Skip to content

Commit bffde29

Browse files
marinakogrjeberhard
marinakog
authored and
rjeberhard
committed
Backport for prometheus and grafana sec context changes
1 parent db4cce3 commit bffde29

File tree

8 files changed

+208
-17
lines changed

8 files changed

+208
-17
lines changed

‎integration-tests/src/test/java/oracle/weblogic/kubernetes/ItMonitoringExporterMetricsFiltering.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,7 @@ class ItMonitoringExporterMetricsFiltering {
112112
private static Map<String, Integer> clusterNameMsPortMap;
113113
private static LoggingFacade logger = null;
114114
private static List<String> clusterNames = new ArrayList<>();
115-
private static String releaseSuffix = "test2";
115+
private static String releaseSuffix = "testfilter";
116116
private static String prometheusReleaseName = "prometheus" + releaseSuffix;
117117
private static String grafanaReleaseName = "grafana" + releaseSuffix;
118118
private static String monitoringExporterDir;

‎integration-tests/src/test/java/oracle/weblogic/kubernetes/ItMonitoringExporterSamples.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -154,7 +154,7 @@ class ItMonitoringExporterSamples {
154154
private static Map<String, Integer> clusterNameMsPortMap;
155155
private static LoggingFacade logger = null;
156156
private static List<String> clusterNames = new ArrayList<>();
157-
private static String releaseSuffix = "test3";
157+
private static String releaseSuffix = "testsamples";
158158
private static String prometheusReleaseName = "prometheus" + releaseSuffix;
159159
private static String grafanaReleaseName = "grafana" + releaseSuffix;
160160
private static String monitoringExporterDir;

‎integration-tests/src/test/java/oracle/weblogic/kubernetes/ItMonitoringExporterWebApp.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -130,7 +130,7 @@ class ItMonitoringExporterWebApp {
130130
private static Map<String, Integer> clusterNameMsPortMap;
131131
private static LoggingFacade logger = null;
132132
private static List<String> clusterNames = new ArrayList<>();
133-
private static String releaseSuffix = "test2";
133+
private static String releaseSuffix = "testwebapp";
134134
private static String prometheusReleaseName = "prometheus" + releaseSuffix;
135135
private static String grafanaReleaseName = "grafana" + releaseSuffix;
136136
private static String monitoringExporterDir;

‎integration-tests/src/test/java/oracle/weblogic/kubernetes/utils/CommonMiiTestUtils.java

Lines changed: 115 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Copyright (c) 2020, 2022, Oracle and/or its affiliates.
1+
// Copyright (c) 2020, 2023, Oracle and/or its affiliates.
22
// Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl.
33

44
package oracle.weblogic.kubernetes.utils;
@@ -655,6 +655,54 @@ public static DomainResource createDomainResourceWithLogHome(
655655
String dbSecretName,
656656
boolean onlineUpdateEnabled,
657657
boolean setDataHome) {
658+
return createDomainResourceWithLogHome(domainResourceName,
659+
domNamespace,
660+
imageName,
661+
adminSecretName,
662+
repoSecretName,
663+
encryptionSecretName,
664+
pvName,
665+
pvcName,
666+
configMapName,
667+
dbSecretName,
668+
"-Dweblogic.security.SSL.ignoreHostnameVerification=true",
669+
onlineUpdateEnabled,
670+
setDataHome);
671+
}
672+
673+
/**
674+
* Create a domain object for a Kubernetes domain custom resource using the basic model-in-image
675+
* image.
676+
*
677+
* @param domainResourceName name of the domain resource
678+
* @param domNamespace Kubernetes namespace that the domain is hosted
679+
* @param imageName name of the image including its tag
680+
* @param adminSecretName name of the new WebLogic admin credentials secret
681+
* @param repoSecretName name of the secret for pulling the WebLogic image
682+
* @param encryptionSecretName name of the secret used to encrypt the models
683+
* @param pvName Name of persistent volume
684+
* @param pvcName Name of persistent volume claim
685+
* @param configMapName name of the configMap containing Weblogic Deploy Tooling model
686+
* @param dbSecretName name of the Secret for WebLogic configuration overrides
687+
* @param javaOpt sting of all java options to be set
688+
* @param onlineUpdateEnabled whether to enable onlineUpdate feature for mii dynamic update
689+
* @param setDataHome whether to set data home at domain resource
690+
* @return domain object of the domain resource
691+
*/
692+
public static DomainResource createDomainResourceWithLogHome(
693+
String domainResourceName,
694+
String domNamespace,
695+
String imageName,
696+
String adminSecretName,
697+
String repoSecretName,
698+
String encryptionSecretName,
699+
String pvName,
700+
String pvcName,
701+
String configMapName,
702+
String dbSecretName,
703+
String javaOpt,
704+
boolean onlineUpdateEnabled,
705+
boolean setDataHome) {
658706
LoggingFacade logger = getLogger();
659707

