Skip to content

Commit 86a230b

Browse files
shajia-deshawCopilothorsegegunes
authored
K8SPSMDB-1595: set container security context for pbm-init container (#2283)
* feat: set container security context for pbm-init container * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * address review comments: use the same test with additional SC assertions * add better tests --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Viacheslav Sarzhan <slava.sarzhan@percona.com> Co-authored-by: Ege Güneş <ege.gunes@percona.com>
1 parent 6a0f11d commit 86a230b

2 files changed

Lines changed: 142 additions & 91 deletions

File tree

‎pkg/controller/perconaservermongodbrestore/physical.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -409,6 +409,9 @@ func (r *ReconcilePerconaServerMongoDBRestore) updateStatefulSetForPhysicalResto
409409
cluster.Spec.ImagePullPolicy,
410410
cmd,
411411
)
412+
if cluster.CompareVersion("1.23.0") >= 0 && cluster.Spec.InitContainerSecurityContext != nil {
413+
pbmInit.SecurityContext = cluster.Spec.InitContainerSecurityContext
414+
}
412415
sts.Spec.Template.Spec.InitContainers = append(sts.Spec.Template.Spec.InitContainers, pbmInit)
413416

414417
pbmIdx := -1

‎pkg/controller/perconaservermongodbrestore/physical_test.go‎

Lines changed: 139 additions & 91 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
package perconaservermongodbrestore
22

33
import (
4-
"context"
54
"slices"
65
"testing"
76

@@ -17,107 +16,156 @@ import (
1716
)
1817

1918
func TestUpdateStatefulSetForPhysicalRestore(t *testing.T) {
20-
ctx := context.Background()
19+
nonRoot := true
20+
allowPrivEsc := false
21+
initSC := &corev1.SecurityContext{
22+
RunAsNonRoot: &nonRoot,
23+
AllowPrivilegeEscalation: &allowPrivEsc,
24+
}
2125

22-
cluster := &psmdbv1.PerconaServerMongoDB{
23-
ObjectMeta: metav1.ObjectMeta{
24-
Name: "my-cluster",
25-
Namespace: "default",
26+
tests := []struct {
27+
name string
28+
crVersion string
29+
clusterInitSC *corev1.SecurityContext
30+
wantPbmInitSC *corev1.SecurityContext
31+
}{
32+
{
33+
name: "latest_version_with_InitContainerSecurityContext",
34+
crVersion: version.Version(),
35+
clusterInitSC: initSC,
36+
wantPbmInitSC: initSC,
2637
},
27-
Spec: psmdbv1.PerconaServerMongoDBSpec{
28-
CRVersion: version.Version(),
29-
Backup: psmdbv1.BackupSpec{
30-
Image: "percona/percona-backup-mongodb:latest",
31-
VolumeMounts: []corev1.VolumeMount{
32-
{
33-
Name: "extra-volume",
34-
MountPath: "/extra",
35-
},
36-
},
37-
},
38-
ImagePullPolicy: corev1.PullIfNotPresent,
39-
Secrets: &psmdbv1.SecretsSpec{
40-
Users: "users-secret",
41-
SSL: "ssl-secret",
42-
},
38+
{
39+
name: "latest_version_without_InitContainerSecurityContext",
40+
crVersion: version.Version(),
41+
clusterInitSC: nil,
42+
wantPbmInitSC: nil,
43+
},
44+
{
45+
name: "1_22_with_InitContainerSecurityContext_ignored",
46+
crVersion: "1.22.0",
47+
clusterInitSC: initSC,
48+
wantPbmInitSC: nil,
49+
},
50+
{
51+
name: "1_22_without_InitContainerSecurityContext",
52+
crVersion: "1.22.0",
53+
clusterInitSC: nil,
54+
wantPbmInitSC: nil,
4355
},
4456
}
4557

