-
Notifications
You must be signed in to change notification settings - Fork 30
/
_autoperms.tpl
142 lines (126 loc) · 4.77 KB
/
_autoperms.tpl
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
{{/* Contains the auto-permissions job */}}
{{- define "tc.v1.common.lib.util.autoperms" -}}
{{- $permAllowedTypes := (list "hostPath" "emptyDir" "nfs" "ixVolume") -}}
{{/* If you change this path, you must change it under _volumeMounts.tpl too*/}}
{{- $basePath := "/mounts" -}}
{{/* Init an empty dict to hold data */}}
{{- $mounts := dict -}}
{{/* Go over persistence and gather needed data */}}
{{- range $name, $mount := .Values.persistence -}}
{{- if and $mount.enabled $mount.autoPermissions -}}
{{/* If autoPermissions is enabled...*/}}
{{- if or $mount.autoPermissions.chown $mount.autoPermissions.chmod -}}
{{- $type := $.Values.fallbackDefaults.persistenceType -}}
{{- if $mount.type -}}
{{- $type = $mount.type -}}
{{- end -}}
{{- if not (mustHas $type $permAllowedTypes) -}}
{{- fail (printf "Auto Permissions - Allowed persistent types for auto permissions are [%v], but got [%v] on [%v]" (join ", " $permAllowedTypes) $type $name) -}}
{{- end -}}
{{- if $mount.readOnly -}}
{{- fail (printf "Auto Permissions - You cannot change permissions/ownership automatically on [%v] with readOnly enabled" $name) -}}
{{- end -}}
{{/* Add some data regarding what actions to perform */}}
{{- $_ := set $mounts $name $mount.autoPermissions -}}
{{- end -}}
{{- end -}}
{{- end -}}
{{- if $mounts }}
enabled: true
type: Job
annotations:
"helm.sh/hook": pre-install, pre-upgrade
"helm.sh/hook-weight": "3"
"helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation,hook-failed
podSpec:
restartPolicy: Never
containers:
# If you change this name, you must change it under _volumeMounts.tpl
autopermissions:
enabled: true
primary: true
imageSelector: alpineImage
securityContext:
runAsNonRoot: false
runAsUser: 0
capabilities:
disableS6Caps: true
add:
- CHOWN
- DAC_OVERRIDE
- FOWNER
resources:
limits:
cpu: 2000m
memory: 2Gi
probes:
liveness:
type: exec
command:
- cat
- /tmp/healthy
readiness:
type: exec
command:
- cat
- /tmp/healthy
startup:
type: exec
command:
- cat
- /tmp/healthy
command:
- /bin/sh
- -c
args:
- |
echo "Starting auto permissions job..."
touch /tmp/healthy
echo "Automatically correcting ownership and permissions..."
{{- range $name, $vol := $mounts }}
{{- $mountPath := (printf "%v/%v" $basePath $name) -}}
{{- $user := "" -}}
{{- if $vol.user -}}
{{- $user = $vol.user -}}
{{- end -}}
{{- $group := $.Values.securityContext.pod.fsGroup -}}
{{- if $vol.group -}}
{{- $group = $vol.group -}}
{{- end -}}
{{- $r := "" -}}
{{- if $vol.recursive -}}
{{- $r = "-$" -}}
{{- end -}}
{{/* Permissions */}}
{{- if $vol.chmod }}
echo "Automatically correcting permissions for {{ $mountPath }}..."
before=$(stat -c "%a" {{ $mountPath }})
chmod {{ $r }} {{ $vol.chmod }} {{ $mountPath }} || echo "Failed setting permissions using chmod..."
echo "Permissions after: [$before]"
echo "Permissions after: [$(stat -c "%a" {{ $mountPath }})]"
echo ""
{{- end -}}
{{/* Ownership */}}
{{- if $vol.chown }}
echo "Automatically correcting ownership for {{ $mountPath }}..."
before=$(stat -c "%u:%g" {{ $mountPath }})
{{- if $.Values.ixChartContext }}{{/* TODO: Add user here too? */}}
/usr/sbin/nfs4xdr_winacl -a chown -G {{ $group }} {{ $r | lower }} -c "{{ $mountPath }}" -p "{{ $mountPath }}" || echo "Failed setting ownership using winacl..."
{{- else }}
chown {{ $r }} -f {{ $user }}:{{ $group }} {{ $mountPath }} || echo "Failed setting ownership using chown..."
{{- end }}
echo "Ownership before: [$before]"
echo "Ownership after: [$(stat -c "%u:%g" {{ $mountPath }})]"
echo ""
{{- end -}}
{{- end }}
echo "Finished auto permissions job..."
{{- end -}}
{{- end -}}
{{- define "tc.v1.common.lib.util.autoperms.job" -}}
{{- $job := (include "tc.v1.common.lib.util.autoperms" $) | fromYaml -}}
{{- if $job -}}
# If you change this name, you must change it under _volumes.tpl
{{- $_ := set $.Values.workload "autopermissions" $job -}}
{{- end -}}
{{- end -}}