Skip to content

Commit ddc5cf8

Browse files
author
Barkha Choithani
committed
rebasing feature branch
2 parents 6bbfe54 + edbf709 commit ddc5cf8

File tree

8 files changed

+140
-9
lines changed

8 files changed

+140
-9
lines changed

‎Jenkinsfile

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -139,6 +139,17 @@ void pullImage() {
139139
}
140140
}
141141

142+
String getVersionDiv(mlVersion) {
143+
switch (mlVersion) {
144+
case '10.0':
145+
return '-'
146+
case '9.0':
147+
return '-'
148+
default:
149+
return '.'
150+
}
151+
}
152+
142153
pipeline {
143154
agent {
144155
label {
@@ -157,13 +168,15 @@ pipeline {
157168
timeStamp = sh(returnStdout: true, script: "date +%Y%m%d -d '-5 hours'").trim()
158169
dockerRegistry = 'ml-docker-dev.marklogic.com'
159170
dockerRepository = "${dockerRegistry}/marklogic/marklogic-server-centos"
160-
dockerVersion = "${ML_VERSION}-${timeStamp}-centos-1.0.1"
171+
dockerVerDivider = getVersionDiv(params.ML_VERSION)
172+
dockerVersion = "${ML_VERSION}${dockerVerDivider}${timeStamp}-centos-${dockerReleaseVer}"
161173
}
162174

163175
parameters {
164176
string(name: 'emailList', defaultValue: emailList, description: 'List of email for build notification', trim: true)
165-
choice(name: 'ML_VERSION', choices: '10.0\n11.0\n9.0', description: 'MarkLogic version. used to pick appropriate docker image')
177+
choice(name: 'ML_VERSION', choices: '11.0\n12.0\n10.0\n9.0', description: 'MarkLogic version. used to pick appropriate docker image')
166178
booleanParam(name: 'KUBERNETES_TESTS', defaultValue: true, description: 'Run kubernetes tests')
179+
string(name: 'dockerReleaseVer', defaultValue: '1.0.1', description: 'Current Docker version. (e.g. 1.0.1)', trim: true)
167180
}
168181

169182
stages {

‎README.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,8 @@
3535
- [Notice](#notice)
3636
- [Uninstalling the Chart](#uninstalling-thechart)
3737
- [Parameters](#parameters)
38+
- [Known Issues and Limitations](#Known-Issues-and-Limitations)
39+
3840

3941
# Introduction
4042

@@ -475,3 +477,7 @@ This table describes the list of available parameters for Helm Chart.
475477
| `logCollection.files.requestLogs` | Enable this parameter to enable collection of Marklogics request logs when log collection is enabled | `true` |
476478
| `logCollection.files.crashLogs` | Enable this parameter to enable collection of Marklogics crash logs when log collection is enabled | `true` |
477479
| `logCollection.files.auditLogs` | Enable this parameter to enable collection of Marklogics audit logs when log collection is enabled | `true` |
480+
481+
# Known Issues and Limitations
482+
483+
1. If the hostname is greater than 64 characters there may be issues with certificates. The certificates may shorten the name or use SANs for hostnames in the certificates.

‎charts/templates/NOTES.txt

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,13 @@
1-
{{- define "marklogic.fqdn" -}}
2-
{{- printf "%s-0.%s.%s.svc.cluster.local" (include "marklogic.fullname" .) (include "marklogic.headlessServiceName" .) .Release.Namespace }}
3-
{{- end}}
4-
51
Thank you for installing {{ .Chart.Name }}.
62

73
Your release is named {{ .Release.Name }}.
84

95
FQDN is {{ include "marklogic.fqdn" . }}
6+
{{- if gt (len (include "marklogic.fqdn" .)) 64 }}
7+
WARNING: The hostname is greater than 64 characters
8+
There may be issues with certificates
9+
The certificates may shorten the name or use SANs for hostnames in the certificates
10+
{{- end }}
1011

1112
Group {{ .Values.group.name }} is created on the MarkLogic cluster.
1213

‎charts/templates/_helpers.tpl

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,3 +75,10 @@ Create the name of the service account to use
7575
{{- default "default" .Values.serviceAccount.name }}
7676
{{- end }}
7777
{{- end }}
78+
79+
{{/*
80+
Fully qualified domain name
81+
*/}}
82+
{{- define "marklogic.fqdn" -}}
83+
{{- printf "%s-0.%s.%s.svc.cluster.local" (include "marklogic.fullname" .) (include "marklogic.headlessServiceName" .) .Release.Namespace }}
84+
{{- end}}

‎charts/templates/statefulset.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -206,6 +206,9 @@ spec:
206206
sleep 10s
207207
fi
208208
done
209+
{{- if .Values.containerSecurityContext.enabled }}
210+
securityContext: {{- omit .Values.containerSecurityContext "enabled" | toYaml | nindent 12 }}
211+
{{- end }}
209212
{{- if .Values.livenessProbe.enabled }}
210213
livenessProbe:
211214
httpGet:

‎charts/values.yaml

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ image:
2525
# Init container image parameters
2626
initContainerImage:
2727
repository: curlimages/curl
28-
tag: 7.85.0
28+
tag: 7.87.0
2929
pullPolicy: IfNotPresent
3030

3131
# Configure the imagePullSecret to pull the image from private repository that requires credential
@@ -113,6 +113,13 @@ networkPolicy:
113113
- port: 8002
114114
protocol: TCP
115115

