worker container
##
containerSecurityContext:
enabled: true
seLinuxOptions: {}
runAsUser: 1001
runAsGroup: 1001
runAsNonRoot: true
readOnlyRootFilesystem: true
privileged: false
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]
seccompProfile:
type: "RuntimeDefault"
## ServiceAccount configuration ## ServiceAccount configuration
## ##
serviceAccount: serviceAccount:
@@ -1390,6 +1432,48 @@ worker:
## @section app Parameters ## @section app Parameters
## ##
app: app:
## Configure Pods Security Context
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
## @param app.podSecurityContext.enabled Enable app pods' Security Context
## @param app.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy for app pods
## @param app.podSecurityContext.sysctls Set kernel settings using the sysctl interface for app pods
## @param app.podSecurityContext.supplementalGroups Set filesystem extra groups for app pods
## @param app.podSecurityContext.fsGroup Set fsGroup in app pods' Security Context
##
podSecurityContext:
enabled: true
fsGroupChangePolicy: Always
sysctls: []
supplementalGroups: []
fsGroup: 1001
## Configure Container Security Context
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
## @param app.containerSecurityContext.enabled Enabled app container' Security Context
## @param app.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in app container
## @param app.containerSecurityContext.runAsUser Set runAsUser in app container' Security Context
## @param app.containerSecurityContext.runAsGroup Set runAsGroup in app container' Security Context
## @param app.containerSecurityContext.runAsNonRoot Set runAsNonRoot in app container' Security Context
## @param app.containerSecurityContext.readOnlyRootFilesystem Set readOnlyRootFilesystem in app container' Security Context
## @param app.containerSecurityContext.privileged Set privileged in app container' Security Context
## @param app.containerSecurityContext.allowPrivilegeEscalation Set allowPrivilegeEscalation in app container' Security Context
## @param app.containerSecurityContext.capabilities.drop List of capabilities to be dropped in app container
## @param app.containerSecurityContext.seccompProfile.type Set seccomp profile in app container
##
containerSecurityContext:
enabled: true
seLinuxOptions: {}
runAsUser: 1001
runAsGroup: 1001
runAsNonRoot: true
readOnlyRootFilesystem: true
privileged: false
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]
seccompProfile:
type: "RuntimeDefault"
## ServiceAccount configuration ## ServiceAccount configuration
## ##
serviceAccount: serviceAccount:
functions/onprem/orborus/orborus.go
+39 -4
View File
@@ -76,7 +76,11 @@ var maxCPUPercent = 90
var isKubernetes = os.Getenv("IS_KUBERNETES") var isKubernetes = os.Getenv("IS_KUBERNETES")
var kubernetesNamespace = os.Getenv("KUBERNETES_NAMESPACE") var kubernetesNamespace = os.Getenv("KUBERNETES_NAMESPACE")
var workerServiceAccountName = os.Getenv("SHUFFLE_WORKER_SERVICE_ACCOUNT_NAME") var workerServiceAccountName = os.Getenv("SHUFFLE_WORKER_SERVICE_ACCOUNT_NAME")
var workerPodSecurityContext = os.Getenv("SHUFFLE_WORKER_POD_SECURITY_CONTEXT")
var workerContainerSecurityContext = os.Getenv("SHUFFLE_WORKER_CONTAINER_SECURITY_CONTEXT")
var appServiceAccountName = os.Getenv("SHUFFLE_APP_SERVICE_ACCOUNT_NAME") var appServiceAccountName = os.Getenv("SHUFFLE_APP_SERVICE_ACCOUNT_NAME")
var appPodSecurityContext = os.Getenv("SHUFFLE_APP_POD_SECURITY_CONTEXT")
var appContainerSecurityContext = os.Getenv("SHUFFLE_APP_CONTAINER_SECURITY_CONTEXT")
// var baseimagename = "docker.pkg.github.com/shuffle/shuffle" // var baseimagename = "docker.pkg.github.com/shuffle/shuffle"
// var baseimagename = "ghcr.io/frikky" // var baseimagename = "ghcr.io/frikky"
@@ -1000,6 +1004,14 @@ func deployK8sWorker(image string, identifier string, env []string) error {