660708
List<String> securityList = new ArrayList<>();
@@ -679,7 +727,7 @@ public static DomainResource createDomainResourceWithLogHome(
679727
.serverPod(new ServerPod()
680728
.addEnvItem(new V1EnvVar()
681729
.name("JAVA_OPTIONS")
682-
.value("-Dweblogic.security.SSL.ignoreHostnameVerification=true"))
730+
.value(javaOpt))
683731
.addEnvItem(new V1EnvVar()
684732
.name("USER_MEM_ARGS")
685733
.value("-Djava.security.egd=file:/dev/./urandom "))
@@ -1156,6 +1204,71 @@ public static void createJobToChangePermissionsOnPvHostPath(String pvName, Strin
11561204
}
11571205
}
11581206

1207+
/**
1208+
* Create a job to change the permissions on the pv host path.
1209+
*
1210+
* @param pvName Name of the persistent volume
1211+
* @param pvcName Name of the persistent volume claim
1212+
* @param namespace Namespace containing the persistent volume claim and where the job should be created in
1213+
* @param mountPath path
1214+
* @param command to change permission
1215+
*/
1216+
public static void createJobToChangePermissionsOnPvHostPath(String pvName, String pvcName,
1217+
String namespace, String mountPath, String command) {
1218+
LoggingFacade logger = getLogger();
1219+
1220+
if (!OKD) {
1221+
logger.info("Running Kubernetes job to create domain");
1222+
V1Job jobBody = new V1Job()
1223+
.metadata(
1224+
new V1ObjectMeta()
1225+
.name("change-permissions-onpv-job-" + pvName) // name of the job
1226+
.namespace(namespace))
1227+
.spec(new V1JobSpec()
1228+
.backoffLimit(0) // try only once
1229+
.template(new V1PodTemplateSpec()
1230+
.spec(new V1PodSpec()
1231+
.restartPolicy("Never")
1232+
.addContainersItem(
1233+
createfixPVCOwnerContainer(pvName,
1234+
mountPath,
1235+
command))
1236+
.volumes(Arrays.asList(
1237+
new V1Volume()
1238+
.name(pvName)
1239+
.persistentVolumeClaim(
1240+
new V1PersistentVolumeClaimVolumeSource()
1241+
.claimName(pvcName))))
1242+
.imagePullSecrets(Arrays.asList(
1243+
new V1LocalObjectReference()
1244+
.name(TEST_IMAGES_REPO_SECRET_NAME)))))); // this secret is used only for non-kind cluster
1245+
1246+
String jobName = createJobAndWaitUntilComplete(jobBody, namespace);
1247+
1248+
// check job status and fail test if the job failed
1249+
V1Job job = assertDoesNotThrow(() -> getJob(jobName, namespace),
1250+
"Getting the job failed");
1251+
if (job != null) {
1252+
V1JobCondition jobCondition = job.getStatus().getConditions().stream().filter(
1253+
v1JobCondition -> "Failed".equals(v1JobCondition.getType()))
1254+
.findAny()
1255+
.orElse(null);
1256+
if (jobCondition != null) {
1257+
logger.severe("Job {0} failed to change permissions on PV hostpath", jobName);
1258+
List<V1Pod> pods = assertDoesNotThrow(() -> listPods(
1259+
namespace, "job-name=" + jobName).getItems(),
1260+
"Listing pods failed");
1261+
if (!pods.isEmpty()) {
1262+
String podLog = assertDoesNotThrow(() -> getPodLog(pods.get(0).getMetadata().getName(), namespace),
1263+
"Failed to get pod log");
1264+
logger.severe(podLog);
1265+
fail("Change permissions on PV hostpath job failed");
1266+
}
1267+
}
1268+
}
1269+
}
1270+
}
1271+
11591272
/**
11601273
* Check logs are written on PV by running the specified command on the pod.
11611274
* @param domainNamespace Kubernetes namespace that the domain is hosted