46-
sts := &appsv1.StatefulSet{
47-
ObjectMeta: metav1.ObjectMeta{
48-
Name: "my-cluster-rs0",
49-
Namespace: "default",
50-
},
51-
Spec: appsv1.StatefulSetSpec{
52-
Selector: &metav1.LabelSelector{
53-
MatchLabels: map[string]string{"app": "my-cluster"},
54-
},
55-
Template: corev1.PodTemplateSpec{
58+
for _, tt := range tests {
59+
t.Run(tt.name, func(t *testing.T) {
60+
ctx := t.Context()
61+
62+
cluster := &psmdbv1.PerconaServerMongoDB{
5663
ObjectMeta: metav1.ObjectMeta{
57-
Labels: map[string]string{"app": "my-cluster"},
64+
Name: "my-cluster",
65+
Namespace: "default",
5866
},
59-
Spec: corev1.PodSpec{
60-
Containers: []corev1.Container{
61-
{
62-
Name: "mongod",
63-
Image: "percona/percona-server-mongodb:latest",
64-
},
65-
{
66-
Name: naming.ContainerBackupAgent,
67-
Image: "percona/percona-backup-agent:latest",
67+
Spec: psmdbv1.PerconaServerMongoDBSpec{
68+
CRVersion: tt.crVersion,
69+
Backup: psmdbv1.BackupSpec{
70+
Image: "percona/percona-backup-mongodb:latest",
71+
VolumeMounts: []corev1.VolumeMount{
72+
{
73+
Name: "extra-volume",
74+
MountPath: "/extra",
75+
},
6876
},
6977
},
78+
ImagePullPolicy: corev1.PullIfNotPresent,
79+
Secrets: &psmdbv1.SecretsSpec{
80+
Users: "users-secret",
81+
SSL: "ssl-secret",
82+
},
83+
InitContainerSecurityContext: tt.clusterInitSC,
7084
},
71-
},
72-
},
73-
}
74-
75-
secretTLS := &corev1.Secret{
76-
ObjectMeta: metav1.ObjectMeta{
77-
Name: cluster.Spec.Secrets.SSL,
78-
Namespace: cluster.Namespace,
79-
},
80-
Data: map[string][]byte{
81-
"ca.crt": {},
82-
"tls.crt": {},
83-
"tls.key": {},
84-
},
85-
}
86-
87-
r := fakeReconciler(cluster, sts, secretTLS)
88-
namespacedName := types.NamespacedName{
89-
Name: sts.Name,
90-
Namespace: sts.Namespace,
91-
}
85+
}
9286

93-
err := r.updateStatefulSetForPhysicalRestore(ctx, cluster, namespacedName, 27017)
94-
assert.NoError(t, err)
95-
96-
updatedSTS := &appsv1.StatefulSet{}
97-
err = r.client.Get(ctx, namespacedName, updatedSTS)
98-
assert.NoError(t, err)
99-
100-
assert.Equal(t, "true", updatedSTS.Annotations[psmdbv1.AnnotationRestoreInProgress])
87+
sts := &appsv1.StatefulSet{
88+
ObjectMeta: metav1.ObjectMeta{
89+
Name: "my-cluster-rs0",
90+
Namespace: "default",
91+
},
92+
Spec: appsv1.StatefulSetSpec{
93+
Selector: &metav1.LabelSelector{
94+
MatchLabels: map[string]string{"app": "my-cluster"},
95+
},
96+
Template: corev1.PodTemplateSpec{
97+
ObjectMeta: metav1.ObjectMeta{
98+
Labels: map[string]string{"app": "my-cluster"},
99+
},
100+
Spec: corev1.PodSpec{
101+
Containers: []corev1.Container{
102+
{
103+
Name: "mongod",
104+
Image: "percona/percona-server-mongodb:latest",
105+
},
106+
{
107+
Name: naming.ContainerBackupAgent,
108+
Image: "percona/percona-backup-agent:latest",
109+
},
110+
},
111+
},
112+
},
113+
},
114+
}
101115