env = append(env, fmt.Sprintf("SHUFFLE_APP_SERVICE_ACCOUNT_NAME=%s", appServiceAccountName)) env = append(env, fmt.Sprintf("SHUFFLE_APP_SERVICE_ACCOUNT_NAME=%s", appServiceAccountName))
} }
if len(appPodSecurityContext) > 0 {
env = append(env, fmt.Sprintf("SHUFFLE_APP_POD_SECURITY_CONTEXT=%s", appPodSecurityContext))
}
if len(appContainerSecurityContext) > 0 {
env = append(env, fmt.Sprintf("SHUFFLE_APP_CONTAINER_SECURITY_CONTEXT=%s", appContainerSecurityContext))
}
clientset, _, err := shuffle.GetKubernetesClient() clientset, _, err := shuffle.GetKubernetesClient()
if err != nil { if err != nil {
log.Printf("[ERROR] Error getting kubernetes client:", err) log.Printf("[ERROR] Error getting kubernetes client:", err)
@@ -1081,10 +1093,33 @@ func deployK8sWorker(image string, identifier string, env []string) error {
"app.kubernetes.io/instance": identifier, "app.kubernetes.io/instance": identifier,
} }
// Parse security contexts from env
var podSecurityContext *corev1.PodSecurityContext
var containerSecurityContext *corev1.SecurityContext
if len(workerPodSecurityContext) > 0 {
podSecurityContext = &corev1.PodSecurityContext{}
err = json.Unmarshal([]byte(workerPodSecurityContext), podSecurityContext)
if err != nil {
log.Printf("[ERROR] Failed to unmarshal worker pod security context: %v", err)
return fmt.Errorf("failed to unmarshal worker pod security context: %v", err)
}
}
if len(workerContainerSecurityContext) > 0 {
containerSecurityContext = &corev1.SecurityContext{}
err = json.Unmarshal([]byte(workerContainerSecurityContext), containerSecurityContext)
if err != nil {
log.Printf("[ERROR] Failed to unmarshal worker container security context: %v", err)
return fmt.Errorf("failed to unmarshal worker container security context: %v", err)
}
}
containerAttachment := corev1.Container{ containerAttachment := corev1.Container{
Name: identifier, Name: identifier,
Image: kubernetesImage, Image: kubernetesImage,
Env: buildEnvVars(envMap), Env: buildEnvVars(envMap),
SecurityContext: containerSecurityContext,
//ImagePullPolicy: "Never", //ImagePullPolicy: "Never",
ImagePullPolicy: corev1.PullIfNotPresent, ImagePullPolicy: corev1.PullIfNotPresent,
@@ -1201,6 +1236,7 @@ func deployK8sWorker(image string, identifier string, env []string) error {
}, },
DNSPolicy: corev1.DNSClusterFirst, DNSPolicy: corev1.DNSClusterFirst,
ServiceAccountName: workerServiceAccountName, ServiceAccountName: workerServiceAccountName,
SecurityContext: podSecurityContext,
}, },
}, },
}, },
@@ -1271,7 +1307,6 @@ func deployWorker(image string, identifier string, env []string, executionReques
Resources: container.Resources{}, Resources: container.Resources{},
} }
// This is just to test the mounting locally so // This is just to test the mounting locally so
// I can control from what source I'm mounting // I can control from what source I'm mounting
// the certs to. Default behaviour is: // the certs to. Default behaviour is:
functions/onprem/worker/worker.go
+40 -14
View File
@@ -57,9 +57,13 @@ var logsDisabled = os.Getenv("SHUFFLE_LOGS_DISABLED")
var cleanupEnv = strings.ToLower(os.Getenv("CLEANUP")) var cleanupEnv = strings.ToLower(os.Getenv("CLEANUP"))
var swarmNetworkName = os.Getenv("SHUFFLE_SWARM_NETWORK_NAME") var swarmNetworkName = os.Getenv("SHUFFLE_SWARM_NETWORK_NAME")
var dockerApiVersion = strings.ToLower(os.Getenv("DOCKER_API_VERSION")) var dockerApiVersion = strings.ToLower(os.Getenv("DOCKER_API_VERSION"))
var appServiceAccountName = os.Getenv("SHUFFLE_APP_SERVICE_ACCOUNT_NAME")
// Kubernetes settings
var appServiceAccountName = os.Getenv("SHUFFLE_APP_SERVICE_ACCOUNT_NAME")
var appPodSecurityContext = os.Getenv("SHUFFLE_APP_POD_SECURITY_CONTEXT")
var appContainerSecurityContext = os.Getenv("SHUFFLE_APP_CONTAINER_SECURITY_CONTEXT")
