Skip to content

Commit 1123dbe

Browse files
pooknullhors
pooknull
and
hors
authored
K8SPS-340: set initContainer security context of restore job to .spec.backup.containerSecuriryContext (#675)
* K8SPS-340: update initContainer security context of restore job https://perconadev.atlassian.net/browse/K8SPS-340 * use `containerSecurityContext` from `.spec.backup.storages[]` * check backup job in test --------- Co-authored-by: Viacheslav Sarzhan <[email protected]>
1 parent a13687f commit 1123dbe

File tree

10 files changed

+264
-81
lines changed

10 files changed

+264
-81
lines changed

‎e2e-tests/tests/gr-security-context/04-assert.yaml

Lines changed: 86 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -2,24 +2,91 @@ apiVersion: kuttl.dev/v1beta1
22
kind: TestAssert
33
timeout: 300
44
---
5-
kind: PerconaServerMySQLBackup
6-
apiVersion: ps.percona.com/v1alpha1
5+
apiVersion: batch/v1
6+
kind: Job
77
metadata:
8-
name: gr-security-context-minio
8+
generation: 1
9+
labels:
10+
app.kubernetes.io/component: xtrabackup
11+
app.kubernetes.io/instance: gr-security-context
12+
app.kubernetes.io/managed-by: percona-server-operator
13+
app.kubernetes.io/name: percona-server
14+
app.kubernetes.io/part-of: percona-server
15+
name: xb-gr-security-context-minio-minio
16+
spec:
17+
backoffLimit: 6
18+
completionMode: NonIndexed
19+
completions: 1
20+
parallelism: 1
21+
suspend: false
22+
template:
23+
metadata:
24+
creationTimestamp: null
25+
labels:
26+
app.kubernetes.io/component: xtrabackup
27+
app.kubernetes.io/instance: gr-security-context
28+
app.kubernetes.io/managed-by: percona-server-operator
29+
app.kubernetes.io/name: percona-server
30+
app.kubernetes.io/part-of: percona-server
31+
job-name: xb-gr-security-context-minio-minio
32+
spec:
33+
containers:
34+
- command:
35+
- /opt/percona/run-backup.sh
36+
image: perconalab/percona-server-mysql-operator:main-backup
37+
imagePullPolicy: Always
38+
name: xtrabackup
39+
resources: {}
40+
securityContext:
41+
privileged: true
42+
terminationMessagePath: /dev/termination-log
43+
terminationMessagePolicy: File
44+
volumeMounts:
45+
- mountPath: /opt/percona
46+
name: bin
47+
- mountPath: /var/lib/mysql
48+
name: datadir
49+
- mountPath: /etc/mysql/mysql-tls-secret
50+
name: tls
51+
dnsPolicy: ClusterFirst
52+
initContainers:
53+
- command:
54+
- /opt/percona-server-mysql-operator/ps-init-entrypoint.sh
55+
imagePullPolicy: Always
56+
name: xtrabackup-init
57+
resources: {}
58+
securityContext:
59+
privileged: true
60+
terminationMessagePath: /dev/termination-log
61+
terminationMessagePolicy: File
62+
volumeMounts:
63+
- mountPath: /opt/percona
64+
name: bin
65+
restartPolicy: Never
66+
schedulerName: default-scheduler
67+
securityContext:
68+
fsGroup: 1001
69+
supplementalGroups:
70+
- 1001
71+
- 1002
72+
- 1003
73+
setHostnameAsFQDN: true
74+
shareProcessNamespace: true
75+
terminationGracePeriodSeconds: 30
76+
volumes:
77+
- emptyDir: {}
78+
name: bin
79+
- emptyDir: {}
80+
name: datadir
81+
- name: users
82+
secret:
83+
defaultMode: 420
84+
secretName: test-secrets
85+
- name: tls
86+
secret:
87+
defaultMode: 420
88+
secretName: test-ssl
989
status:
10-
state: Succeeded
11-
storage:
12-
containerSecurityContext:
13-
privileged: true
14-
podSecurityContext:
15-
fsGroup: 1001
16-
supplementalGroups:
17-
- 1001
18-
- 1002
19-
- 1003
20-
s3:
21-
bucket: operator-testing
22-
credentialsSecret: minio-secret
23-
endpointUrl: http://minio-service:9000
24-
region: us-east-1
25-
type: s3
90+
active: 1
91+
ready: 0
92+
uncountedTerminatedPods: {}

