Skip to content

Commit 2a84b43

Browse files
pascalfreundsrfPascal Freundgithub-actions[bot]
authored
[zookeeper] add networkpolicy and poddisruptionbudget (#2) (CloudPirates-io#155)
* [zookeeper] add networkpolicy and poddisruptionbudget (#2) * Fix typos and remove quotes from namespace * Add a networkpolicy to zookeeper * Add poddisruptionbudget to zookeeper helm charts * Fix typos in labels * Bump chart version * Update CHANGELOG.md Signed-off-by: pascalfreundsrf <[email protected]> * Fix accessModes templating for zookeeper * Update CHANGELOG.md Signed-off-by: pascalfreundsrf <[email protected]> * Add revisionHistoryLimit * Update securityContext and add revisionHistoryLimit * fix lint / mountpath / podsecuritycontext * fix podsecuritycontext and zookeper-myid * fix formatting * Add networkpolicy and poddisruptionbudget to values.yaml * Update CHANGELOG.md Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * update zookeeper commandsWhitelist default * Update readme description --------- Signed-off-by: pascalfreundsrf <[email protected]> Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: Pascal Freund <[email protected]> Co-authored-by: pascalfreundsrf <[email protected]> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * Bump zookeeper appVersion to 3.9.3 --------- Signed-off-by: pascalfreundsrf <[email protected]> Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: Pascal Freund <[email protected]> Co-authored-by: pascalfreundsrf <[email protected]> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
1 parent 772d18f commit 2a84b43

File tree

10 files changed

+223
-39
lines changed

10 files changed

+223
-39
lines changed

‎charts/zookeeper/CHANGELOG.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# Changelog
2+
3+
## 0.1.1 (2025-09-25)
4+
5+
* [zookeeper] add networkpolicy and poddisruptionbudget ([#2](https://github.com/mmz-srf/cloudpirates-helm-charts/pull/2))

‎charts/zookeeper/Chart.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@ apiVersion: v2
22
name: zookeeper
33
description: Apache ZooKeeper is a centralized service for maintaining configuration information, naming, providing distributed synchronization, and providing group services.
44
type: application
5-
version: 0.1.0
6-
appVersion: "3.9.2"
5+
version: 0.1.1
6+
appVersion: "3.9.3"
77
keywords:
88
- zookeeper
99
- distributed

