description: The port grafana-k8s will be listening on
type: int
default: 3000
+ security_context:
+ description: Enables the security context of the pods
+ type: boolean
+ default: false
ingress_whitelist_source_range: Optional[str]
tls_secret_name: Optional[str]
image_pull_policy: str
+ security_context: bool
@validator("log_level")
def validate_log_level(cls, v):
self.grafana_cluster.set_initial_password(admin_initial_password)
# Create Builder for the PodSpec
- pod_spec_builder = PodSpecV3Builder()
+ pod_spec_builder = PodSpecV3Builder(
+ enable_security_context=config.security_context
+ )
# Add secrets to the pod
grafana_secret_name = f"{self.app.name}-admin-secret"
# Build Container
container_builder = ContainerV3Builder(
- self.app.name, image_info, config.image_pull_policy
+ self.app.name,
+ image_info,
+ config.image_pull_policy,
+ run_as_non_root=config.security_context,
)
container_builder.add_port(name=self.app.name, port=config.port)
container_builder.add_http_readiness_probe(
ImagePullPolicy configuration for the pod.
Possible values: always, ifnotpresent, never
default: always
+ security_context:
+ description: Enables the security context of the pods
+ type: boolean
+ default: false
ingress_whitelist_source_range: Optional[str]
tls_secret_name: Optional[str]
image_pull_policy: str
+ security_context: bool
@validator("site_url")
def validate_site_url(cls, v):
self._check_missing_dependencies(config)
# Create Builder for the PodSpec
- pod_spec_builder = PodSpecV3Builder()
+ pod_spec_builder = PodSpecV3Builder(
+ enable_security_context=config.security_context
+ )
# Build container
container_builder = ContainerV3Builder(
- self.app.name, image_info, config.image_pull_policy
+ self.app.name,
+ image_info,
+ config.image_pull_policy,
+ run_as_non_root=config.security_context,
)
container_builder.add_port(name=self.app.name, port=PORT)
container_builder.add_http_readiness_probe(
description: Kafka number of partitions per topic
type: int
default: 1
+ security_context:
+ description: Enables the security context of the pods
+ type: boolean
+ default: false
class ConfigModel(ModelValidator):
num_partitions: int
image_pull_policy: str
+ security_context: bool
@validator("image_pull_policy")
def validate_image_pull_policy(cls, v):
self._check_missing_dependencies()
# Create Builder for the PodSpec
- pod_spec_builder = PodSpecV3Builder()
+ pod_spec_builder = PodSpecV3Builder(
+ enable_security_context=config.security_context
+ )
# Build Container
container_builder = ContainerV3Builder(
- self.app.name, image_info, config.image_pull_policy
+ self.app.name,
+ image_info,
+ config.image_pull_policy,
+ run_as_non_root=config.security_context,
)
container_builder.add_port(name="kafka", port=KAFKA_PORT)
self.assertIsInstance(self.harness.charm.unit.status, ActiveStatus)
@patch("charm.KafkaCharm.num_units", new_callable=PropertyMock)
- def test_with_relations_kafka(
- self, mock_num_units
- ) -> NoReturn:
+ def test_with_relations_kafka(self, mock_num_units) -> NoReturn:
"Test with relations (kafka)"
mock_num_units.return_value = 1
ImagePullPolicy configuration for the pod.
Possible values: always, ifnotpresent, never
default: always
+ security_context:
+ description: Enables the security context of the pods
+ type: boolean
+ default: false
region_id:
type: string
description: Region ID to be created when starting the service
mysql_port: Optional[int]
mysql_root_password: Optional[str]
image_pull_policy: str
+ security_context: bool
@validator("max_file_size")
def validate_max_file_size(cls, v):
self._check_missing_dependencies(config, external_db)
# Create Builder for the PodSpec
- pod_spec_builder = PodSpecV3Builder()
+ pod_spec_builder = PodSpecV3Builder(
+ enable_security_context=config.security_context
+ )
container_builder = ContainerV3Builder(
- self.app.name, image_info, config.image_pull_policy
+ self.app.name,
+ image_info,
+ config.image_pull_policy,
+ run_as_non_root=config.security_context,
)
# Build files
description: |
If true, debug mode is activated. It means that the service will not run,
and instead, the command for the container will be a `sleep infinity`.