var kubernetesNamespace = os.Getenv("KUBERNETES_NAMESPACE") var kubernetesNamespace = os.Getenv("KUBERNETES_NAMESPACE")
var executionCount int64 var executionCount int64
var baseimagename = os.Getenv("SHUFFLE_BASE_IMAGE_NAME") var baseimagename = os.Getenv("SHUFFLE_BASE_IMAGE_NAME")
@@ -503,6 +507,28 @@ func deployk8sApp(image string, identifier string, env []string) error {
"app.kubernetes.io/instance": name, "app.kubernetes.io/instance": name,
} }
// Parse security contexts from env
var podSecurityContext *corev1.PodSecurityContext
var containerSecurityContext *corev1.SecurityContext
if len(appPodSecurityContext) > 0 {
podSecurityContext = &corev1.PodSecurityContext{}
err = json.Unmarshal([]byte(appPodSecurityContext), podSecurityContext)
if err != nil {
log.Printf("[ERROR] Failed to unmarshal app pod security context: %v", err)
return fmt.Errorf("failed to unmarshal app pod security context: %v", err)
}
}
if len(appContainerSecurityContext) > 0 {
containerSecurityContext = &corev1.SecurityContext{}
err = json.Unmarshal([]byte(appContainerSecurityContext), containerSecurityContext)
if err != nil {
log.Printf("[ERROR] Failed to unmarshal app container security context: %v", err)
return fmt.Errorf("failed to unmarshal app container security context: %v", err)
}
}
// pod := &corev1.Pod{ // pod := &corev1.Pod{
// ObjectMeta: metav1.ObjectMeta{ // ObjectMeta: metav1.ObjectMeta{
// Name: podName, // Name: podName,
@@ -596,13 +622,15 @@ func deployk8sApp(image string, identifier string, env []string) error {
Spec: corev1.PodSpec{ Spec: corev1.PodSpec{
Containers: []corev1.Container{ Containers: []corev1.Container{
{ {
Name: value, Name: value,
Image: image, Image: image,
Env: buildEnvVars(envMap), Env: buildEnvVars(envMap),
SecurityContext: containerSecurityContext,
}, },
}, },
DNSPolicy: corev1.DNSClusterFirst, DNSPolicy: corev1.DNSClusterFirst,
ServiceAccountName: appServiceAccountName, ServiceAccountName: appServiceAccountName,
SecurityContext: podSecurityContext,
}, },
}, },
}, },
@@ -940,9 +968,9 @@ func deployApp(cli *dockerclient.Client, image string, identifier string, env []
} }
builtMount := mount.Mount{ builtMount := mount.Mount{
Type: mount.TypeBind, Type: mount.TypeBind,
Source: sourceFolder, Source: sourceFolder,
Target: destinationFolder, Target: destinationFolder,
ReadOnly: readOnly, ReadOnly: readOnly,
} }
@@ -1859,12 +1887,12 @@ func executionInit(workflowExecution shuffle.WorkflowExecution) error {
// 2. Only ONE action // 2. Only ONE action
// 3. Every predefined result having result.Action.Category == "rerun" // 3. Every predefined result having result.Action.Category == "rerun"
/* /*
if len(workflowExecution.Workflow.Actions) == 1 && len(workflowExecution.Results) > 0 { if len(workflowExecution.Workflow.Actions) == 1 && len(workflowExecution.Results) > 0 {
finished := shuffle.ValidateFinished(ctx, extra, workflowExecution) finished := shuffle.ValidateFinished(ctx, extra, workflowExecution)
if finished { if finished {
return nil return nil
}
} }
}
*/ */
nextActions = append(nextActions, startAction) nextActions = append(nextActions, startAction)
@@ -1954,7 +1982,6 @@ func executionInit(workflowExecution shuffle.WorkflowExecution) error {
//log.Printf("Successfully downloaded and built %s", image) //log.Printf("Successfully downloaded and built %s", image)
} }
visited := []string{} visited := []string{}
executed := []string{} executed := []string{}
environments := []string{} environments := []string{}
@@ -3905,7 +3932,6 @@ func checkStandaloneRun() {
log.Printf("\n\n\n[DEBUG] Finished resetting execution %s. Body: %s. Starting execution.\n\n\n", newresp.Status, string(body)) log.Printf("\n\n\n[DEBUG] Finished resetting execution %s. Body: %s. Starting execution.\n\n\n", newresp.Status, string(body))
} }
// Initial loop etc // Initial loop etc