Skip to content
This repository was archived by the owner on May 8, 2025. It is now read-only.

Commit abba461

Browse files
thebaluthebalu
authored
Expose SecurityContext in FlinkClusterSpec (#324)
1 parent 5cfd66a commit abba461

File tree

8 files changed

+338
-6
lines changed

8 files changed

+338
-6
lines changed

‎api/v1beta1/flinkcluster_default_test.go‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,7 @@ func TestSetDefault(t *testing.T) {
8181
MemoryOffHeapMin: defaultMemoryOffHeapMin,
8282
Volumes: nil,
8383
VolumeMounts: nil,
84+
SecurityContext: nil,
8485
},
8586
TaskManager: TaskManagerSpec{
8687
Replicas: 0,
@@ -93,6 +94,7 @@ func TestSetDefault(t *testing.T) {
9394
MemoryOffHeapRatio: &defaultMemoryOffHeapRatio,
9495
MemoryOffHeapMin: defaultMemoryOffHeapMin,
9596
Volumes: nil,
97+
SecurityContext: nil,
9698
},
9799
Job: &JobSpec{
98100
AllowNonRestoredState: &defaultJobAllowNonRestoredState,
@@ -104,6 +106,7 @@ func TestSetDefault(t *testing.T) {
104106
AfterJobFails: "KeepCluster",
105107
AfterJobCancelled: "DeleteCluster",
106108
},
109+
SecurityContext: nil,
107110
},
108111
FlinkProperties: nil,
109112
HadoopConfig: &HadoopConfig{
@@ -138,6 +141,11 @@ func TestSetNonDefault(t *testing.T) {
138141
var jobManagerIngressTLSUse = true
139142
var memoryOffHeapRatio = int32(50)
140143
var memoryOffHeapMin = resource.MustParse("600M")
144+
var securityContextUserGroup = int64(9999)
145+
var securityContext = corev1.PodSecurityContext{
146+
RunAsUser: &securityContextUserGroup,
147+
RunAsGroup: &securityContextUserGroup,
148+
}
141149
var cluster = FlinkCluster{
142150
TypeMeta: metav1.TypeMeta{},
143151
ObjectMeta: metav1.ObjectMeta{},
@@ -164,6 +172,7 @@ func TestSetNonDefault(t *testing.T) {
164172
MemoryOffHeapMin: memoryOffHeapMin,
165173
Volumes: nil,
166174
VolumeMounts: nil,
175+
SecurityContext: &securityContext,
167176
},
168177
TaskManager: TaskManagerSpec{
169178
Replicas: 0,
@@ -176,12 +185,14 @@ func TestSetNonDefault(t *testing.T) {
176185
MemoryOffHeapRatio: &memoryOffHeapRatio,
177186
MemoryOffHeapMin: memoryOffHeapMin,
178187
Volumes: nil,
188+
SecurityContext: &securityContext,
179189
},
180190
Job: &JobSpec{
181191
AllowNonRestoredState: &jobAllowNonRestoredState,
182192
Parallelism: &jobParallelism,
183193
NoLoggingToStdout: &jobNoLoggingToStdout,
184194
RestartPolicy: &jobRestartPolicy,
195+
SecurityContext: &securityContext,
185196
CleanupPolicy: &CleanupPolicy{
186197
AfterJobSucceeds: "DeleteTaskManagers",
187198
AfterJobFails: "DeleteCluster",
@@ -225,6 +236,7 @@ func TestSetNonDefault(t *testing.T) {
225236
MemoryOffHeapMin: memoryOffHeapMin,
226237
Volumes: nil,
227238
VolumeMounts: nil,
239+
SecurityContext: &securityContext,
228240
},
229241
TaskManager: TaskManagerSpec{
230242
Replicas: 0,
@@ -237,12 +249,14 @@ func TestSetNonDefault(t *testing.T) {
237249
MemoryOffHeapRatio: &memoryOffHeapRatio,
238250
MemoryOffHeapMin: memoryOffHeapMin,
239251
Volumes: nil,
252+
SecurityContext: &securityContext,
240253
},
241254
Job: &JobSpec{
242255
AllowNonRestoredState: &jobAllowNonRestoredState,
243256
Parallelism: &jobParallelism,
244257
NoLoggingToStdout: &jobNoLoggingToStdout,
245258
RestartPolicy: &jobRestartPolicy,
259+
SecurityContext: &securityContext,
246260
CleanupPolicy: &CleanupPolicy{
247261
AfterJobSucceeds: "DeleteTaskManagers",
248262
AfterJobFails: "DeleteCluster",