‎e2e-tests/tests/gr-security-context/05-assert.yaml

Lines changed: 21 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,25 @@
11
apiVersion: kuttl.dev/v1beta1
22
kind: TestAssert
3-
timeout: 30
3+
timeout: 300
44
---
5-
kind: ConfigMap
6-
apiVersion: v1
5+
kind: PerconaServerMySQLBackup
6+
apiVersion: ps.percona.com/v1alpha1
77
metadata:
8-
name: 04-delete-data-minio-0
9-
data:
10-
data: ""
11-
---
12-
kind: ConfigMap
13-
apiVersion: v1
14-
metadata:
15-
name: 04-delete-data-minio-1
16-
data:
17-
data: ""
18-
---
19-
kind: ConfigMap
20-
apiVersion: v1
21-
metadata:
22-
name: 04-delete-data-minio-2
23-
data:
24-
data: ""
8+
name: gr-security-context-minio
9+
status:
10+
state: Succeeded
11+
storage:
12+
containerSecurityContext:
13+
privileged: true
14+
podSecurityContext:
15+
fsGroup: 1001
16+
supplementalGroups:
17+
- 1001
18+
- 1002
19+
- 1003
20+
s3:
21+
bucket: operator-testing
22+
credentialsSecret: minio-secret
23+
endpointUrl: http://minio-service:9000
24+
region: us-east-1
25+
type: s3

‎e2e-tests/tests/gr-security-context/06-assert.yaml

Lines changed: 18 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,24 @@
11
apiVersion: kuttl.dev/v1beta1
22
kind: TestAssert
3-
timeout: 500
3+
timeout: 30
44
---
5-
apiVersion: ps.percona.com/v1alpha1
6-
kind: PerconaServerMySQL
5+
kind: ConfigMap
6+
apiVersion: v1
77
metadata:
8-
name: gr-security-context
9-
status:
10-
haproxy:
11-
ready: 3
12-
size: 3
13-
state: ready
14-
mysql:
15-
ready: 3
16-
size: 3
17-
state: ready
18-
state: ready
8+
name: 04-delete-data-minio-0
9+
data:
10+
data: ""
1911
---
20-
kind: PerconaServerMySQLRestore
21-
apiVersion: ps.percona.com/v1alpha1
12+
kind: ConfigMap
13+
apiVersion: v1
2214
metadata:
23-
name: gr-security-context-restore-minio
24-
status:
25-
state: Succeeded
15+
name: 04-delete-data-minio-1
16+
data:
17+
data: ""
18+
---
19+
kind: ConfigMap
20+
apiVersion: v1
21+
metadata:
22+
name: 04-delete-data-minio-2
23+
data:
24+
data: ""

‎e2e-tests/tests/gr-security-context/05-delete-data.yaml renamed to ‎e2e-tests/tests/gr-security-context/06-delete-data.yaml

File renamed without changes.

‎e2e-tests/tests/gr-security-context/07-assert.yaml

Lines changed: 86 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,90 @@
11
apiVersion: kuttl.dev/v1beta1
22
kind: TestAssert
3-
timeout: 30
3+
timeout: 500
44
---
5-
kind: ConfigMap
6-
apiVersion: v1
5+
apiVersion: batch/v1
6+
kind: Job
77
metadata:
8-
name: 06-read-data-minio-0
9-
data:
10-
data: "100500"
11-
---
12-
kind: ConfigMap
13-
apiVersion: v1
14-
metadata:
15-
name: 06-read-data-minio-1
16-
data:
17-
data: "100500"
18-
---
19-
kind: ConfigMap
20-
apiVersion: v1
21-
metadata:
22-
name: 06-read-data-minio-2
23-
data:
24-
data: "100500"
8+
annotations:
9+
batch.kubernetes.io/job-tracking: ""
10+
generation: 1
11+
labels:
12+
app.kubernetes.io/component: xtrabackup
13+
app.kubernetes.io/instance: gr-security-context
14+
app.kubernetes.io/managed-by: percona-server-operator
15+
app.kubernetes.io/name: percona-server
16+
app.kubernetes.io/part-of: percona-server
17+
name: xb-restore-gr-security-context-restore-minio
18+
spec:
19+
backoffLimit: 4
20+
completionMode: NonIndexed
21+
completions: 1
22+
parallelism: 1
23+
suspend: false
24+
template:
25+
spec:
26+
containers:
27+
- command:
28+
- /opt/percona/run-restore.sh
29+
image: perconalab/percona-server-mysql-operator:main-backup
30+
imagePullPolicy: Always
31+
name: xtrabackup
32+
resources: {}
33+
securityContext:
34+
privileged: true
35+
terminationMessagePath: /dev/termination-log
36+
terminationMessagePolicy: File
37+
volumeMounts:
38+
- mountPath: /opt/percona
39+
name: bin
40+
- mountPath: /var/lib/mysql
41+
name: datadir
42+
- mountPath: /etc/mysql/mysql-tls-secret
43+
name: tls
44+
dnsPolicy: ClusterFirst
45+
initContainers:
46+
- command:
47+
- /opt/percona-server-mysql-operator/ps-init-entrypoint.sh
48+
imagePullPolicy: Always
49+
name: xtrabackup-init
50+
resources: {}
51+
securityContext:
52+
privileged: true
53+
terminationMessagePath: /dev/termination-log
54+
terminationMessagePolicy: File
55+
volumeMounts:
56+
- mountPath: /opt/percona
57+
name: bin
58+
- mountPath: /var/lib/mysql
59+
name: datadir
60+
- mountPath: /etc/mysql/mysql-users-secret
61+
name: users
62+
- mountPath: /etc/mysql/mysql-tls-secret
63+
name: tls
64+
restartPolicy: Never
65+
schedulerName: default-scheduler
66+
securityContext:
67+
fsGroup: 1001
68+
supplementalGroups:
69+
- 1001
70+
- 1002
71+
- 1003
72+
terminationGracePeriodSeconds: 30
73+
volumes:
74+
- emptyDir: {}
75+
name: bin
76+
- name: datadir
77+
persistentVolumeClaim:
78+
claimName: datadir-gr-security-context-mysql-0
79+
- name: users
80+
secret:
81+
defaultMode: 420
82+
secretName: test-secrets
83+
- name: tls
84+
secret:
85+
defaultMode: 420
86+
secretName: test-ssl
87+
status:
88+
active: 1
89+
ready: 0
90+
uncountedTerminatedPods: {}