+ Note: If enabled, security_context will be disabled.
type: boolean
default: false
debug_pubkey:
description: |
Public SSH key that will be injected to the application pod.
type: string
+ security_context:
+ description: Enables the security context of the pods
+ type: boolean
+ default: false
vca_stablerepourl: Optional[str]
vca_helm_ca_certs: Optional[str]
image_pull_policy: str
+ debug_mode: bool
+ security_context: bool
@validator("log_level")
def validate_log_level(cls, v):
# Check relations
self._check_missing_dependencies(config)
+ security_context_enabled = (
+ config.security_context if not config.debug_mode else False
+ )
+
# Create Builder for the PodSpec
- pod_spec_builder = PodSpecV3Builder()
+ pod_spec_builder = PodSpecV3Builder(
+ enable_security_context=security_context_enabled
+ )
# Add secrets to the pod
lcm_secret_name = f"{self.app.name}-lcm-secret"
# Build Container
container_builder = ContainerV3Builder(
- self.app.name, image_info, config.image_pull_policy
+ self.app.name,
+ image_info,
+ config.image_pull_policy,
+ run_as_non_root=security_context_enabled,
)
container_builder.add_port(name=self.app.name, port=PORT)
container_builder.add_envs(
description: |
If true, debug mode is activated. It means that the service will not run,
and instead, the command for the container will be a `sleep infinity`.
+ Note: If enabled, security_context will be disabled.
type: boolean
default: false
debug_pubkey:
description: |
Public SSH key that will be injected to the application pod.
type: string
+ security_context:
+ description: Enables the security context of the pods
+ type: boolean
+ default: false
grafana_password: str
certificates: Optional[str]
image_pull_policy: str
+ debug_mode: bool
+ security_context: bool
@validator("log_level")
def validate_log_level(cls, v):
# Check relations
self._check_missing_dependencies(config)
+ security_context_enabled = (
+ config.security_context if not config.debug_mode else False
+ )
+
# Create Builder for the PodSpec
- pod_spec_builder = PodSpecV3Builder()
+ pod_spec_builder = PodSpecV3Builder(
+ enable_security_context=security_context_enabled
+ )
# Add secrets to the pod
mongodb_secret_name = f"{self.app.name}-mongodb-secret"
# Build Container
container_builder = ContainerV3Builder(
- self.app.name, image_info, config.image_pull_policy
+ self.app.name,
+ image_info,
+ config.image_pull_policy,
+ run_as_non_root=security_context_enabled,
)
certs_files = self._build_cert_files(config)
ImagePullPolicy configuration for the pod.
Possible values: always, ifnotpresent, never
default: always
+ security_context:
+ description: Enables the security context of the pods
+ type: boolean
+ default: false
tls_secret_name: Optional[str]
mongodb_uri: Optional[str]
image_pull_policy: str
+ security_context: bool
@validator("site_url")
def validate_site_url(cls, v):
mongodb_uri += f"?{parsed.query}"
# Create Builder for the PodSpec
- pod_spec_builder = PodSpecV3Builder()
+ pod_spec_builder = PodSpecV3Builder(
+ enable_security_context=config.security_context
+ )
# Add secrets to the pod
mongodb_secret_name = f"{self.app.name}-mongodb-secret"
# Build container
container_builder = ContainerV3Builder(
- self.app.name, image_info, config.image_pull_policy
+ self.app.name,
+ image_info,
+ config.image_pull_policy,
+ run_as_non_root=config.security_context,
)
container_builder.add_port(name=self.app.name, port=PORT)
container_builder.add_http_readiness_probe(
ImagePullPolicy configuration for the pod.