‎api/v1beta1/flinkcluster_types.go‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -222,6 +222,9 @@ type JobManagerSpec struct {
222222
// JobManager Deployment pod template annotations.
223223
PodAnnotations map[string]string `json:"podAnnotations,omitempty"`
224224

225+
// SecurityContext of the JM pod.
226+
SecurityContext *corev1.PodSecurityContext `json:"securityContext,omitempty"`
227+
225228
// JobManager Deployment pod template labels.
226229
PodLabels map[string]string `json:"podLabels,omitempty"`
227230
}
@@ -292,6 +295,9 @@ type TaskManagerSpec struct {
292295
// TaskManager Deployment pod template annotations.
293296
PodAnnotations map[string]string `json:"podAnnotations,omitempty"`
294297

298+
// SecurityContext of the TM pod.
299+
SecurityContext *corev1.PodSecurityContext `json:"securityContext,omitempty"`
300+
295301
// TaskManager Deployment pod template labels.
296302
PodLabels map[string]string `json:"podLabels,omitempty"`
297303
}
@@ -396,6 +402,8 @@ type JobSpec struct {
396402
// Cannot be updated.
397403
// More info: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
398404
Resources corev1.ResourceRequirements `json:"resources,omitempty"`
405+
406+
SecurityContext *corev1.PodSecurityContext `json:"securityContext,omitempty"`
399407
}
400408

401409
// FlinkClusterSpec defines the desired state of FlinkCluster

‎config/crd/bases/flinkoperator.k8s.io_flinkclusters.yaml‎

Lines changed: 159 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -753,6 +753,59 @@ spec:
753753
type: integer
754754
savepointsDir:
755755
type: string
756+
securityContext:
757+
properties:
758+
fsGroup:
759+
format: int64
760+
type: integer
761+
fsGroupChangePolicy:
762+
type: string
763+
runAsGroup:
764+
format: int64
765+
type: integer
766+
runAsNonRoot:
767+
type: boolean
768+
runAsUser:
769+
format: int64
770+
type: integer
771+
seLinuxOptions:
772+
properties:
773+
level:
774+
type: string
775+
role:
776+
type: string
777+
type:
778+
type: string
779+
user:
780+
type: string
781+
type: object
782+
supplementalGroups:
783+
items:
784+
format: int64
785+
type: integer
786+
type: array
787+
sysctls:
788+
items:
789+
properties:
790+
name:
791+
type: string
792+
value:
793+
type: string
794+
required:
795+
- name
796+
- value
797+
type: object
798+
type: array
799+
windowsOptions:
800+
properties:
801+
gmsaCredentialSpec:
802+
type: string
803+
gmsaCredentialSpecName:
804+
type: string
805+
runAsUserName:
806+
type: string
807+
type: object
808+
type: object
756809
volumeMounts:
757810
items:
758811
properties:
@@ -2001,6 +2054,59 @@ spec:
20012054
x-kubernetes-int-or-string: true
20022055
type: object
20032056
type: object
2057+
securityContext:
2058+
properties:
2059+
fsGroup:
2060+
format: int64
2061+
type: integer
2062+
fsGroupChangePolicy:
2063+
type: string
2064+
runAsGroup:
2065+
format: int64
2066+
type: integer
2067+
runAsNonRoot:
2068+
type: boolean
2069+
runAsUser:
2070+
format: int64
2071+
type: integer
2072+
seLinuxOptions:
2073+
properties:
2074+
level:
2075+
type: string
2076+
role:
2077+
type: string
2078+
type:
2079+
type: string
2080+
user:
2081+
type: string
2082+
type: object
2083+
supplementalGroups:
2084+
items:
2085+
format: int64
2086+
type: integer
2087+
type: array
2088+
sysctls:
2089+
items:
2090+
properties:
2091+
name:
2092+
type: string
2093+
value:
2094+
type: string
2095+
required:
2096+
- name
2097+
- value
2098+
type: object
2099+
type: array
2100+
windowsOptions:
2101+
properties:
2102+
gmsaCredentialSpec:
2103+
type: string
2104+
gmsaCredentialSpecName:
2105+
type: string
2106+
runAsUserName:
2107+
type: string
2108+
type: object
2109+
type: object
20042110
sidecars:
20052111
items:
20062112
properties:
@@ -3789,6 +3895,59 @@ spec:
37893895
x-kubernetes-int-or-string: true
37903896
type: object
37913897
type: object
3898+
securityContext:
3899+
properties:
3900+
fsGroup:
3901+
format: int64
3902+
type: integer
3903+
fsGroupChangePolicy:
3904+
type: string
3905+
runAsGroup:
3906+
format: int64
3907+
type: integer
3908+
runAsNonRoot:
3909+
type: boolean
3910+
runAsUser:
3911+
format: int64
3912+
type: integer
3913+
seLinuxOptions:
3914+
properties:
3915+
level:
3916+
type: string
3917+
role:
3918+
type: string
3919+
type:
3920+
type: string
3921+
user:
3922+
type: string
3923+
type: object
3924+
supplementalGroups:
3925+
items:
3926+
format: int64
3927+
type: integer
3928+
type: array
3929+
sysctls:
3930+
items:
3931+
properties:
3932+
name:
3933+
type: string
3934+
value:
3935+
type: string
3936+
required:
3937+
- name
3938+
- value
3939+
type: object
3940+
type: array
3941+
windowsOptions:
3942+
properties:
3943+
gmsaCredentialSpec:
3944+
type: string
3945+
gmsaCredentialSpecName:
3946+
type: string
3947+
runAsUserName:
3948+
type: string
3949+
type: object
3950+
type: object
37923951
sidecars:
37933952
items:
37943953
properties:

