OpenShit Teting Commit

Author: danc094codetogether

charts/collab/templates/deployment.yaml

@@ -29,6 +29,101 @@ spec:
         - name: {{ include "codetogether.fullname" . }}-pull-secret
       {{- end }}
       serviceAccountName: {{ include "codetogether.serviceAccountName" . }}
+      {{- if .Values.openshift.enabled }}
+      # OpenShift
+      {{- else if .Values.podSecurityContext }}
+      # Vanilla Kubernetes use what is set in podSecurityContext
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      {{- end }}
+      {{- if .Values.securityContext.readOnlyRootFilesystem }}
+      initContainers:
+        - name: prepare-volatile
+          image: busybox:1.36
+          command: ["/bin/sh", "-c"]
+          args:
+            {{- if .Values.openshift.enabled }}
+            - |
+              set -eu
+              for d in \
+                /run/volatile/clients \
+                /run/volatile/codetogether-config \
+                /run/volatile/codetogether-forever \
+                /run/volatile/codetogether-npm \
+                /run/volatile/codetogether-pm2 \
+                /run/volatile/codetogether-theia \
+                /run/volatile/jicofo-etc \
+                /run/volatile/jvb-etc \
+                /run/volatile/log-codetogether \
+                /run/volatile/log-jitsi \
+                /run/volatile/log-prosody \
+                /run/volatile/meet-web \
+                /run/volatile/nginx \
+                /run/volatile/pki-catrust \
+                /run/volatile/prosody \
+                /run/volatile/prosody-certs \
+                /run/volatile/prosody-conf \
+                /run/volatile/var-cache/dnf \
+                /run/volatile/var-cache/ldconfig \
+                /run/volatile/var-cache/libX11 \
+                /run/volatile/var-cache/nginx \
+                /run/volatile/var-cache/private \
+                /run/volatile/var-cache/yum
+              do
+                install -d -m 0775 "$d"
+              done
+            {{- else }}
+            - |
+              set -eu
+              for d in \
+                /run/volatile/clients \
+                /run/volatile/codetogether-config \
+                /run/volatile/codetogether-forever \
+                /run/volatile/codetogether-npm \
+                /run/volatile/codetogether-pm2 \
+                /run/volatile/codetogether-theia \
+                /run/volatile/jicofo-etc \
+                /run/volatile/jvb-etc \
+                /run/volatile/log-codetogether \
+                /run/volatile/log-jitsi \
+                /run/volatile/log-prosody \
+                /run/volatile/meet-web \
+                /run/volatile/nginx \
+                /run/volatile/pki-catrust \
+                /run/volatile/prosody \
+                /run/volatile/prosody-certs \
+                /run/volatile/prosody-conf \
+                /run/volatile/var-cache/dnf \
+                /run/volatile/var-cache/ldconfig \
+                /run/volatile/var-cache/libX11 \
+                /run/volatile/var-cache/nginx \
+                /run/volatile/var-cache/private \
+                /run/volatile/var-cache/yum
+              do
+                install -d -m 0775 "$d"
+              done
+              chown -R {{ default 1000 .Values.securityContext.runAsUser }}:{{ default 1000 .Values.securityContext.runAsGroup | default 1000 }} \
+                /run /var/log/nginx /var/cache/nginx
+            {{- end }}
+          securityContext:
+            {{- if .Values.openshift.enabled }}
+            runAsNonRoot: true
+            allowPrivilegeEscalation: false
+            {{- else }}
+            runAsUser: 0
+            runAsGroup: 0
+            runAsNonRoot: false
+            allowPrivilegeEscalation: false
+            {{- end }}
+          volumeMounts:
+            - name: codetogether-runtime
+              mountPath: /run
+            - name: codetogether-runtime
+              mountPath: /var/log/nginx
+            - name: codetogether-runtime
+              mountPath: /var/cache/nginx
+      {{- end }}
+
       containers:
         - name: {{ .Chart.Name }}
           securityContext:
@@ -248,6 +343,7 @@ spec:
 
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
+  
       {{- if .Values.securityContext.readOnlyRootFilesystem}}
       volumes:
         - name: codetogether-runtime

charts/collab/values.yaml

@@ -211,13 +211,24 @@ serviceAccount:
 
 podAnnotations: {}
 
+# Enable if deploying in OpenShift
+openshift:
+  enabled: false
+
 securityContext: {} #defaults
   # capabilities:
   #   drop:
   #   - ALL
   # readOnlyRootFilesystem: true # enable for read-only setup
   # runAsNonRoot: true
-  # runAsUser: 0 # Use '0' for root user for read-only setup
+  # runAsUser: 1000 # Use '0' for root user, in vanilla k8s you can use any non-root uid
+  # runAsGroup: 1000
+  # In openshift, dont set runAsUser or runAsGroup, let OpenShift assign the values
+
+podSecurityContext: {}
+# In OpenShift will inject automatically
+  #fsGroup: 1000
+  #fsGroupChangePolicy: "OnRootMismatch"
 
 readinessProbe:
   initialDelaySeconds: 60