Possible values: always, ifnotpresent, never
default: always
+ security_context:
+ description: Enables the security context of the pods
+ type: boolean
+ default: false
tls_secret_name: Optional[str]
mysql_uri: Optional[str]
image_pull_policy: str
+ security_context: bool
@validator("site_url")
def validate_site_url(cls, v):
)
# Create Builder for the PodSpec
- pod_spec_builder = PodSpecV3Builder()
+ pod_spec_builder = PodSpecV3Builder(
+ enable_security_context=config.security_context
+ )
# Add secrets to the pod
mysql_secret_name = f"{self.app.name}-mysql-secret"
# Build container
container_builder = ContainerV3Builder(
- self.app.name, image_info, config.image_pull_policy
+ self.app.name,
+ image_info,
+ config.image_pull_policy,
+ run_as_non_root=config.security_context,
)
container_builder.add_port(name=self.app.name, port=PORT)
container_builder.add_http_readiness_probe(
description: |
If true, debug mode is activated. It means that the service will not run,
and instead, the command for the container will be a `sleep infinity`.
+ Note: If enabled, security_context will be disabled.
type: boolean
default: false
debug_pubkey:
description: |
Public SSH key that will be injected to the application pod.
type: string
+ security_context:
+ description: Enables the security context of the pods
+ type: boolean
+ default: false
tls_secret_name: Optional[str]
mongodb_uri: Optional[str]
image_pull_policy: str
+ debug_mode: bool
+ security_context: bool
@validator("auth_backend")
def validate_auth_backend(cls, v):
# Check relations
self._check_missing_dependencies(config)
+ security_context_enabled = (
+ config.security_context if not config.debug_mode else False
+ )
+
# Create Builder for the PodSpec
- pod_spec_builder = PodSpecV3Builder()
+ pod_spec_builder = PodSpecV3Builder(
+ enable_security_context=security_context_enabled
+ )
# Add secrets to the pod
mongodb_secret_name = f"{self.app.name}-mongodb-secret"
# Build Container
container_builder = ContainerV3Builder(
- self.app.name, image_info, config.image_pull_policy
+ self.app.name,
+ image_info,
+ config.image_pull_policy,
+ run_as_non_root=security_context_enabled,
)
container_builder.add_port(name=self.app.name, port=PORT)
container_builder.add_tcpsocket_readiness_probe(
ImagePullPolicy configuration for the pod.
Possible values: always, ifnotpresent, never
default: always
+ security_context:
+ description: Enables the security context of the pods
+ type: boolean
+ default: false
ingress_whitelist_source_range: Optional[str]
tls_secret_name: Optional[str]
image_pull_policy: str
+ security_context: bool
@validator("port")
def validate_port(cls, v):
# Check relations
self._check_missing_dependencies(config)
# Create Builder for the PodSpec
- pod_spec_builder = PodSpecV3Builder()
+ pod_spec_builder = PodSpecV3Builder(
+ enable_security_context=config.security_context
+ )
# Build Container
container_builder = ContainerV3Builder(
- self.app.name, image_info, config.image_pull_policy
+ self.app.name,
+ image_info,
+ config.image_pull_policy,
+ run_as_non_root=config.security_context,
)
container_builder.add_port(name=self.app.name, port=config.port)
container = container_builder.build()
ImagePullPolicy configuration for the pod.
Possible values: always, ifnotpresent, never
default: always
+ security_context:
+ description: Enables the security context of the pods
+ type: boolean
+ default: false
mongodb_uri: Optional[str]
log_level: str
image_pull_policy: str
+ security_context: bool
@validator("log_level")
def validate_log_level(cls, v):
self._check_missing_dependencies(config)
# Create Builder for the PodSpec
- pod_spec_builder = PodSpecV3Builder()
+ pod_spec_builder = PodSpecV3Builder(
+ enable_security_context=config.security_context
+ )
# Add secrets to the pod
mongodb_secret_name = f"{self.app.name}-mongodb-secret"
# Build Container
container_builder = ContainerV3Builder(
- self.app.name, image_info, config.image_pull_policy
+ self.app.name,
+ image_info,
+ config.image_pull_policy,
+ run_as_non_root=config.security_context,
)
container_builder.add_port(name=self.app.name, port=PORT)
container_builder.add_envs(
description: |
If true, debug mode is activated. It means that the service will not run,
and instead, the command for the container will be a `sleep infinity`.
