Skip to content

Commit b1c41ef

Browse files
ankediaankedia
authored
OWLS-107961 - Restore security context on init containers to avoid pod roll during operator upgrade from 4.0 to latest. (#4143)
1 parent 6535e20 commit b1c41ef

File tree

5 files changed

+304
-0
lines changed

5 files changed

+304
-0
lines changed

‎operator/src/main/java/oracle/kubernetes/operator/helpers/PodStepContext.java

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1350,6 +1350,12 @@ private void restoreSecurityContext(V1Pod recipe, V1Pod currentPod) {
13501350
container.setSecurityContext(null);
13511351
}
13521352
}));
1353+
Optional.ofNullable(recipe.getSpec().getInitContainers())
1354+
.ifPresent(initContainers -> initContainers.forEach(initContainer -> {
1355+
if (PodSecurityHelper.getDefaultContainerSecurityContext().equals(initContainer.getSecurityContext())) {
1356+
initContainer.setSecurityContext(null);
1357+
}
1358+
}));
13531359
}
13541360

13551361
private boolean canAdjustRecentOperatorMajorVersion3HashToMatch(V1Pod currentPod, String requiredHash) {

‎operator/src/test/java/oracle/kubernetes/operator/helpers/AdminPodHelperTest.java

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -167,6 +167,11 @@ String getReferenceMiiConvertedAuxImagePodYaml_3_4_1() {
167167
return ReferenceObjects.ADMIN_MII_CONVERTED_AUX_IMAGE_POD_3_4_1;
168168
}
169169

170+
@Override
171+
String getReferenceMiiAuxImagePodYaml_4_0() {
172+
return ReferenceObjects.ADMIN_MII_AUX_IMAGE_POD_4_0;
173+
}
174+
170175
@Override
171176
String getReferenceIstioMonitoringExporterTcpProtocol() {
172177
return ReferenceObjects.ADMIN_ISTIO_MONITORING_EXPORTER_TCP_PROTOCOL;

‎operator/src/test/java/oracle/kubernetes/operator/helpers/ManagedPodHelperTest.java

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1329,6 +1329,11 @@ String getReferenceMiiAuxImagePodYaml_3_3() {
13291329
return ReferenceObjects.MANAGED_MII_AUX_IMAGE_POD_3_3;
13301330
}
13311331

1332+
@Override
1333+
String getReferenceMiiAuxImagePodYaml_4_0() {
1334+
return ReferenceObjects.MANAGED_MII_AUX_IMAGE_POD_4_0;
1335+
}
1336+
13321337
@Override
13331338
String getReferenceMiiConvertedAuxImagePodYaml_3_4() {
13341339
return ReferenceObjects.MANAGED_MII_CONVERTED_AUX_IMAGE_POD_3_4;

‎operator/src/test/java/oracle/kubernetes/operator/helpers/PodHelperTestBase.java

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -807,6 +807,9 @@ void whenPodCreated_hasSha256HashAnnotationForRecipe() {
807807
// Returns the YAML for a 3.3 Mii pod with aux image.
808808
abstract String getReferenceMiiAuxImagePodYaml_3_3();
809809

810+
// Returns the YAML for a 4.0 Mii pod with aux image.
811+
abstract String getReferenceMiiAuxImagePodYaml_4_0();
812+
810813
// Returns the YAML for a 3.4 Mii pod with converted aux image.
811814
abstract String getReferenceMiiConvertedAuxImagePodYaml_3_4();
812815

@@ -899,6 +902,20 @@ void afterUpgradingMiiDomainWith3_4_1_ConvertedAuxImages_patchIt() {
899902
assertThat(AnnotationHelper.getHash(patchedPod), equalTo(AnnotationHelper.getHash(createPodModel())));
900903
}
901904