‎integration-tests/src/test/java/oracle/weblogic/kubernetes/utils/MonitoringUtils.java

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -583,7 +583,7 @@ public static GrafanaParams installAndVerifyGrafana(String grafanaReleaseName,
583583
BUSYBOX_IMAGE), "Failed to replace String ");
584584
assertDoesNotThrow(() -> replaceStringInFile(targetGrafanaFile.toString(),
585585
"busybox_tag",
586-
BUSYBOX_TAG), "Failed to replace String ");
586+
BUSYBOX_TAG), "Failed to replace String ");
587587
if (!OKE_CLUSTER) {
588588
assertDoesNotThrow(() -> replaceStringInFile(targetGrafanaFile.toString(),
589589
"enabled: false", "enabled: true"));
@@ -668,6 +668,9 @@ public static void cleanupPromGrafanaClusterRoles(String prometheusReleaseName,
668668
if (ClusterRole.clusterRoleExists(prometheusReleaseName + "-kube-state-metrics")) {
669669
Kubernetes.deleteClusterRole(prometheusReleaseName + "-kube-state-metrics");
670670
}
671+
if (ClusterRole.clusterRoleExists(prometheusReleaseName + "-pushgateway")) {
672+
Kubernetes.deleteClusterRole(prometheusReleaseName + "-pushgateway");
673+
}
671674
if (ClusterRole.clusterRoleExists(prometheusReleaseName + "-server")) {
672675
Kubernetes.deleteClusterRole(prometheusReleaseName + "-server");
673676
}
@@ -686,6 +689,9 @@ public static void cleanupPromGrafanaClusterRoles(String prometheusReleaseName,
686689
if (ClusterRoleBinding.clusterRoleBindingExists(prometheusReleaseName + "-kube-state-metrics")) {
687690
Kubernetes.deleteClusterRoleBinding(prometheusReleaseName + "-kube-state-metrics");
688691
}
692+
if (ClusterRoleBinding.clusterRoleBindingExists(prometheusReleaseName + "-pushgateway")) {
693+
Kubernetes.deleteClusterRoleBinding(prometheusReleaseName + "-pushgateway");
694+
}
689695
if (ClusterRoleBinding.clusterRoleBindingExists(prometheusReleaseName + "-server")) {
690696
Kubernetes.deleteClusterRoleBinding(prometheusReleaseName + "-server");
691697
}

‎integration-tests/src/test/java/oracle/weblogic/kubernetes/utils/PersistentVolumeUtils.java

Lines changed: 60 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Copyright (c) 2021, 2022, Oracle and/or its affiliates.
1+
// Copyright (c) 2021, 2023, Oracle and/or its affiliates.
22
// Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl.
33