+ Note: If enabled, security_context will be disabled.
type: boolean
default: false
debug_pubkey:
description: |
Public SSH key that will be injected to the application pod.
type: string
+ security_context:
+ description: Enables the security context of the pods
+ type: boolean
+ default: false
mongodb_uri: Optional[str]
mysql_uri: Optional[str]
image_pull_policy: str
+ debug_mode: bool
+ security_context: bool
@validator("log_level")
def validate_log_level(cls, v):
# Check relations
self._check_missing_dependencies(config)
+ security_context_enabled = (
+ config.security_context if not config.debug_mode else False
+ )
+
# Create Builder for the PodSpec
- pod_spec_builder = PodSpecV3Builder()
+ pod_spec_builder = PodSpecV3Builder(
+ enable_security_context=security_context_enabled
+ )
# Add secrets to the pod
mongodb_secret_name = f"{self.app.name}-mongodb-secret"
# Build Container
container_builder = ContainerV3Builder(
- self.app.name, image_info, config.image_pull_policy
+ self.app.name,
+ image_info,
+ config.image_pull_policy,
+ run_as_non_root=security_context_enabled,
)
container_builder.add_port(name=self.app.name, port=PORT)
container_builder.add_envs(
ImagePullPolicy configuration for the pod.
Possible values: always, ifnotpresent, never
default: always
+ security_context:
+ description: Enables the security context of the pods
+ type: boolean
+ default: false
tls_secret_name: Optional[str]
enable_web_admin_api: bool
image_pull_policy: str
+ security_context: bool
@validator("web_subpath")
def validate_web_subpath(cls, v):
# Validate config
config = ConfigModel(**dict(self.config))
# Create Builder for the PodSpec
- pod_spec_builder = PodSpecV3Builder()
+ pod_spec_builder = PodSpecV3Builder(
+ enable_security_context=config.security_context
+ )
# Build Backup Container
backup_image = OCIImageResource(self, "backup-image")
# Build Container
container_builder = ContainerV3Builder(
- self.app.name, image_info, config.image_pull_policy
+ self.app.name,
+ image_info,
+ config.image_pull_policy,
+ run_as_non_root=config.security_context,
)
container_builder.add_port(name=self.app.name, port=PORT)
container_builder.add_http_readiness_probe(
description: |
If true, debug mode is activated. It means that the service will not run,
and instead, the command for the container will be a `sleep infinity`.
+ Note: If enabled, security_context will be disabled.
type: boolean
default: false
debug_pubkey:
description: |
Public SSH key that will be injected to the application pod.
type: string
+ security_context:
+ description: Enables the security context of the pods
+ type: boolean
+ default: false
openmano_tenant: str
certificates: Optional[str]
image_pull_policy: str
+ debug_mode: bool
+ security_context: bool
@validator("log_level")
def validate_log_level(cls, v):
# Check relations
self._check_missing_dependencies(config)
+ security_context_enabled = (
+ config.security_context if not config.debug_mode else False
+ )
+
# Create Builder for the PodSpec
- pod_spec_builder = PodSpecV3Builder()
+ pod_spec_builder = PodSpecV3Builder(
+ enable_security_context=security_context_enabled
+ )
# Build Container
container_builder = ContainerV3Builder(
- self.app.name, image_info, config.image_pull_policy
+ self.app.name,
+ image_info,
+ config.image_pull_policy,
+ run_as_non_root=security_context_enabled,
)
certs_files = self._build_cert_files(config)
For example, the minimum session timeout will be two ticks.
type: int
default: 2000
+ security_context:
+ description: Enables the security context of the pods
+ type: boolean
+ default: false
sync_limit: int
init_limit: int
tick_time: int
+ security_context: bool
@validator("log_level")
def validate_log_level(cls, v):
Args:
event (EventBase): Zookeeper Cluster relation event.
"""
- self._publish_zookeeper_info(event)
+ self._publish_info(event)
self.configure_pod()
def _publish_info(self, event: EventBase):
config = ConfigModel(**dict(self.config))
# Create Builder for the PodSpec
- pod_spec_builder = PodSpecV3Builder()
+ pod_spec_builder = PodSpecV3Builder(
+ enable_security_context=config.security_context
+ )
# Build Container
container_builder = ContainerV3Builder(
- self.app.name, image_info, config.image_pull_policy
+ self.app.name,
+ image_info,
+ config.image_pull_policy,
+ run_as_non_root=config.security_context,
)
container_builder.add_port(name="client", port=CLIENT_PORT)
projects / osm / devops.git / commitdiff