[COMMON] Synchronize the charts

Correct the security settings and improve templates.

Issue-ID: OOM-3288

Change-Id: Idf1d59b33bea4d27a523d990b218b2e36ffb0348
Signed-off-by: Andreas Geissler <andreas-geissler@telekom.de>

diff --git a/kubernetes/common/cassandra/values.yaml b/kubernetes/common/cassandra/values.yaml
index 842c268..e69d305 100644 (file)
--- a/kubernetes/common/cassandra/values.yaml
+++ b/kubernetes/common/cassandra/values.yaml
@@ -29,7 +29,7 @@ global: # global defaults
     enableServiceAccount: false
 
 k8ssandraOperator:
-  cassandraVersion: 4.1.3
+  cassandraVersion: 4.1.6
   persistence:
     #storageClassName: default
     size: 10Gi

diff --git a/kubernetes/common/common/Chart.yaml b/kubernetes/common/common/Chart.yaml
index 6fa2926..591f24f 100644 (file)
--- a/kubernetes/common/common/Chart.yaml
+++ b/kubernetes/common/common/Chart.yaml
@@ -17,4 +17,4 @@
 apiVersion: v2
 description: Common templates for inclusion in other charts
 name: common
-version: 13.2.6
+version: 13.2.10

diff --git a/kubernetes/common/common/templates/_ingress.tpl b/kubernetes/common/common/templates/_ingress.tpl
index ca23c75..4d762c7 100644 (file)
--- a/kubernetes/common/common/templates/_ingress.tpl
+++ b/kubernetes/common/common/templates/_ingress.tpl
@@ -744,11 +744,7 @@ metadata:
   name: {{ include "common.fullname" $dot }}-ingress
   annotations:
     {{ include "ingress.config.annotations" $dot }}
-  labels:
-    app: {{ $dot.Chart.Name }}
-    chart: {{ $dot.Chart.Name }}-{{ $dot.Chart.Version | replace "+" "_" }}
-    release: {{ include "common.release" $dot }}
-    heritage: {{ $dot.Release.Service }}
+  labels: {{- include "common.labels" $dot | nindent 4 }}
 spec:
   rules:
   {{ include "ingress.config.port" $dot | trim }}

diff --git a/kubernetes/common/common/templates/_labels.tpl b/kubernetes/common/common/templates/_labels.tpl
index a690acd..df5cab9 100644 (file)
--- a/kubernetes/common/common/templates/_labels.tpl
+++ b/kubernetes/common/common/templates/_labels.tpl
@@ -22,11 +22,13 @@ Common labels
 The function takes several arguments (inside a dictionary):
      - .dot : environment (.)
      - .labels : labels to add (dict)
+     - .suffix : name suffix
 */}}
 {{- define "common.labels" -}}
 {{- $dot := default . .dot -}}
-app.kubernetes.io/name: {{ include "common.name" $dot }}
-app: {{ include "common.name" $dot }}
+{{- $suffix := .suffix -}}
+app.kubernetes.io/name: {{ include "common.name" (dict "dot" $dot "suffix" $suffix) }}
+app: {{ include "common.name" (dict "dot" $dot "suffix" $suffix) }}
 {{- if $dot.Chart.AppVersion }}
 version: "{{ $dot.Chart.AppVersion | replace "+" "_" }}"
 {{- else }}

diff --git a/kubernetes/common/common/templates/_pod.tpl b/kubernetes/common/common/templates/_pod.tpl
index 743e3db..6feb91b 100644 (file)
--- a/kubernetes/common/common/templates/_pod.tpl
+++ b/kubernetes/common/common/templates/_pod.tpl
@@ -98,12 +98,12 @@ securityContext:
   privileged: {{ hasKey .Values.containerSecurityContext "privileged" | ternary .Values.containerSecurityContext.privileged false }}
   allowPrivilegeEscalation: {{ hasKey .Values.containerSecurityContext "allowPrivilegeEscalation" | ternary .Values.containerSecurityContext.allowPrivilegeEscalation false }}
   runAsNonRoot: {{ hasKey .Values.containerSecurityContext "runAsNonRoot" | ternary .Values.containerSecurityContext.runAsNonRoot true }}
-{{-   if .Values.containerSecurityContext.runAsUser }}
+{{-   if hasKey .Values.containerSecurityContext "runAsUser" }}
   runAsUser: {{ .Values.containerSecurityContext.runAsUser }}
 {{-   end }}
-{{-   if .Values.containerSecurityContext.runAsGroup }}
+{{-   if hasKey .Values.containerSecurityContext "runAsGroup" }}
   runAsGroup: {{ .Values.containerSecurityContext.runAsGroup }}
-{{    end }}
+{{-    end }}
 {{- end }}
   capabilities:
     drop:

diff --git a/kubernetes/common/common/templates/_secret.tpl b/kubernetes/common/common/templates/_secret.tpl
index 9d284de..9eb47d7 100644 (file)
--- a/kubernetes/common/common/templates/_secret.tpl
+++ b/kubernetes/common/common/templates/_secret.tpl
@@ -19,7 +19,7 @@
 
