Skip to content

Commit 53a05e7

Browse files
rjeberhardrjeberhard
committed
Merge branch 'owls-110521-backport-3897' into 'release/3.4'
Owls 110521 backport 3897 See merge request weblogic-cloud/weblogic-kubernetes-operator!4335
2 parents 1d52c69 + 0b83fc5 commit 53a05e7

File tree

12 files changed

+159
-37
lines changed

12 files changed

+159
-37
lines changed

‎documentation/domains/Domain.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -850,7 +850,7 @@
850850
"type": "string"
851851
},
852852
"podSecurityContext": {
853-
"description": "Pod-level security attributes. See `kubectl explain pods.spec.securityContext`.",
853+
"description": "Pod-level security attributes. See `kubectl explain pods.spec.podSecurityContext`. Beginning with operator version 3.4.7, if no value is specified for this field, the operator will use default content for the pod-level `securityContext`. More info: https://oracle.github.io/weblogic-kubernetes-operator/security/domain-security/pod-and-container/.",
854854
"$ref": "https://github.com/garethr/kubernetes-json-schema/blob/master/v1.13.5/_definitions.json#/definitions/io.k8s.api.core.v1.PodSecurityContext"
855855
},
856856
"priorityClassName": {
@@ -901,7 +901,7 @@
901901
"$ref": "#/definitions/ProbeTuning"
902902
},
903903
"containerSecurityContext": {
904-
"description": "Container-level security attributes. Will override any matching Pod-level attributes. See `kubectl explain pods.spec.containers.securityContext`.",
904+
"description": "Container-level security attributes. Will override any matching Pod-level attributes. See `kubectl explain pods.spec.containers.securityContext`. Beginning with operator version 3.4.7, if no value is specified for this field, the operator will use default content for container-level `securityContext`. More info: https://oracle.github.io/weblogic-kubernetes-operator/security/domain-security/pod-and-container/.",
905905
"$ref": "https://github.com/garethr/kubernetes-json-schema/blob/master/v1.13.5/_definitions.json#/definitions/io.k8s.api.core.v1.SecurityContext"
906906
},
907907
"schedulerName": {

‎documentation/domains/Domain.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -156,15 +156,15 @@ The current status of the operation of the WebLogic domain. Updated automaticall
156156
| `annotations` | Map | The annotations to be added to generated resources. |
157157
| `auxiliaryImages` | Array of [Auxiliary Image](#auxiliary-image) | Use an auxiliary image to automatically include directory content from additional images. This is a useful alternative for including Model in Image model files, or other types of files, in a pod without requiring modifications to the pod's base image 'domain.spec.image'. This feature internally uses a Kubernetes emptyDir volume and Kubernetes init containers to share the files from the additional images with the pod. |
158158
| `containers` | Array of [Container](k8s1.13.5.md#container) | Additional containers to be included in the server Pod. See `kubectl explain pods.spec.containers`. |
159-
| `containerSecurityContext` | [Security Context](k8s1.13.5.md#security-context) | Container-level security attributes. Will override any matching Pod-level attributes. See `kubectl explain pods.spec.containers.securityContext`. |
159+
| `containerSecurityContext` | [Security Context](k8s1.13.5.md#security-context) | Container-level security attributes. Will override any matching Pod-level attributes. See `kubectl explain pods.spec.containers.securityContext`. Beginning with operator version 3.4.7, if no value is specified for this field, the operator will use default content for container-level `securityContext`. More info: https://oracle.github.io/weblogic-kubernetes-operator/security/domain-security/pod-and-container/. |
160160
| `env` | Array of [Env Var](k8s1.13.5.md#env-var) | A list of environment variables to set in the container running a WebLogic Server instance. More info: https://oracle.github.io/weblogic-kubernetes-operator/userguide/managing-domains/domain-resource/#jvm-memory-and-java-option-environment-variables. See `kubectl explain pods.spec.containers.env`. |
161161
| `hostAliases` | Array of [Host Alias](k8s1.13.5.md#host-alias) | HostAliases is an optional list of hosts and IPs that will be injected into the pod's hosts file if specified. This is only valid for non-hostNetwork pods. |
162162
| `initContainers` | Array of [Container](k8s1.13.5.md#container) | Initialization containers to be included in the server Pod. See `kubectl explain pods.spec.initContainers`. |
163163
| `labels` | Map | The labels to be added to generated resources. The label names must not start with "weblogic.". |
164164
| `livenessProbe` | [Probe Tuning](#probe-tuning) | Settings for the liveness probe associated with a WebLogic Server instance. |
165165
| `nodeName` | string | NodeName is a request to schedule this Pod onto a specific Node. If it is non-empty, the scheduler simply schedules this pod onto that node, assuming that it fits the resource requirements. See `kubectl explain pods.spec.nodeName`. |
166166
| `nodeSelector` | Map | Selector which must match a Node's labels for the Pod to be scheduled on that Node. See `kubectl explain pods.spec.nodeSelector`. |
167-
| `podSecurityContext` | [Pod Security Context](k8s1.13.5.md#pod-security-context) | Pod-level security attributes. See `kubectl explain pods.spec.securityContext`. |
167+
| `podSecurityContext` | [Pod Security Context](k8s1.13.5.md#pod-security-context) | Pod-level security attributes. See `kubectl explain pods.spec.podSecurityContext`. Beginning with operator version 3.4.7, if no value is specified for this field, the operator will use default content for the pod-level `securityContext`. More info: https://oracle.github.io/weblogic-kubernetes-operator/security/domain-security/pod-and-container/. |
168168
| `priorityClassName` | string | If specified, indicates the Pod's priority. "system-node-critical" and "system-cluster-critical" are two special keywords which indicate the highest priorities with the former being the highest priority. Any other name must be defined by creating a PriorityClass object with that name. If not specified, the pod priority will be the default or zero, if there is no default. See `kubectl explain pods.spec.priorityClassName`. |
169169
| `readinessGates` | Array of [Pod Readiness Gate](k8s1.13.5.md#pod-readiness-gate) | If specified, all readiness gates will be evaluated for Pod readiness. A Pod is ready when all its containers are ready AND all conditions specified in the readiness gates have a status equal to "True". More info: https://github.com/kubernetes/community/blob/master/keps/sig-network/0007-pod-ready%2B%2B.md. |
170170
| `readinessProbe` | [Probe Tuning](#probe-tuning) | Settings for the readiness probe associated with a WebLogic Server instance. |