905+
@Test
906+
void afterUpgradingMiiDomainWith4_0_AuxImages_patchIt() {
907+
configureDomain().withAuxiliaryImages(getAuxiliaryImages("wdt-image:v1"));
908+
909+
useProductionHash();
910+
initializeExistingPod(loadPodModel(getReferenceMiiAuxImagePodYaml_4_0()));
911+
912+
verifyPodPatched();
913+
914+
V1Pod patchedPod = domainPresenceInfo.getServerPod(getServerName());
915+
assertThat(patchedPod.getMetadata().getLabels().get(OPERATOR_VERSION), equalTo(TEST_PRODUCT_VERSION));
916+
assertThat(AnnotationHelper.getHash(patchedPod), equalTo(AnnotationHelper.getHash(createPodModel())));
917+
}
918+
902919
@Test
903920
void afterUpgradingPlainPortPodFrom31_patchIt() {
904921
useProductionHash();

‎operator/src/test/java/oracle/kubernetes/operator/helpers/ReferenceObjects.java

Lines changed: 271 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2373,4 +2373,275 @@ class ReferenceObjects {
23732373
+ " name: weblogic-domain-introspect-cm-volume\n"
23742374
+ " - emptyDir: {}\n"
23752375
+ " name: compat-ai-vol-auxiliaryimagevolume1\n";
2376+
2377+
static final String ADMIN_MII_AUX_IMAGE_POD_4_0 =
2378+
"metadata:\n"
2379+
+ " annotations:\n"
2380+
+ " prometheus.io/path: /wls-exporter/metrics\n"
2381+
+ " prometheus.io/port: '7001'\n"
2382+
+ " prometheus.io/scrape: 'true'\n"
2383+
+ " weblogic.sha256: f8ce3566270c93f214545fd8398012c8ce7e48c9e591e3c502f71b3f83259407\n"
2384+
+ " labels:\n"
2385+
+ " weblogic.domainName: domain1\n"
2386+
+ " weblogic.serverName: ADMIN_SERVER\n"
2387+
+ " weblogic.domainRestartVersion: null\n"
2388+
+ " weblogic.domainUID: uid1\n"
2389+
+ " weblogic.createdByOperator: 'true'\n"
2390+
+ " weblogic.operatorVersion: 4.0\n"
2391+
+ " weblogic.clusterRestartVersion: null\n"
2392+
+ " weblogic.serverRestartVersion: null\n"
2393+
+ " name: uid1-admin-server\n"
2394+
+ " namespace: namespace\n"
2395+
+ "spec:\n"
2396+
+ " containers:\n"
2397+
+ " - command:\n"
2398+
+ " - /weblogic-operator/scripts/startServer.sh\n"
2399+
+ " env:\n"
2400+
+ " - name: DOMAIN_NAME\n"
2401+
+ " value: domain1\n"
2402+
+ " - name: DOMAIN_HOME\n"
2403+
+ " value: /u01/oracle/user_projects/domains\n"
2404+
+ " - name: ADMIN_NAME\n"
2405+
+ " value: ADMIN_SERVER\n"
2406+
+ " - name: ADMIN_PORT\n"
2407+
+ " value: '7001'\n"
2408+
+ " - name: SERVER_NAME\n"
2409+
+ " value: ADMIN_SERVER\n"
2410+
+ " - name: DOMAIN_UID\n"
2411+
+ " value: uid1\n"
2412+
+ " - name: NODEMGR_HOME\n"
2413+
+ " value: /u01/nodemanager\n"
2414+
+ " - name: LOG_HOME\n"
2415+
+ " - name: SERVER_OUT_IN_POD_LOG\n"
2416+
+ " value: 'true'\n"
2417+
+ " - name: SERVICE_NAME\n"
2418+
+ " value: uid1-admin-server\n"
2419+
+ " - name: AS_SERVICE_NAME\n"
2420+
+ " value: uid1-admin-server\n"
2421+
+ " - name: USER_MEM_ARGS\n"
2422+
+ " value: -Djava.security.egd=file:/dev/./urandom\n"
