Skip to content

Commit 0d54037

Browse files
sachingade20sachingade20
committed
Added pvc permissions chart
1 parent 9556e22 commit 0d54037

File tree

14 files changed

+248
-0
lines changed

14 files changed

+248
-0
lines changed

‎cloudbees-cd/kubernetes/storage/nfs-permissions/.helmignore‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎cloudbees-cd/kubernetes/storage/nfs-permissions/Chart.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
apiVersion: v2
2+
name: nfs-permissions
3+
description: TODO
4+
version: 0.1.0
5+
appVersion: N/A

‎cloudbees-cd/kubernetes/storage/nfs-permissions/LICENSE‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2021 Cloudbees Flow Public Repos
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎cloudbees-cd/kubernetes/storage/nfs-permissions/README.md‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
Install Chart to update nfs permissions.
2+
3+
This chart creates Persistent Volume and Persistent Volume claim with given nfs host and nfs path with storage.
4+
Updated User/Group/Mode permissions for NFS . This chart runs a job which updates permission for NFS using command
5+
chown and chmod
6+
7+
## Common Configuration
8+
9+
The following table lists the configurable parameters with their default values.
10+
11+
| Parameter | Description | Default Value |
12+
|-------------------------|---------------------------------------------------------------------------------|-----------------|
13+
| `permissions.user` | Filesystem user for permission updates using command `chown user:group /path` | None |
14+
| `permissions.group` | Filesystem group for permission updates using command `chown user:group /path` | None |
15+
| `permissions.mode` | Filesystem accessMode for permission updates using command `chmod 770 /path` | 770 |
16+
| `nfs.host` | Required NFS Host.IP or DNS. Append port if not using default NFS port `2049` | None |
17+
| `nfs.path` | NFS path to mount. e.g / | / |
18+
| `nfs.storage` | Storage size to mount for nfs. e.g 5Gi | 5Gi |
19+
| `nfs.accessMode` | Filesystem accessMode to create PV . ReadWriteOnce, ReadWriteMany | ReadWriteMany |
20+
-------------------------------------------------------------------------------------------------------------------------------
21+
22+
23+
helm install your-release-name nfs-permissions -f values-input.yaml
24+
25+
e.g values-input.yaml
26+
```
27+
permissions:
28+
mode: 770
29+
30+
nfs:
31+
storage: 5Gi
32+
host: "10.141.161.42"
33+
path: "/ocp"
34+
accessMode: ReadWriteMany
35+
36+
```

‎cloudbees-cd/kubernetes/storage/nfs-permissions/templates/NOTES.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Kernel parameters should now be tuned.

‎cloudbees-cd/kubernetes/storage/nfs-permissions/templates/_helpers.tpl‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
{{/*
2+
TODO add any required helper functions here
3+
*/}}

‎cloudbees-cd/kubernetes/storage/nfs-permissions/templates/nfs-job.yaml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
apiVersion: batch/v1
2+
kind: Job
3+
metadata:
4+
name: nfs-volume-permission-updates-{{ .Release.Name }}
5+
labels:
6+
app: nfs-volume-permission-updates
7+
chart: {{ .Chart.Name }}
8+
release: {{ .Release.Name }}
9+
heritage: {{ .Release.Service }}
10+
spec:
11+
backoffLimit: 0
12+
template:
13+
metadata:
14+
labels:
15+
app: nfs-permission-update
16+
release: {{ .Release.Name }}
17+
spec:
18+
{{- if .Values.podSecurityPolicy.enabled }}
19+
serviceAccount: {{ .Release.Name }}
20+
{{- end }}
21+
restartPolicy: Never
22+
containers:
23+
- name: tune
24+
image: busybox:stable
25+
securityContext:
26+
privileged: true
27+
runAsUser: 0
28+
resources:
29+
requests:
30+
cpu: 1m
31+
memory: 1Mi
32+
command:
33+
- sh
34+
- -c
35+
- |
36+
set -ex
37+
{{- if and .Values.permissions.user .Values.permissions.group }}
38+
chown -R {{ .Values.permissions.user }}:{{ .Values.permissions.group }} /temp-pvc-path
39+
{{- end }}
40+
chmod -R {{ .Values.permissions.mode }} /temp-pvc-path/
41+
sleep 1000
42+
volumeMounts:
43+
- name: nfs-pvc-mount
44+
mountPath: /temp-pvc-path
45+
volumes:
46+
- name: nfs-pvc-mount
47+
persistentVolumeClaim:
48+
claimName: nfs-permission-update-pvc-{{ .Release.Name }}

‎cloudbees-cd/kubernetes/storage/nfs-permissions/templates/nfs-pv.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: v1
2+
kind: PersistentVolume
3+
metadata:
4+
name: nfs-permission-update-pv-{{ .Release.Name }}
5+
spec:
6+
capacity:
7+
storage: {{ .Values.nfs.storage | default "5Gi" }}
8+
accessModes:
9+
- ReadWriteMany
10+
nfs:
11+
path: {{ .Values.nfs.path | default "/" }}
12+
server: {{ required ".nfs.host is required " .Values.nfs.host }}

‎cloudbees-cd/kubernetes/storage/nfs-permissions/templates/nfs-pvc.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: v1
2+
kind: PersistentVolumeClaim
3+
metadata:
4+
name: nfs-permission-update-pvc-{{ .Release.Name }}
5+
spec:
6+
accessModes:
7+
- {{ .Values.nfs.accessMode | default "ReadWriteMany" }}
8+
storageClassName: ""
9+
volumeName: nfs-permission-update-pv-{{ .Release.Name }}
10+
resources:
11+
requests:
12+
storage: {{ .Values.nfs.storage | default "5Gi" }}

‎cloudbees-cd/kubernetes/storage/nfs-permissions/templates/psp.yaml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{{- if .Values.podSecurityPolicy.enabled }}
2+
apiVersion: policy/v1beta1
3+
kind: PodSecurityPolicy
4+
metadata:
5+
name: privileged-{{ .Release.Namespace }}-{{ .Release.Name }}
6+
annotations:
7+
seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'
8+
spec:
9+
privileged: true
10+
allowPrivilegeEscalation: true
11+
allowedCapabilities:
12+
- '*'
13+
volumes:
14+
- '*'
15+
hostNetwork: true
16+
hostPorts:
17+
- min: 0
18+
max: 65535
19+
hostIPC: true
20+
hostPID: true
21+
runAsUser:
22+
rule: 'RunAsAny'
23+
seLinux:
24+
rule: 'RunAsAny'
25+
supplementalGroups:
26+
rule: 'RunAsAny'
27+
fsGroup:
28+
rule: 'RunAsAny'
29+
{{- end }}

0 commit comments

Comments
 (0)