‎kubernetes/charts/weblogic-operator/templates/_operator-dep.tpl

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,9 +33,10 @@ spec:
3333
{{- end }}
3434
spec:
3535
serviceAccountName: {{ .serviceAccount | quote }}
36-
{{- if .runAsUser }}
36+
{{- if (ne ( .kubernetesPlatform | default "Generic" ) "OpenShift") }}
3737
securityContext:
38-
runAsUser: {{ .runAsUser }}
38+
seccompProfile:
39+
type: RuntimeDefault
3940
{{- end }}
4041
{{- with .nodeSelector }}
4142
nodeSelector:
@@ -103,6 +104,15 @@ spec:
103104
{{- if .memoryLimits}}
104105
memory: {{ .memoryLimits }}
105106
{{- end }}
107+
securityContext:
108+
{{- if (ne ( .kubernetesPlatform | default "Generic" ) "OpenShift") }}
109+
runAsUser: {{ .runAsUser | default 1000 }}
110+
{{- end }}
111+
runAsNonRoot: true
112+
privileged: false
113+
allowPrivilegeEscalation: false
114+
capabilities:
115+
drop: ["ALL"]
106116
volumeMounts:
107117
- name: "weblogic-operator-cm-volume"
108118
mountPath: "/operator/config"

‎kubernetes/crd/domain-crd.yaml

Lines changed: 42 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ apiVersion: apiextensions.k8s.io/v1
55
kind: CustomResourceDefinition
66
metadata:
77
annotations:
8-
weblogic.sha256: 0682d363f6541bfb919b1488f4b02e2aa6490b6a2a9a28ded5b3c7dbebf23ddd
8+
weblogic.sha256: 3e97d0a6aae14bdbaa1f844ac80ab297cec9c4c6be23c3cbb6702d378041ad03
99
name: domains.weblogic.oracle
1010
spec:
1111
group: weblogic.oracle
@@ -544,8 +544,11 @@ spec:
544544
Pod is created. See `kubectl explain pods.spec.serviceAccountName`.
545545
type: string
546546
podSecurityContext:
547-
description: Pod-level security attributes. See `kubectl explain
548-
pods.spec.securityContext`.
547+
description: 'Pod-level security attributes. See `kubectl
548+
explain pods.spec.podSecurityContext`. Beginning with operator
549+
version 3.4.7, if no value is specified for this field,
550+
the operator will use default content for the pod-level
551+
`securityContext`. More info: https://oracle.github.io/weblogic-kubernetes-operator/security/domain-security/pod-and-container/.'
549552
properties:
550553
runAsUser:
551554
type: number
@@ -721,9 +724,12 @@ spec:
721724
type: number
722725
type: object
723726
containerSecurityContext:
724-
description: Container-level security attributes. Will override
727+
description: 'Container-level security attributes. Will override
725728
any matching Pod-level attributes. See `kubectl explain
726-
pods.spec.containers.securityContext`.
729+
pods.spec.containers.securityContext`. Beginning with operator
730+
version 3.4.7, if no value is specified for this field,
731+
the operator will use default content for container-level
732+
`securityContext`. More info: https://oracle.github.io/weblogic-kubernetes-operator/security/domain-security/pod-and-container/.'
727733
properties:
728734
privileged:
729735
type: boolean
@@ -3462,8 +3468,11 @@ spec:
34623468
Pod is created. See `kubectl explain pods.spec.serviceAccountName`.
34633469
type: string
34643470
podSecurityContext:
3465-
description: Pod-level security attributes. See `kubectl
3466-
explain pods.spec.securityContext`.
3471+
description: 'Pod-level security attributes. See `kubectl
3472+
explain pods.spec.podSecurityContext`. Beginning with
3473+
operator version 3.4.7, if no value is specified for this
3474+
field, the operator will use default content for the pod-level
3475+
`securityContext`. More info: https://oracle.github.io/weblogic-kubernetes-operator/security/domain-security/pod-and-container/.'
34673476
type: object
34683477
properties:
34693478
runAsUser:
@@ -3642,9 +3651,12 @@ spec:
36423651
check is performed.
36433652
type: number
36443653
containerSecurityContext:
3645-