44

@@ -42,7 +42,9 @@
4242
import static oracle.weblogic.kubernetes.assertions.TestAssertions.pvExists;
4343
import static oracle.weblogic.kubernetes.assertions.TestAssertions.pvNotExists;
4444
import static oracle.weblogic.kubernetes.assertions.TestAssertions.pvcExists;
45+
import static oracle.weblogic.kubernetes.utils.CommonMiiTestUtils.createJobToChangePermissionsOnPvHostPath;
4546
import static oracle.weblogic.kubernetes.utils.CommonTestUtils.testUntil;
47+
import static oracle.weblogic.kubernetes.utils.ImageUtils.createTestRepoSecret;
4648
import static oracle.weblogic.kubernetes.utils.ThreadSafeLogger.getLogger;
4749
import static org.apache.commons.io.FileUtils.deleteDirectory;
4850
import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
@@ -193,6 +195,13 @@ public static void createPV(String pvName, String domainUid, String className) {
193195
boolean success = assertDoesNotThrow(() -> createPersistentVolume(v1pv),
194196
"Failed to create persistent volume");
195197
assertTrue(success, "PersistentVolume creation failed");
198+
199+
testUntil(
200+
assertDoesNotThrow(() -> pvExists(pvName, null),
201+
String.format("pvExists failed with ApiException when checking pv %s", pvName)),
202+
logger,
203+
"persistent volume {0} exists",
204+
pvName);
196205
}
197206

198207
public static void setVolumeSource(Path pvHostPath, V1PersistentVolume v1pv) {
@@ -204,6 +213,7 @@ private static void setVolumeSource(Path pvHostPath, V1PersistentVolume v1pv, St
204213
String fssDir = FSS_DIR[new Random().nextInt(FSS_DIR.length)];
205214
LoggingFacade logger = getLogger();
206215
logger.info("Using FSS PV directory {0}", fssDir);
216+
logger.info("Using NFS_SERVER {0}", NFS_SERVER);
207217
v1pv.getSpec()
208218
.storageClassName("oci-fss")
209219
.nfs(new V1NFSVolumeSource()
@@ -225,8 +235,14 @@ private static void setVolumeSource(Path pvHostPath, V1PersistentVolume v1pv, St
225235
}
226236
}
227237

238+
/**
239+
* Create PV hostPath directory.
240+
* @param pvName Persistent Volume Name
241+
* @param className Test class name to create the PV
242+
* @return Path object representing PV host path
243+
*/
228244
@Nonnull
229-
private static Path createPVHostPathDir(String pvName, String className) {
245+
public static Path createPVHostPathDir(String pvName, String className) {
230246
Path pvHostPath = null;
231247
LoggingFacade logger = getLogger();
232248
try {
@@ -280,6 +296,16 @@ public static void createPVC(String pvName, String pvcName, String domainUid, St
280296
boolean success = assertDoesNotThrow(() -> createPersistentVolumeClaim(v1pvc),
281297
"Failed to create persistent volume claim");
282298
assertTrue(success, "PersistentVolumeClaim creation failed");
299+
300+
// wait for PVC exists
301+
testUntil(
302+
assertDoesNotThrow(() -> pvcExists(pvcName, namespace),
303+
String.format("pvcExists failed with ApiException when checking pvc %s in namespace %s",
304+
pvcName, namespace)),
305+
logger,
306+
"persistent volume claim {0} exists in namespace {1}",
307+
pvcName,
308+
namespace);
283309
}
284310