‎charts/zookeeper/README.md‎

Lines changed: 35 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,19 @@ To install with custom values:
2323
helm install my-zookeeper ./charts/zookeeper -f values.yaml
2424
```
2525

26+
#### Example config for OpenShift Clusters
27+
To run this chart in an OpenShift cluster, the following security values must be empty:
28+
```yaml
29+
zookeeper:
30+
containerSecurityContext:
31+
runAsUser:
32+
runAsGroup:
33+
seLinuxOptions:
34+
podSecurityContext:
35+
fsGroup:
36+
```
37+
38+
2639
### Getting Started
2740
2841
1. Connect to ZooKeeper from inside the cluster:
@@ -51,20 +64,21 @@ zkCli.sh -server my-zookeeper:2181
5164

5265
### Common Parameters
5366

54-
| Parameter | Description | Default |
55-
|-----------|-------------|---------|
56-
| `nameOverride` | String to partially override fullname | `""` |
57-
| `fullnameOverride` | String to fully override fullname | `""` |
58-
| `commonLabels` | Labels to add to all deployed objects | `{}` |
59-
| `commonAnnotations` | Annotations to add to all deployed objects | `{}` |
60-
| `replicaCount` | Number of ZooKeeper replicas to deploy | `3` |
67+
| Parameter | Description | Default |
68+
|-----------------------------|-----------------------------------------------------------------------------|---------|
69+
| `nameOverride` | String to partially override fullname | `""` |
70+
| `fullnameOverride` | String to fully override fullname | `""` |
71+
| `commonLabels` | Labels to add to all deployed objects | `{}` |
72+
| `commonAnnotations` | Annotations to add to all deployed objects | `{}` |
73+
| `replicaCount` | Number of ZooKeeper replicas to deploy | `3` |
74+
| `podDisruptionBudget.enabled` | Create a Pod Disruption Budget to ensure high availability during voluntary disruptions | `true` |
75+
| `networkPolicy.enabled` | Enable network policies | `true` |
6176

6277
### ZooKeeper Configuration
6378

6479
| Parameter | Description | Default |
6580
|-----------|-------------|---------|
6681
| `zookeeperConfig.tickTime` | ZooKeeper tick time | `2000` |
67-
| `zookeeperConfig.dataDir` | ZooKeeper data directory | `/var/lib/zookeeper/data` |
6882
| `zookeeperConfig.initLimit` | ZooKeeper init limit | `10` |
6983
| `zookeeperConfig.syncLimit` | ZooKeeper sync limit | `5` |
7084
| `zookeeperConfig.electionPortBindRetry` | ZooKeeper election port bind retry | `10` |
@@ -122,12 +136,19 @@ zkCli.sh -server my-zookeeper:2181
122136

123137
### Security Context
124138

125-
| Parameter | Description | Default |
126-
|-----------|-------------|---------|
127-
| `containerSecurityContext.runAsUser` | Set container's Security Context runAsUser | `1000` |
128-
| `containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` |
129-
| `containerSecurityContext.allowPrivilegeEscalation` | Set container's privilege escalation | `false` |
130-
| `podSecurityContext.fsGroup` | Group ID for the volumes of the pod | `1000` |
139+
| Parameter | Description | Default |
140+
|-------------------------------------------|-----------------------------------------------------------|---------|
141+
| `containerSecurityContext.runAsUser` | User ID to run the container process | `1000` |
142+
| `containerSecurityContext.runAsGroup` | Group ID to run the container process | `1000` |
143+
| `containerSecurityContext.seLinuxOptions` | SELinux options for the container | `{}` |
144+
| `containerSecurityContext.runAsNonRoot` | Require the container to run as a non-root user | `true` |
145+
| `containerSecurityContext.allowPrivilegeEscalation` | Whether to allow privilege escalation for the container | `false` |
146+
| `containerSecurityContext.privileged` | Set container's privileged mode | `false` |
147+
| `containerSecurityContext.readOnlyRootFilesystem` | Mount container root filesystem as read-only | `false` |
148+
| `containerSecurityContext.capabilities` | Linux capabilities to drop or add for the container | `{}` |
149+
| `containerSecurityContext.seccompProfile` | Seccomp profile for the container | `{}` |
150+
| `podSecurityContext.fsGroup` | Group ID for the volumes of the pod | `1000` |
151+
131152

132153
### Health Checks
133154

‎charts/zookeeper/templates/configmap.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,13 @@ apiVersion: v1
22
kind: ConfigMap
33
metadata:
44
name: {{ include "zookeeper.fullname" . }}-config
5-
namespace: {{ .Release.Namespace | quote }}
5+
namespace: {{ .Release.Namespace }}
66
labels:
77