description: Container-level security attributes. Will override
3646-
any matching Pod-level attributes. See `kubectl explain
3647-
pods.spec.containers.securityContext`.
3654+
description: 'Container-level security attributes. Will
3655+
override any matching Pod-level attributes. See `kubectl
3656+
explain pods.spec.containers.securityContext`. Beginning
3657+
with operator version 3.4.7, if no value is specified
3658+
for this field, the operator will use default content
3659+
for container-level `securityContext`. More info: https://oracle.github.io/weblogic-kubernetes-operator/security/domain-security/pod-and-container/.'
36483660
type: object
36493661
properties:
36503662
privileged:
@@ -6400,8 +6412,11 @@ spec:
64006412
See `kubectl explain pods.spec.serviceAccountName`.
64016413
type: string
64026414
podSecurityContext:
6403-
description: Pod-level security attributes. See `kubectl explain
6404-
pods.spec.securityContext`.
6415+
description: 'Pod-level security attributes. See `kubectl explain
6416+
pods.spec.podSecurityContext`. Beginning with operator version
6417+
3.4.7, if no value is specified for this field, the operator
6418+
will use default content for the pod-level `securityContext`.
6419+
More info: https://oracle.github.io/weblogic-kubernetes-operator/security/domain-security/pod-and-container/.'
64056420
properties:
64066421
runAsUser:
64076422
type: number
@@ -6574,8 +6589,11 @@ spec:
65746589
type: number
65756590
type: object
65766591
containerSecurityContext:
6577-
description: Container-level security attributes. Will override
6592+
description: 'Container-level security attributes. Will override
65786593
any matching Pod-level attributes. See `kubectl explain pods.spec.containers.securityContext`.
6594+
Beginning with operator version 3.4.7, if no value is specified
6595+
for this field, the operator will use default content for container-level
6596+
`securityContext`. More info: https://oracle.github.io/weblogic-kubernetes-operator/security/domain-security/pod-and-container/.'
65796597
properties:
65806598
privileged:
65816599
type: boolean
@@ -9216,8 +9234,11 @@ spec:
92169234
Pod is created. See `kubectl explain pods.spec.serviceAccountName`.
92179235
type: string
92189236
podSecurityContext:
9219-
description: Pod-level security attributes. See `kubectl
9220-
explain pods.spec.securityContext`.
9237+
description: 'Pod-level security attributes. See `kubectl
9238+
explain pods.spec.podSecurityContext`. Beginning with
9239+
operator version 3.4.7, if no value is specified for this
9240+
field, the operator will use default content for the pod-level
9241+
`securityContext`. More info: https://oracle.github.io/weblogic-kubernetes-operator/security/domain-security/pod-and-container/.'
92219242
type: object
92229243
properties:
92239244
runAsUser:
@@ -9396,9 +9417,12 @@ spec:
93969417
check is performed.
93979418
type: number
93989419
containerSecurityContext:
9399-
description: Container-level security attributes. Will override
9400-
any matching Pod-level attributes. See `kubectl explain
9401-
pods.spec.containers.securityContext`.
9420+
description: 'Container-level security attributes. Will
9421+
override any matching Pod-level attributes. See `kubectl
9422+
explain pods.spec.containers.securityContext`. Beginning
9423+
with operator version 3.4.7, if no value is specified
9424+
for this field, the operator will use default content
9425+
for container-level `securityContext`. More info: https://oracle.github.io/weblogic-kubernetes-operator/security/domain-security/pod-and-container/.'
94029426
type: object
94039427
properties:
94049428
privileged:

‎kubernetes/src/test/java/oracle/kubernetes/operator/create/CreateOperatorGeneratedFilesTestBase.java