2423+
+ " - name: ADMIN_USERNAME\n"
2424+
+ " - name: ADMIN_PASSWORD\n"
2425+
+ " image: image:latest\n"
2426+
+ " imagePullPolicy: Always\n"
2427+
+ " lifecycle:\n"
2428+
+ " preStop:\n"
2429+
+ " exec:\n"
2430+
+ " command:\n"
2431+
+ " - /weblogic-operator/scripts/stopServer.sh\n"
2432+
+ " livenessProbe:\n"
2433+
+ " exec:\n"
2434+
+ " command:\n"
2435+
+ " - /weblogic-operator/scripts/livenessProbe.sh\n"
2436+
+ " failureThreshold: 1\n"
2437+
+ " initialDelaySeconds: 4\n"
2438+
+ " periodSeconds: 6\n"
2439+
+ " timeoutSeconds: 5\n"
2440+
+ " name: weblogic-server\n"
2441+
+ " ports:\n"
2442+
+ " - containerPort: 7001\n"
2443+
+ " name: default\n"
2444+
+ " protocol: TCP\n"
2445+
+ " readinessProbe:\n"
2446+
+ " failureThreshold: 1\n"
2447+
+ " httpGet:\n"
2448+
+ " path: /weblogic/ready\n"
2449+
+ " port: 7001\n"
2450+
+ " initialDelaySeconds: 1\n"
2451+
+ " periodSeconds: 3\n"
2452+
+ " timeoutSeconds: 2\n"
2453+
+ " resources:\n"
2454+
+ " limits: {}\n"
2455+
+ " requests:\n"
2456+
+ " memory: 768Mi\n"
2457+
+ " cpu: 250m\n"
2458+
+ " securityContext: {}\n"
2459+
+ " volumeMounts:\n"
2460+
+ " - mountPath: /weblogic-operator/scripts\n"
2461+
+ " name: weblogic-scripts-cm-volume\n"
2462+
+ " readOnly: true\n"
2463+
+ " - mountPath: /weblogic-operator/debug\n"
2464+
+ " name: weblogic-domain-debug-cm-volume\n"
2465+
+ " readOnly: true\n"
2466+
+ " - mountPath: /weblogic-operator/introspector\n"
2467+
+ " name: weblogic-domain-introspect-cm-volume\n"
2468+
+ " - mountPath: /auxiliary\n"
2469+
+ " name: aux-image-volume-auxiliaryimagevolume1\n"
2470+
+ " hostname: uid1-admin-server\n"
2471+
+ " imagePullSecrets: []\n"
2472+
+ " initContainers:\n"
2473+
+ " - command:\n"
2474+
+ " - /weblogic-operator/scripts/auxImage.sh\n"
2475+
+ " env:\n"
2476+
+ " - name: AUXILIARY_IMAGE_PATH\n"
2477+
+ " value: /auxiliary\n"
2478+
+ " - name: AUXILIARY_IMAGE_TARGET_PATH\n"
2479+
+ " value: /tmpAuxiliaryImage\n"
2480+
+ " - name: AUXILIARY_IMAGE_COMMAND\n"
2481+
+ " value: cp -R $AUXILIARY_IMAGE_PATH/* $AUXILIARY_IMAGE_TARGET_PATH\n"
2482+
+ " - name: AUXILIARY_IMAGE_CONTAINER_IMAGE\n"
2483+
+ " value: model-in-image:WLS-AI-v1\n"
2484+
+ " - name: AUXILIARY_IMAGE_CONTAINER_NAME\n"
2485+
+ " value: operator-aux-container1\n"
2486+
+ " image: model-in-image:WLS-AI-v1\n"
2487+
+ " imagePullPolicy: IfNotPresent\n"
2488+
+ " name: operator-aux-container1\n"
2489+
+ " volumeMounts:\n"
2490+
+ " - mountPath: /tmpAuxiliaryImage\n"
2491+
+ " name: aux-image-volume-auxiliaryimagevolume1\n"
2492+
+ " - mountPath: /weblogic-operator/scripts\n"
2493+
+ " name: weblogic-scripts-cm-volume\n"
2494+
+ " nodeSelector: {}\n"
2495+
+ " securityContext: {}\n"
2496+
+ " volumes:\n"
2497+
+ " - configMap:\n"
2498+
+ " defaultMode: 365\n"