{{- include "zookeeper.labels" . | nindent 4 }}
88
data:
99
zoo.cfg: |
1010
tickTime={{ .Values.zookeeperConfig.tickTime | default 2000 }}
11-
dataDir={{ .Values.zookeeperConfig.dataDir | default "/var/lib/zookeeper/data" }}
11+
dataDir={{ .Values.persistence.mountPath | default "/data" }}
1212
initLimit={{ .Values.zookeeperConfig.initLimit | default 10 }}
1313
syncLimit={{ .Values.zookeeperConfig.syncLimit | default 5 }}
1414
clientPort={{ .Values.service.ports.client | default 2181 }}
@@ -27,4 +27,4 @@ data:
2727
metricsProvider.exportJvmInfo=true
2828
{{- end }}
2929
{{- /* Add a line for each server in the ensemble */}}
30-
{{- include "zookeeper.servers" . | nindent 4 }}
30+
{{- include "zookeeper.servers" . | nindent 4 }}

‎charts/zookeeper/templates/networkpolicy.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
{{- if not .Values.networkPolicy.enabled }}
2+
kind: NetworkPolicy
3+
apiVersion: networking.k8s.io/v1
4+
metadata:
5+
name: {{ include "zookeeper.fullname" . }}
6+
namespace: {{ .Release.Namespace }}
7+
labels:
8+
{{- include "zookeeper.labels" . | nindent 4 }}
9+
spec:
10+
podSelector:
11+
matchLabels:
12+
app.kubernetes.io/instance: release-name
13+
app.kubernetes.io/name: zookeeper
14+
policyTypes:
15+
- Ingress
16+
- Egress
17+
egress:
18+
- {}
19+
ingress:
20+
# Allow inbound connections to ZooKeeper
21+
- ports:
22+
- port: {{ .Values.service.ports.client | default 2181 }}
23+
# Allow internal communications between nodes
24+
- ports:
25+
- port: {{ .Values.service.ports.quorum | default 2888 }}
26+
- port: {{ .Values.service.ports.leaderElection | default 3888 }}
27+
from:
28+
- podSelector:
29+
matchLabels:
30+
app.kubernetes.io/instance: release-name
31+
app.kubernetes.io/name: zookeeper
32+
{{- end }}

‎charts/zookeeper/templates/poddisruptionbudget.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
{{- if and .Values.podDisruptionBudget.enabled (gt (int .Values.replicaCount) 1) }}
2+
apiVersion: policy/v1
3+
kind: PodDisruptionBudget
4+
metadata:
5+
name: {{ include "zookeeper.fullname" . }}
6+
namespace: {{ .Release.Namespace }}
7+
labels:
8+
{{- include "zookeeper.labels" . | nindent 4 }}
9+
spec:
10+
maxUnavailable: 1
11+
selector:
12+
matchLabels:
13+
app.kubernetes.io/instance: release-name
14+
app.kubernetes.io/name: zookeeper
15+
{{- end }}

‎charts/zookeeper/templates/service.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: v1
22
kind: Service
33
metadata:
44
name: {{ include "zookeeper.fullname" . }}
5-
namespace: {{ .Release.Namespace | quote }}
5+
namespace: {{ .Release.Namespace }}
66
labels:
77
{{- include "zookeeper.labels" . | nindent 4 }}
88
spec:
@@ -23,7 +23,7 @@ apiVersion: v1
2323
kind: Service
2424
metadata:
2525
name: {{ include "zookeeper.fullname" . }}-headless
26-
namespace: {{ .Release.Namespace | quote }}
26+
namespace: {{ .Release.Namespace }}
2727
labels:
2828
{{- include "zookeeper.labels" . | nindent 4 }}
2929
spec:

‎charts/zookeeper/templates/statefulset.yaml‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: apps/v1
22
kind: StatefulSet
33
metadata:
44
name: {{ include "zookeeper.fullname" . }}
5-
namespace: {{ .Release.Namespace | quote }}
5+
namespace: {{ .Release.Namespace }}
66
labels:
77
{{- include "zookeeper.labels" . | nindent 4 }}
88
{{- with (include "zookeeper.annotations" .) }}
@@ -12,6 +12,7 @@ metadata:
1212
spec:
1313
serviceName: {{ include "zookeeper.fullname" . }}-headless
1414
replicas: {{ .Values.replicaCount }}
15+
revisionHistoryLimit: {{ .Values.revisionHistoryLimit | default 10 }}
1516
updateStrategy:
1617
type: RollingUpdate
1718
podManagementPolicy: Parallel
@@ -56,6 +57,10 @@ spec:
5657
- name: {{ .name }}
5758
value: {{ .value | quote }}
5859
{{- end }}
60+
- name: ZOO_MY_ID
61+
valueFrom:
62+
fieldRef:
63+
fieldPath: metadata.labels['apps.kubernetes.io/pod-index']
5964
livenessProbe:
6065
tcpSocket:
6166
port: client
@@ -118,7 +123,9 @@ spec:
118123
{{- end }}
119124
spec:
120125
accessModes:
121-
- {{ .Values.persistence.accessMode | quote }}
126+
{{- with .Values.persistence.accessModes }}
127+
{{- toYaml . | nindent 10 }}
128+
{{- end}}
122129
{{- if .Values.persistence.storageClass }}
123130
storageClassName: {{ .Values.persistence.storageClass | quote }}
124131
{{- end }}

‎charts/zookeeper/values.schema.json‎

Lines changed: 93 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -49,16 +49,76 @@
4949
},
5050
"containerSecurityContext": {
5151
"type": "object",
52+
"description": "Container-level security context settings",