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,25 @@
1-
// Copyright (c) 2018, 2021, Oracle and/or its affiliates.
1+
// Copyright (c) 2018, 2023, Oracle and/or its affiliates.
22
// Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl.
33

44
package oracle.kubernetes.operator.create;
55

66
import io.kubernetes.client.custom.Quantity;
7+
import io.kubernetes.client.openapi.models.V1Capabilities;
78
import io.kubernetes.client.openapi.models.V1ClusterRole;
89
import io.kubernetes.client.openapi.models.V1ClusterRoleBinding;
910
import io.kubernetes.client.openapi.models.V1ConfigMap;
1011
import io.kubernetes.client.openapi.models.V1Container;
1112
import io.kubernetes.client.openapi.models.V1Deployment;
1213
import io.kubernetes.client.openapi.models.V1LabelSelector;
1314
import io.kubernetes.client.openapi.models.V1Namespace;
15+
import io.kubernetes.client.openapi.models.V1PodSecurityContext;
1416
import io.kubernetes.client.openapi.models.V1Probe;
1517
import io.kubernetes.client.openapi.models.V1ResourceRequirements;
1618
import io.kubernetes.client.openapi.models.V1Role;
1719
import io.kubernetes.client.openapi.models.V1RoleBinding;
20+
import io.kubernetes.client.openapi.models.V1SeccompProfile;
1821
import io.kubernetes.client.openapi.models.V1Secret;
22+
import io.kubernetes.client.openapi.models.V1SecurityContext;
1923
import io.kubernetes.client.openapi.models.V1Service;
2024
import io.kubernetes.client.openapi.models.V1ServiceAccount;
2125
import io.kubernetes.client.openapi.models.V1ServiceSpec;
@@ -188,6 +192,8 @@ protected V1Deployment getExpectedWeblogicOperatorDeployment() {
188192
.spec(
189193
newPodSpec()
190194
.serviceAccountName(getInputs().getServiceAccount())
195+
.securityContext(new V1PodSecurityContext().seccompProfile(
196+
new V1SeccompProfile().type("RuntimeDefault")))
191197
.addContainersItem(
192198
newContainer()
193199
.name("weblogic-operator")
@@ -217,6 +223,11 @@ protected V1Deployment getExpectedWeblogicOperatorDeployment() {
217223
.putRequestsItem("cpu", Quantity.fromString("100m"))
218224
.putRequestsItem(
219225
"memory", Quantity.fromString("512Mi")))
226+
.securityContext(
227+
new V1SecurityContext().runAsUser(1000L)
228+
.runAsNonRoot(true)
229+
.privileged(false).allowPrivilegeEscalation(false)
230+
.capabilities(new V1Capabilities().addDropItem("ALL")))
220231
.addVolumeMountsItem(
221232
newVolumeMount()
222233
.name("weblogic-operator-cm-volume")

‎operator/src/main/java/oracle/kubernetes/operator/helpers/BasePodStepContext.java

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Copyright (c) 2019, 2022, Oracle and/or its affiliates.
1+
// Copyright (c) 2019, 2023, Oracle and/or its affiliates.
22
// Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl.
33

44
package oracle.kubernetes.operator.helpers;
@@ -127,6 +127,7 @@ protected V1Container createInitContainerForAuxiliaryImage(AuxiliaryImage auxili
127127
.command(Collections.singletonList(AUXILIARY_IMAGE_INIT_CONTAINER_WRAPPER_SCRIPT))
128128
.env(createEnv(auxiliaryImage, info.getDomain().getAuxiliaryImageVolumes(), getName(index)))
129129
.resources(createResources())
130+
.securityContext(PodSecurityHelper.getDefaultContainerSecurityContext())
130131
.volumeMounts(Arrays.asList(
131132
new V1VolumeMount().name(getDNS1123auxiliaryImageVolumeName(auxiliaryImage.getVolume()))
132133
.mountPath(AUXILIARY_IMAGE_TARGET_PATH),

‎operator/src/main/java/oracle/kubernetes/operator/helpers/FluentdHelper.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ public static void addFluentdContainer(FluentdSpecification fluentdSpecification
4949
fluentdContainer.setImage(fluentdSpecification.getImage());
5050
fluentdContainer.setImagePullPolicy(fluentdSpecification.getImagePullPolicy());
5151
fluentdContainer.setResources(fluentdSpecification.getResources());
52-
52+
fluentdContainer.setSecurityContext(PodSecurityHelper.getDefaultContainerSecurityContext());
5353
addFluentdContainerEnvList(fluentdSpecification, fluentdContainer, domain, isJobPod);
5454

5555
fluentdSpecification.getVolumeMounts()

0 commit comments

Comments
 (0)