2499+
+ " name: weblogic-scripts-cm\n"
2500+
+ " name: weblogic-scripts-cm-volume\n"
2501+
+ " - configMap:\n"
2502+
+ " defaultMode: 365\n"
2503+
+ " name: uid1-weblogic-domain-debug-cm\n"
2504+
+ " optional: true\n"
2505+
+ " name: weblogic-domain-debug-cm-volume\n"
2506+
+ " - configMap:\n"
2507+
+ " defaultMode: 365\n"
2508+
+ " name: uid1-weblogic-domain-introspect-cm\n"
2509+
+ " name: weblogic-domain-introspect-cm-volume\n"
2510+
+ " - emptyDir: {}\n"
2511+
+ " name: aux-image-volume-auxiliaryimagevolume1\n";
2512+
2513+
static final String MANAGED_MII_AUX_IMAGE_POD_4_0 =
2514+
"metadata:\n"
2515+
+ " annotations:\n"
2516+
+ " prometheus.io/path: /wls-exporter/metrics\n"
2517+
+ " prometheus.io/port: '7001'\n"
2518+
+ " prometheus.io/scrape: 'true'\n"
2519+
+ " weblogic.sha256: 82ec0ede6f40b4cd03d5cc40c593f8552677a89b73e602df33afe967b378881a\n"
2520+
+ " labels:\n"
2521+
+ " weblogic.domainName: domain1\n"
2522+
+ " weblogic.serverName: ess_server1\n"
2523+
+ " weblogic.domainRestartVersion: null\n"
2524+
+ " weblogic.domainUID: uid1\n"
2525+
+ " weblogic.createdByOperator: 'true'\n"
2526+
+ " weblogic.operatorVersion: 4.0\n"
2527+
+ " weblogic.clusterRestartVersion: null\n"
2528+
+ " weblogic.serverRestartVersion: null\n"
2529+
+ " name: uid1-ess-server1\n"
2530+
+ " namespace: namespace\n"
2531+
+ "spec:\n"
2532+
+ " containers:\n"
2533+
+ " - command:\n"
2534+
+ " - /weblogic-operator/scripts/startServer.sh\n"
2535+
+ " env:\n"
2536+
+ " - name: DOMAIN_NAME\n"
2537+
+ " value: domain1\n"
2538+
+ " - name: DOMAIN_HOME\n"
2539+
+ " value: /u01/oracle/user_projects/domains\n"
2540+
+ " - name: ADMIN_NAME\n"
2541+
+ " value: ADMIN_SERVER\n"
2542+
+ " - name: ADMIN_PORT\n"
2543+
+ " value: '7001'\n"
2544+
+ " - name: SERVER_NAME\n"
2545+
+ " value: ess_server1\n"
2546+
+ " - name: DOMAIN_UID\n"
2547+
+ " value: uid1\n"
2548+
+ " - name: NODEMGR_HOME\n"
2549+
+ " value: /u01/nodemanager\n"
2550+
+ " - name: LOG_HOME\n"
2551+
+ " - name: SERVER_OUT_IN_POD_LOG\n"
2552+
+ " value: 'true'\n"
2553+
+ " - name: SERVICE_NAME\n"
2554+
+ " value: uid1-ess-server1\n"
2555+
+ " - name: AS_SERVICE_NAME\n"
2556+
+ " value: uid1-admin-server\n"
2557+
+ " - name: USER_MEM_ARGS\n"
2558+
+ " value: -Djava.security.egd=file:/dev/./urandom\n"
2559+
+ " - name: ADMIN_USERNAME\n"
2560+
+ " - name: ADMIN_PASSWORD\n"
2561+
+ " image: image:latest\n"
2562+
+ " imagePullPolicy: Always\n"
2563+
+ " lifecycle:\n"
2564+
+ " preStop:\n"
2565+
+ " exec:\n"
2566+
+ " command:\n"
2567+
+ " - /weblogic-operator/scripts/stopServer.sh\n"
2568+
+ " livenessProbe:\n"
2569+
+ " exec:\n"
2570+
+ " command:\n"
2571+
+ " - /weblogic-operator/scripts/livenessProbe.sh\n"
2572+
+ " failureThreshold: 1\n"
2573+
+ " initialDelaySeconds: 4\n"
2574+
+ " periodSeconds: 6\n"