285311
/**
@@ -297,13 +323,26 @@ public static synchronized V1Container createfixPVCOwnerContainer(String pvName,
297323
+ mountPath
298324
+ "/. -maxdepth 1 ! -name '.snapshot' ! -name '.' -print0 | xargs -r -0 chown -R 1000:0";
299325
}
326+
return createfixPVCOwnerContainer(pvName, mountPath, argCommand);
327+
}
328+
329+
/**
330+
* Create container to fix pvc owner for pod.
331+
*
332+
* @param pvName name of pv
333+
* @param mountPath mounting path for pv
334+
* @param command to run for ownership
335+
* @return container object with required ownership based on OKE_CLUSTER variable value.
336+
*/
337+
public static synchronized V1Container createfixPVCOwnerContainer(String pvName, String mountPath, String command) {
338+
300339
V1Container container = new V1Container()
301340
.name("fix-pvc-owner") // change the ownership of the pv to opc:opc
302341
.image(WEBLOGIC_IMAGE_TO_USE_IN_SPEC)
303342
.imagePullPolicy(IMAGE_PULL_POLICY)
304343
.addCommandItem("/bin/sh")
305344
.addArgsItem("-c")
306-
.addArgsItem(argCommand)
345+
.addArgsItem(command)
307346
.volumeMounts(Arrays.asList(
308347
new V1VolumeMount()
309348
.name(pvName)
@@ -381,6 +420,23 @@ public static void createPvAndPvc(String nameSuffix, String namespace,
381420
.storageClassName(nameSuffix);
382421
}
383422

384-
createPVPVCAndVerify(v1pv,v1pvc, labelSelector, namespace);
423+
createPVPVCAndVerify(v1pv, v1pvc, labelSelector, namespace);
424+
if (nameSuffix.contains("grafana") || nameSuffix.contains("prometheus")) {
425+
String mountPath = "/data";
426+
if (nameSuffix.contains("grafana")) {
427+
mountPath = "/var/lib/grafana";
428+
}
429+
String argCommand = "chown -R 1000:1000 " + mountPath;
430+
if (OKE_CLUSTER) {
431+
argCommand = "chown 1000:1000 " + mountPath
432+
+ "/. && find "
433+
+ mountPath
434+
+ "/. -maxdepth 1 ! -name '.snapshot' ! -name '.' -print0 | xargs -r -0 chown -R 1000:1000";
435+
}
436+
createTestRepoSecret(namespace);
437+
createJobToChangePermissionsOnPvHostPath("pv-test" + nameSuffix,
438+
"pvc-" + nameSuffix, namespace,
439+
mountPath, argCommand);
440+
}
385441
}
386442
}

‎integration-tests/src/test/resources/exporter/grafanavalues.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,6 @@ initChownData:
3131
pullPolicy: IfNotPresent
3232

3333
securityContext:
34-
fsGroup: 0
35-
runAsGroup: 0
36-
runAsUser: 0
34+
fsGroup: 1000
35+
runAsGroup: 1000
36+
runAsUser: 1000

‎integration-tests/src/test/resources/exporter/promvalues.yaml

Lines changed: 20 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,9 @@ alertmanager:
2626
tag: prometheus_alertmanager_tag
2727
pullPolicy: IfNotPresent
2828
securityContext:
29-
runAsUser: 65534
29+
runAsUser: 1000
3030
runAsNonRoot: true
31-
runAsGroup: 65534
31+
runAsGroup: 1000
3232

3333
#nodeExporter:
3434
prometheus-node-exporter:
@@ -66,8 +66,24 @@ server:
6666
type: NodePort
6767
nodePort: 30500
6868
securityContext:
69-
runAsUser: 0
70-
runAsNonRoot: false
69+
runAsNonRoot: true
70+
runAsUser: 1000
71+
initContainers:
72+
- command: [ "chown","-R","1000:1000","/data" ]
73+
image: busybox
74+
name: prometheus-data-permission-fix
75+
volumeMounts:
76+
- mountPath: /data
77+
name: storage-volume
78+
securityContext:
79+
runAsNonRoot: false
80+
runAsUser: 0
81+
runAsGroup: 0
82+
83+
volumes:
84+
- name: storage-volume
85+
persistentVolumeClaim:
86+
claimName: pvc-prometheus
7187

7288
global:
7389
evaluation_interval: 1m

0 commit comments

Comments
 (0)