   Generates a secret header with given name and desired labels.
 
-  The template takes two arguments:
+  The template takes three arguments:
     - .global: environment (.)
     - .name: name of the secret
     - .annotations: annotations which should be used
@@ -29,17 +29,14 @@
 */}}
 {{- define "common.secret._header" -}}
 {{- $global := .global }}
+
 {{- $name := .name }}
 apiVersion: v1
 kind: Secret
 metadata:
   name: {{ $name }}
   namespace: {{ include "common.namespace" $global }}
-  labels:
-    app: {{ include "common.name" $global }}
-    chart: {{ $global.Chart.Name }}-{{ $global.Chart.Version | replace "+" "_" }}
-    release: {{ include "common.release" $global }}
-    heritage: {{ $global.Release.Service }}
+  labels: {{- include "common.labels" $global | nindent 4 }}
 {{- if .annotations }}
   annotations: {{- include "common.tplValue" (dict "value" .annotations "context" $global) | nindent 4 }}
 {{- end }}

diff --git a/kubernetes/common/common/templates/_serviceMonitor.tpl b/kubernetes/common/common/templates/_serviceMonitor.tpl
index 907d9c6..5b80c18 100644 (file)
--- a/kubernetes/common/common/templates/_serviceMonitor.tpl
+++ b/kubernetes/common/common/templates/_serviceMonitor.tpl
@@ -52,11 +52,7 @@
       ## ServiceMonitor selector labels
       ## ref: https://github.com/bitnami/charts/tree/master/bitnami/prometheus-operator#prometheus-configuration
       ##
-      selector:
-        app: '{{ include "common.name" . }}'
-        chart: '{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}'
-        release: '{{ include "common.release" . }}'
-        heritage: '{{ .Release.Service }}'
+      selector: {{- include "common.matchLabels" . | nindent 4 }}
 
       ## RelabelConfigs to apply to samples before scraping
       ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#relabelconfig

diff --git a/kubernetes/common/common/templates/_strimzikafka.tpl b/kubernetes/common/common/templates/_strimzikafka.tpl
index a2e9c90..a48b444 100644 (file)
--- a/kubernetes/common/common/templates/_strimzikafka.tpl
+++ b/kubernetes/common/common/templates/_strimzikafka.tpl
@@ -56,6 +56,7 @@ kind: KafkaUser
 metadata:
   name: {{ include "common.name" . }}-ku
   labels:
+    {{- include "common.labels" . | nindent 4 }}
     strimzi.io/cluster: {{ include "common.release" . }}-strimzi
 spec:
   authentication:
@@ -118,6 +119,7 @@ metadata:
   name: {{ ($topic.name) | lower }}-kt
   {{- end }}
   labels:
+    {{- include "common.labels" $ | nindent 4 }}
     strimzi.io/cluster: {{ include "common.release" $ }}-strimzi
 spec:
   {{- if (hasKey $topic "partitions") }}

diff --git a/kubernetes/common/mariadb-galera/Chart.yaml b/kubernetes/common/mariadb-galera/Chart.yaml
index 41d11a6..552f6cc 100644 (file)
--- a/kubernetes/common/mariadb-galera/Chart.yaml
+++ b/kubernetes/common/mariadb-galera/Chart.yaml
@@ -18,7 +18,7 @@
 apiVersion: v2
 description: Chart for MariaDB Galera cluster
 name: mariadb-galera
-version: 13.2.2
+version: 13.2.3
 keywords:
   - mariadb
   - mysql