‎config/samples/flinkoperator_v1beta1_flinksessioncluster.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,9 @@ spec:
2222
pullPolicy: Always
2323
jobManager:
2424
accessScope: Cluster
25+
securityContext:
26+
runAsUser: 9999
27+
runAsGroup: 9999
2528
ports:
2629
ui: 8081
2730
resources:

‎controllers/flinkcluster_converter.go‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,7 @@ func getDesiredJobManagerDeployment(
100100
var podLabels = getComponentLabels(*flinkCluster, "jobmanager")
101101
podLabels = mergeLabels(podLabels, jobManagerSpec.PodLabels)
102102
var deploymentLabels = mergeLabels(podLabels, getRevisionHashLabels(flinkCluster.Status))
103+
var securityContext = jobManagerSpec.SecurityContext
103104
// Make Volume, VolumeMount to use configMap data for flink-conf.yaml, if flinkProperties is provided.
104105
var volumes []corev1.Volume
105106
var volumeMounts []corev1.VolumeMount
@@ -201,8 +202,8 @@ func getDesiredJobManagerDeployment(
201202
NodeSelector: jobManagerSpec.NodeSelector,
202203
Tolerations: jobManagerSpec.Tolerations,
203204
ImagePullSecrets: imageSpec.PullSecrets,
205+
SecurityContext: securityContext,
204206
}
205-
206207
var jobManagerDeployment = &appsv1.Deployment{
207208
ObjectMeta: metav1.ObjectMeta{
208209
Namespace: clusterNamespace,
@@ -392,6 +393,9 @@ func getDesiredTaskManagerDeployment(
392393
var podLabels = getComponentLabels(*flinkCluster, "taskmanager")
393394
podLabels = mergeLabels(podLabels, taskManagerSpec.PodLabels)
394395
var deploymentLabels = mergeLabels(podLabels, getRevisionHashLabels(flinkCluster.Status))
396+
397+
var securityContext = taskManagerSpec.SecurityContext
398+
395399
// Make Volume, VolumeMount to use configMap data for flink-conf.yaml
396400
var volumes []corev1.Volume
397401
var volumeMounts []corev1.VolumeMount
@@ -492,6 +496,7 @@ func getDesiredTaskManagerDeployment(
492496
NodeSelector: taskManagerSpec.NodeSelector,
493497
Tolerations: taskManagerSpec.Tolerations,
494498
ImagePullSecrets: imageSpec.PullSecrets,
499+
SecurityContext: securityContext,
495500
}
496501
var taskManagerDeployment = &appsv1.Deployment{
497502
ObjectMeta: metav1.ObjectMeta{
@@ -628,6 +633,8 @@ func getDesiredJob(
628633
}
629634
jobArgs = append(jobArgs, "--detached")
630635

636+
var securityContext = jobSpec.SecurityContext
637+
631638
var envVars = []corev1.EnvVar{}
632639

633640
// If the JAR file is remote, put the URI in the env variable
@@ -700,6 +707,7 @@ func getDesiredJob(
700707
RestartPolicy: corev1.RestartPolicyNever,
701708
Volumes: volumes,
702709
ImagePullSecrets: imageSpec.PullSecrets,
710+
SecurityContext: securityContext,
703711
}
704712

705713
// Disable the retry mechanism of k8s Job, all retires should be initiated

0 commit comments

Comments
 (0)