5253
"properties": {
53-
"runAsUser": { "type": "integer", "minimum": 0 },
54-
"runAsNonRoot": { "type": "boolean" },
55-
"allowPrivilegeEscalation": { "type": "boolean" }
54+
"runAsUser": {
55+
"type": "integer",
56+
"description": "User ID to run the container process"
57+
},
58+
"runAsGroup": {
59+
"type": "integer",
60+
"description": "Group ID to run the container process"
61+
},
62+
"seLinuxOptions": {
63+
"type": "object",
64+
"description": "Set container's Security Context seLinuxOptions"
65+
},
66+
"runAsNonRoot": {
67+
"type": "boolean",
68+
"description": "Require the container to run as a non-root user"
69+
},
70+
"allowPrivilegeEscalation": {
71+
"type": "boolean",
72+
"description": "Whether to allow privilege escalation for the container"
73+
},
74+
"privileged": {
75+
"type": "boolean",
76+
"description": "Set container's privileged mode"
77+
},
78+
"readOnlyRootFilesystem": {
79+
"type": "boolean",
80+
"description": "Mount container root filesystem as read-only"
81+
},
82+
"capabilities": {
83+
"type": "object",
84+
"description": "Linux capabilities to drop or add for the container",
85+
"properties": {
86+
"drop": {
87+
"type": "array",
88+
"items": { "type": "string" },
89+
"description": "List of Linux capabilities to drop (e.g., ALL)"
90+
},
91+
"add": {
92+
"type": "array",
93+
"items": { "type": "string" },
94+
"description": "List of Linux capabilities to add"
95+
}
96+
}
97+
},
98+
"seccompProfile": {
99+
"type": "object",
100+
"description": "Seccomp profile configuration for the container",
101+
"properties": {
102+
"type": {
103+
"type": "string",
104+
"description": "Type of seccomp profile to use (e.g., RuntimeDefault, Localhost)"
105+
},
106+
"localhostProfile": {
107+
"type": "string",
108+
"description": "Path to a localhost seccomp profile (if type is Localhost)"
109+
}
110+
}
111+
}
56112
}
57113
},
58114
"podSecurityContext": {
59115
"type": "object",
116+
"description": "Pod-level security context settings",
60117
"properties": {
61-
"fsGroup": { "type": "integer", "minimum": 0 }
118+
"fsGroup": {
119+
"type": "integer",
120+
"description": "Group ID for the volumes of the pod"
121+
}
62122
}
63123
},
64124
"service": {
@@ -113,14 +173,15 @@
113173
"affinity": { "type": "object" },
114174
"persistence": {
115175
"type": "object",
176+
"description": "Persistence configuration",
116177
"properties": {
117-
"enabled": { "type": "boolean" },
118-
"storageClass": { "type": "string" },
119-
"annotations": { "type": "object", "additionalProperties": { "type": "string" } },
120-
"size": { "type": "string", "pattern": "^\\d+(Ei|Pi|Ti|Gi|Mi|Ki|E|P|T|G|M|K)?$" },
121-
"accessModes": { "type": "array", "items": { "type": "string" } },
122-
"existingClaim": { "type": "string" },
123-
"mountPath": { "type": "string" }
178+
"enabled": { "type": "boolean", "description": "Enable persistence using Persistent Volume Claims" },
179+
"storageClass": { "type": "string", "description": "Persistent Volume storage class" },
180+
"annotations": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Persistent Volume Claim annotations" },
181+
"size": { "type": "string", "description": "Persistent Volume size" },
182+
"accessModes": { "type": "array", "items": { "type": "string" }, "description": "Persistent Volume access modes" },
183+
"existingClaim": { "type": "string", "description": "The name of an existing PVC to use for persistence" },
184+
"mountPath": { "type": "string", "description": "The path where to mount the data volume" }
124185
}
125186
},
126187
"livenessProbe": {
@@ -169,6 +230,26 @@
169230
},
170231
"extraVolumes": { "type": "array", "items": { "type": "object" } },
171232
"extraVolumeMounts": { "type": "array", "items": { "type": "object" } },
172-
"extraObjects": { "type": "array", "items": { "type": "object" } }
233+
"extraObjects": { "type": "array", "items": { "type": "object" } },
234+
"podDisruptionBudget": {
235+
"type": "object",
236+
"description": "Pod Disruption Budget configuration",
237+
"properties": {
238+
"enabled": {
239+
"type": "boolean",
240+
"description": "Create a Pod Disruption Budget to ensure high availability during voluntary disruptions"
241+
}
242+
}
243+
},
244+
"networkPolicy": {
245+
"type": "object",
246+
"description": "Network Policy configuration",
247+
"properties": {
248+
"enabled": {
249+
"type": "boolean",
250+
"description": "Enable network policies"
251+
}
252+
}
253+
}
173254
}
174255
}

0 commit comments

Comments
 (0)