102-
for _, c := range updatedSTS.Spec.Template.Spec.Containers {
103-
assert.NotEqual(t, naming.ContainerBackupAgent, c.Name)
116+
secretTLS := &corev1.Secret{
117+
ObjectMeta: metav1.ObjectMeta{
118+
Name: cluster.Spec.Secrets.SSL,
119+
Namespace: cluster.Namespace,
120+
},
121+
Data: map[string][]byte{
122+
"ca.crt": {},
123+
"tls.crt": {},
124+
"tls.key": {},
125+
},
126+
}
127+
128+
r := fakeReconciler(cluster, sts, secretTLS)
129+
namespacedName := types.NamespacedName{
130+
Name: sts.Name,
131+
Namespace: sts.Namespace,
132+
}
133+
134+
err := r.updateStatefulSetForPhysicalRestore(ctx, cluster, namespacedName, 27017)
135+
assert.NoError(t, err)
136+
137+
updatedSTS := &appsv1.StatefulSet{}
138+
err = r.client.Get(ctx, namespacedName, updatedSTS)
139+
assert.NoError(t, err)
140+
141+
assert.Equal(t, "true", updatedSTS.Annotations[psmdbv1.AnnotationRestoreInProgress])
142+
143+
for _, c := range updatedSTS.Spec.Template.Spec.Containers {
144+
assert.NotEqual(t, naming.ContainerBackupAgent, c.Name)
145+
}
146+
147+
var pbmInit *corev1.Container
148+
for i := range updatedSTS.Spec.Template.Spec.InitContainers {
149+
if updatedSTS.Spec.Template.Spec.InitContainers[i].Name == "pbm-init" {
150+
pbmInit = &updatedSTS.Spec.Template.Spec.InitContainers[i]
151+
break
152+
}
153+
}
154+
assert.NotNil(t, pbmInit)
155+
assert.Equal(t, tt.wantPbmInitSC, pbmInit.SecurityContext)
156+
157+
assert.Equal(t, "/opt/percona/physical-restore-ps-entry.sh", updatedSTS.Spec.Template.Spec.Containers[0].Command[0])
158+
159+
assert.True(t,
160+
slices.ContainsFunc(updatedSTS.Spec.Template.Spec.Containers[0].VolumeMounts, func(c corev1.VolumeMount) bool {
161+
return c.MountPath == "/etc/pbm/"
162+
}))
163+
164+
lastEnvVar := updatedSTS.Spec.Template.Spec.Containers[0].Env[len(updatedSTS.Spec.Template.Spec.Containers[0].Env)-1]
165+
expectedURI := "mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@localhost:$(PBM_MONGODB_PORT)/?tls=true&tlsCertificateKeyFile=/tmp/tls.pem&tlsCAFile=/etc/mongodb-ssl/ca.crt&tlsInsecure=true"
166+
167+
assert.Equal(t, "PBM_MONGODB_URI", lastEnvVar.Name)
168+
assert.Equal(t, expectedURI, lastEnvVar.Value)
169+
})
104170
}
105-
106-
assert.True(t,
107-
slices.ContainsFunc(updatedSTS.Spec.Template.Spec.InitContainers, func(c corev1.Container) bool {
108-
return c.Name == "pbm-init"
109-
}))
110-
111-
assert.Equal(t, "/opt/percona/physical-restore-ps-entry.sh", updatedSTS.Spec.Template.Spec.Containers[0].Command[0])
112-
113-
assert.True(t,
114-
slices.ContainsFunc(updatedSTS.Spec.Template.Spec.Containers[0].VolumeMounts, func(c corev1.VolumeMount) bool {
115-
return c.MountPath == "/etc/pbm/"
116-
}))
117-
118-
lastEnvVar := updatedSTS.Spec.Template.Spec.Containers[0].Env[len(updatedSTS.Spec.Template.Spec.Containers[0].Env)-1]
119-
expectedURI := "mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@localhost:$(PBM_MONGODB_PORT)/?tls=true&tlsCertificateKeyFile=/tmp/tls.pem&tlsCAFile=/etc/mongodb-ssl/ca.crt&tlsInsecure=true"
120-
121-
assert.Equal(t, "PBM_MONGODB_URI", lastEnvVar.Name)
122-
assert.Equal(t, expectedURI, lastEnvVar.Value)
123171
}

0 commit comments

Comments
 (0)