diff --git a/kubernetes/common/mariadb-galera/templates/statefulset.yaml b/kubernetes/common/mariadb-galera/templates/statefulset.yaml
index 66ce8ab..3011d93 100644 (file)
--- a/kubernetes/common/mariadb-galera/templates/statefulset.yaml
+++ b/kubernetes/common/mariadb-galera/templates/statefulset.yaml
@@ -39,50 +39,24 @@ spec:
       initContainers:
         # we shouldn't need this but for unknown reason, it's fsGroup is not
         # applied
-        - name: fix-permission
+      {{- if .Values.mariadbConfiguration }}
+        - name: copy-config
           command:
             - /bin/sh
           args:
             - -c
             - |
-              chown -R {{ .Values.securityContext.user_id }}:{{ .Values.securityContext.group_id }} /data
-              chown -R {{ .Values.securityContext.user_id }}:{{ .Values.securityContext.group_id }} /bootstrap/
-              chown -R {{ .Values.securityContext.user_id }}:{{ .Values.securityContext.group_id }} /tmp/
-              {{- if .Values.mariadbConfiguration }}
               cp /config/my.cnf /actual/my.cnf
-              chown -R {{ .Values.securityContext.user_id }}:{{ .Values.securityContext.group_id }} /actual
-              {{- end }}
           image: {{ include "repositoryGenerator.image.busybox" . }}
           imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-              - ALL
-              - CAP_NET_RAW
-              add:
-              - CHOWN
-              - SYS_CHROOT
-            runAsGroup: {{ .Values.securityContext.group_id }}
-            readOnlyRootFilesystem: false
-            runAsUser: 0
-            runAsNonRoot: false
-            seccompProfile:
-              type: RuntimeDefault
+          {{ include "common.containerSecurityContext" . | indent 10 | trim }}
           volumeMounts:
-            - name: previous-boot
-              mountPath: /bootstrap
-            - name: mariadb-tmp-folder
-              mountPath: /tmp
-            - name: {{ include "common.fullname" . }}
-              mountPath: /data
-            {{- if .Values.mariadbConfiguration }}
             - name: mariadb-galera-starting-config
               mountPath: /config/my.cnf
               subPath: my.cnf
             - name: mariadb-galera-actual-config
               mountPath: /actual
-            {{- end }}
+      {{- end }}
       containers:
         - name: {{ include "common.name" . }}
           image: {{ include "repositoryGenerator.dockerHubRepository" . }}/{{ .Values.image }}
@@ -185,6 +159,8 @@ spec:
           {{ include "common.containerSecurityContext" . | indent 10 | trim }}
           resources: {{ include "common.resources" . | nindent 12 }}
           volumeMounts:
+            - name: tmp
+              mountPath: /tmp
             - name: previous-boot
               mountPath: /opt/bitnami/mariadb/.bootstrap
             - name: {{ include "common.fullname" . }}
@@ -258,13 +234,19 @@ spec:
       tolerations: {{- include "common.tplValue" (dict "value" .Values.tolerations "context" .) | nindent 8 }}
       {{- end }}
       volumes:
+        - name: tmp
+          emptyDir:
+            sizeLimit: {{ .Values.volumes.tmpSizeLimit }}
         - name: previous-boot
-          emptyDir: {}
+          emptyDir:
+            sizeLimit: {{ .Values.volumes.bootSizeLimit }}
         - name: mariadb-tmp-folder
-          emptyDir: {}
+          emptyDir:
+            sizeLimit: {{ .Values.volumes.tmpMariaDBSizeLimit }}
         {{- if .Values.mariadbConfiguration  }}
         - name:  mariadb-galera-actual-config
-          emptyDir: {}
+          emptyDir:
+            sizeLimit: {{ .Values.volumes.configSizeLimit }}
         - name: mariadb-galera-starting-config
           configMap:
             name: {{ printf "%s-configuration" (include "common.fullname" .) }}

diff --git a/kubernetes/common/mariadb-galera/values.yaml b/kubernetes/common/mariadb-galera/values.yaml
index faab7af..6684d6d 100644 (file)
--- a/kubernetes/common/mariadb-galera/values.yaml
+++ b/kubernetes/common/mariadb-galera/values.yaml
@@ -609,6 +609,12 @@ resources:
       memory: "3Gi"
   unlimited: {}
 
+volumes:
+  bootSizeLimit: 50Mi
+  tmpSizeLimit: 200Mi
+  configSizeLimit: 50Mi
+  tmpMariaDBSizeLimit: 100Mi
+
 ## MariaDB Galera containers' liveness and readiness probes
 ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes
 ##
@@ -689,6 +695,7 @@ metrics:
     requests:
       cpu: "0.5"
       memory: "200Mi"
+
   ## MariaDB Galera metrics container's liveness and readiness probes
   ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes
   ##