116+
# Below are the security configurations for container, by default security will be enabled
117+
containerSecurityContext:
118+
enabled: true
119+
runAsUser: 1000
120+
runAsNonRoot: true
121+
allowPrivilegeEscalation: true
122+
116123
# Below are the advanced configurations, please understand read the reference before you make changes
117124

118125
# Configure options for liveness probe
@@ -150,7 +157,7 @@ startupProbe:
150157
# And export them to a logging backend specified in the outputs section below
151158
logCollection:
152159
enabled: false
153-
image: fluent/fluent-bit:1.9.7
160+
image: fluent/fluent-bit:2.0.6
154161
resources:
155162
requests:
156163
cpu: "100m"

‎test/template/sec_template_test.go

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
package template_test
2+
3+
import (
4+
"path/filepath"
5+
"strings"
6+
"testing"
7+
8+
"github.com/stretchr/testify/require"
9+
appsv1 "k8s.io/api/apps/v1"
10+
11+
"github.com/gruntwork-io/terratest/modules/helm"
12+
"github.com/gruntwork-io/terratest/modules/k8s"
13+
"github.com/gruntwork-io/terratest/modules/random"
14+
)
15+
16+
func TestChartTemplateSecurityEnabled(t *testing.T) {
17+
t.Parallel()
18+
19+
// Path to the helm chart we will test
20+
helmChartPath, err := filepath.Abs("../../charts")
21+
releaseName := "marklogic-sec-test"
22+
t.Log(helmChartPath, releaseName)
23+
require.NoError(t, err)
24+
25+
// Set up the namespace; confirm that the template renders the expected value for the namespace.
26+
namespaceName := "marklogic-" + strings.ToLower(random.UniqueId())
27+
t.Logf("Namespace: %s\n", namespaceName)
28+
29+
// Setup the args for helm install
30+
options := &helm.Options{
31+
SetValues: map[string]string{
32+
"image.repository": "marklogicdb/marklogic-db",
33+
"image.tag": "latest",
34+
"persistence.enabled": "false",
35+
"containerSecurityContext.enabled": "true",
36+
},
37+
KubectlOptions: k8s.NewKubectlOptions("", "", namespaceName),
38+
}
39+
40+
// render the tempate
41+
output := helm.RenderTemplate(t, options, helmChartPath, releaseName, []string{"templates/statefulset.yaml"})
42+
43+
var statefulset appsv1.StatefulSet
44+
helm.UnmarshalK8SYaml(t, output, &statefulset)
45+
46+
// Verify the name and namespace matches
47+
require.Equal(t, namespaceName, statefulset.Namespace)
48+
49+
// Verify the securityContext values are set for container
50+
expectedRunAsUser := 1000
51+
statefulSetContainers := statefulset.Spec.Template.Spec.Containers
52+
actualRunAsUser := *(statefulSetContainers[0].SecurityContext.RunAsUser)
53+
require.Equal(t, len(statefulSetContainers), 1)
54+
require.Equal(t, int(actualRunAsUser), expectedRunAsUser)
55+
}
56+
57+
func TestChartTemplateSecurityDisabled(t *testing.T) {
58+
t.Parallel()
59+
60+
// Path to the helm chart we will test
61+
helmChartPath, err := filepath.Abs("../../charts")
62+
releaseName := "marklogic-sec-test"
63+
t.Log(helmChartPath, releaseName)
64+
require.NoError(t, err)
65+
66+
// Set up the namespace; confirm that the template renders the expected value for the namespace.
67+
namespaceName := "marklogic-" + strings.ToLower(random.UniqueId())
68+
t.Logf("Namespace: %s\n", namespaceName)
69+
70+
// Setup the args for helm install
71+
options := &helm.Options{
72+
SetValues: map[string]string{
73+
"image.repository": "marklogicdb/marklogic-db",
74+
"image.tag": "latest",
75+
"persistence.enabled": "false",
76+
"containerSecurityContext.enabled": "false",
77+
},
78+
KubectlOptions: k8s.NewKubectlOptions("", "", namespaceName),
79+
}
80+
81+
// render the tempate
82+
output := helm.RenderTemplate(t, options, helmChartPath, releaseName, []string{"templates/statefulset.yaml"})
83+
84+
var statefulset appsv1.StatefulSet
85+
helm.UnmarshalK8SYaml(t, output, &statefulset)
86+
87+
// Verify the name and namespace matches
88+
require.Equal(t, namespaceName, statefulset.Namespace)
89+
90+
// Verify SecurityContext is not set for container
91+
statefulSetContainers := statefulset.Spec.Template.Spec.Containers
92+
require.Equal(t, len(statefulSetContainers), 1)
93+
require.Nil(t, statefulSetContainers[0].SecurityContext)
94+
}

‎test/template/template_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,7 @@ func TestChartTemplateLogCollection(t *testing.T) {
9090

9191
// Verify the image matches
9292
expectedImage1 := "marklogicdb/marklogic-db:latest"
93-
expectedImage2 := "fluent/fluent-bit:1.9.7"
93+
expectedImage2 := "fluent/fluent-bit:2.0.6"
9494

9595
statefulSetContainers := statefulset.Spec.Template.Spec.Containers
9696
require.Equal(t, len(statefulSetContainers), 2)

0 commit comments

Comments
 (0)