‎e2e-tests/tests/gr-security-context/06-restore-from-minio.yaml renamed to ‎e2e-tests/tests/gr-security-context/07-restore-from-minio.yaml

File renamed without changes.

‎e2e-tests/tests/gr-security-context/08-assert.yaml

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
apiVersion: kuttl.dev/v1beta1
2+
kind: TestAssert
3+
timeout: 500
4+
---
5+
apiVersion: ps.percona.com/v1alpha1
6+
kind: PerconaServerMySQL
7+
metadata:
8+
name: gr-security-context
9+
status:
10+
haproxy:
11+
ready: 3
12+
size: 3
13+
state: ready
14+
mysql:
15+
ready: 3
16+
size: 3
17+
state: ready
18+
state: ready
19+
---
20+
kind: PerconaServerMySQLRestore
21+
apiVersion: ps.percona.com/v1alpha1
22+
metadata:
23+
name: gr-security-context-restore-minio
24+
status:
25+
state: Succeeded

‎e2e-tests/tests/gr-security-context/09-assert.yaml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
apiVersion: kuttl.dev/v1beta1
2+
kind: TestAssert
3+
timeout: 30
4+
---
5+
kind: ConfigMap
6+
apiVersion: v1
7+
metadata:
8+
name: 06-read-data-minio-0
9+
data:
10+
data: "100500"
11+
---
12+
kind: ConfigMap
13+
apiVersion: v1
14+
metadata:
15+
name: 06-read-data-minio-1
16+
data:
17+
data: "100500"
18+
---
19+
kind: ConfigMap
20+
apiVersion: v1
21+
metadata:
22+
name: 06-read-data-minio-2
23+
data:
24+
data: "100500"

‎e2e-tests/tests/gr-security-context/07-read-data.yaml renamed to ‎e2e-tests/tests/gr-security-context/09-read-data.yaml

File renamed without changes.

‎pkg/xtrabackup/xtrabackup.go

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -104,7 +104,7 @@ func Job(
104104
componentName,
105105
initImage,
106106
cluster.Spec.Backup.ImagePullPolicy,
107-
cluster.Spec.Backup.ContainerSecurityContext,
107+
storage.ContainerSecurityContext,
108108
),
109109
},
110110
Containers: []corev1.Container{
@@ -322,7 +322,7 @@ func RestoreJob(
322322
{
323323
Name: componentName + "-init",
324324
Image: initImage,
325-
ImagePullPolicy: cluster.Spec.MySQL.ImagePullPolicy,
325+
ImagePullPolicy: cluster.Spec.Backup.ImagePullPolicy,
326326
VolumeMounts: []corev1.VolumeMount{
327327
{
328328
Name: apiv1alpha1.BinVolumeName,
@@ -344,7 +344,7 @@ func RestoreJob(
344344
Command: []string{"/opt/percona-server-mysql-operator/ps-init-entrypoint.sh"},
345345
TerminationMessagePath: "/dev/termination-log",
346346
TerminationMessagePolicy: corev1.TerminationMessageReadFile,
347-
SecurityContext: cluster.Spec.MySQL.ContainerSecurityContext,
347+
SecurityContext: storage.ContainerSecurityContext,
348348
},
349349
},
350350
Containers: []corev1.Container{
@@ -358,6 +358,7 @@ func RestoreJob(
358358
PriorityClassName: storage.PriorityClassName,
359359
RuntimeClassName: storage.RuntimeClassName,
360360
DNSPolicy: corev1.DNSClusterFirst,
361+
SecurityContext: storage.PodSecurityContext,
361362
Volumes: []corev1.Volume{
362363
{
363364
Name: apiv1alpha1.BinVolumeName,

0 commit comments

Comments
 (0)