2575+
+ " timeoutSeconds: 5\n"
2576+
+ " name: weblogic-server\n"
2577+
+ " ports:\n"
2578+
+ " - containerPort: 8001\n"
2579+
+ " name: default\n"
2580+
+ " protocol: TCP\n"
2581+
+ " readinessProbe:\n"
2582+
+ " failureThreshold: 1\n"
2583+
+ " httpGet:\n"
2584+
+ " path: /weblogic/ready\n"
2585+
+ " port: 8001\n"
2586+
+ " initialDelaySeconds: 1\n"
2587+
+ " periodSeconds: 3\n"
2588+
+ " timeoutSeconds: 2\n"
2589+
+ " resources:\n"
2590+
+ " limits: {}\n"
2591+
+ " requests:\n"
2592+
+ " memory: 768Mi\n"
2593+
+ " cpu: 250m\n"
2594+
+ " securityContext: {}\n"
2595+
+ " volumeMounts:\n"
2596+
+ " - mountPath: /weblogic-operator/scripts\n"
2597+
+ " name: weblogic-scripts-cm-volume\n"
2598+
+ " readOnly: true\n"
2599+
+ " - mountPath: /weblogic-operator/debug\n"
2600+
+ " name: weblogic-domain-debug-cm-volume\n"
2601+
+ " readOnly: true\n"
2602+
+ " - mountPath: /weblogic-operator/introspector\n"
2603+
+ " name: weblogic-domain-introspect-cm-volume\n"
2604+
+ " - mountPath: /auxiliary\n"
2605+
+ " name: aux-image-volume-auxiliaryimagevolume1\n"
2606+
+ " imagePullSecrets: []\n"
2607+
+ " initContainers:\n"
2608+
+ " - command:\n"
2609+
+ " - /weblogic-operator/scripts/auxImage.sh\n"
2610+
+ " env:\n"
2611+
+ " - name: AUXILIARY_IMAGE_PATH\n"
2612+
+ " value: /auxiliary\n"
2613+
+ " - name: AUXILIARY_IMAGE_TARGET_PATH\n"
2614+
+ " value: /tmpAuxiliaryImage\n"
2615+
+ " - name: AUXILIARY_IMAGE_COMMAND\n"
2616+
+ " value: cp -R $AUXILIARY_IMAGE_PATH/* $AUXILIARY_IMAGE_TARGET_PATH\n"
2617+
+ " - name: AUXILIARY_IMAGE_CONTAINER_IMAGE\n"
2618+
+ " value: model-in-image:WLS-AI-v1\n"
2619+
+ " - name: AUXILIARY_IMAGE_CONTAINER_NAME\n"
2620+
+ " value: operator-aux-container1\n"
2621+
+ " image: model-in-image:WLS-AI-v1\n"
2622+
+ " imagePullPolicy: IfNotPresent\n"
2623+
+ " name: operator-aux-container1\n"
2624+
+ " volumeMounts:\n"
2625+
+ " - mountPath: /tmpAuxiliaryImage\n"
2626+
+ " name: aux-image-volume-auxiliaryimagevolume1\n"
2627+
+ " - mountPath: /weblogic-operator/scripts\n"
2628+
+ " name: weblogic-scripts-cm-volume\n"
2629+
+ " nodeSelector: {}\n"
2630+
+ " securityContext: {}\n"
2631+
+ " volumes:\n"
2632+
+ " - configMap:\n"
2633+
+ " defaultMode: 365\n"
2634+
+ " name: weblogic-scripts-cm\n"
2635+
+ " name: weblogic-scripts-cm-volume\n"
2636+
+ " - configMap:\n"
2637+
+ " defaultMode: 365\n"
2638+
+ " name: uid1-weblogic-domain-debug-cm\n"
2639+
+ " optional: true\n"
2640+
+ " name: weblogic-domain-debug-cm-volume\n"
2641+
+ " - configMap:\n"
2642+
+ " defaultMode: 365\n"
2643+
+ " name: uid1-weblogic-domain-introspect-cm\n"
2644+
+ " name: weblogic-domain-introspect-cm-volume\n"
2645+
+ " - emptyDir: {}\n"
2646+
+ " name: aux-image-volume-auxiliaryimagevolume1\n";
23762647
}

0 commit comments

Comments
 (0)