From 2368513ff7fb1ff10917bbecc2638dd5a999aeff Mon Sep 17 00:00:00 2001
From: Stavros kois <s.kois@outlook.com>
Date: Fri, 11 Nov 2022 17:53:24 +0200
Subject: [PATCH] make emptyDir safer

---
 .../tests/pod/deployment_volume_test.yaml     | 109 ++++++++++++++++++
 .../templates/lib/controller/_volumes.tpl     |  33 ++++--
 2 files changed, 130 insertions(+), 12 deletions(-)

diff --git a/library/common-test/tests/pod/deployment_volume_test.yaml b/library/common-test/tests/pod/deployment_volume_test.yaml
index 7519d9708b..2154e68e2f 100644
--- a/library/common-test/tests/pod/deployment_volume_test.yaml
+++ b/library/common-test/tests/pod/deployment_volume_test.yaml
@@ -89,6 +89,17 @@ tests:
             emptyDir:
               medium: Memory
 
+  - it: should fail with added emptyDir and non Memory medium
+    set:
+      persistence:
+        volume1:
+          enabled: true
+          type: emptyDir
+          medium: not_memory
+    asserts:
+      - failedTemplate:
+          errorMessage: You can only set medium as (Memory)
+
   - it: should pass with added nfs
     set:
       persistence:
@@ -306,6 +317,32 @@ tests:
               secretName: some_object_name
               defaultMode: 644
 
+  - it: should fail with added secret and no key on items
+    set:
+      persistence:
+        some_volume:
+          type: secret
+          enabled: true
+          objectName: some_object_name
+          items:
+            - path: some_path
+    asserts:
+      - failedTemplate:
+          errorMessage: No key was given for persistence item some_volume
+
+  - it: should fail with added secret and no path on items
+    set:
+      persistence:
+        some_volume:
+          type: secret
+          enabled: true
+          objectName: some_object_name
+          items:
+            - key: some_key
+    asserts:
+      - failedTemplate:
+          errorMessage: No path was given for persistence item some_volume
+
   - it: should pass with added secret and items
     set:
       persistence:
@@ -327,6 +364,29 @@ tests:
                 - key: some_key
                   path: some_path
 
+  - it: should pass with added secret and items from tpl
+    set:
+      key: some_key
+      path: some_path
+      persistence:
+        some_volume:
+          type: secret
+          enabled: true
+          objectName: some_object_name
+          items:
+            - key: "{{ .Values.key }}"
+              path: "{{ .Values.path }}"
+    asserts:
+      - equal:
+          path: spec.template.spec.volumes[0]
+          value:
+            name: some_volume
+            secret:
+              secretName: some_object_name
+              items:
+                - key: some_key
+                  path: some_path
+
   - it: should fail with not set objectName on configMap
     set:
       persistence:
@@ -443,6 +503,55 @@ tests:
                 - key: some_key
                   path: some_path
 
+  - it: should fail with added configMap and no key on items
+    set:
+      persistence:
+        some_volume:
+          type: configMap
+          enabled: true
+          objectName: some_object_name
+          items:
+            - path: some_path
+    asserts:
+      - failedTemplate:
+          errorMessage: No key was given for persistence item some_volume
+
+  - it: should fail with added configMap and no path on items
+    set:
+      persistence:
+        some_volume:
+          type: configMap
+          enabled: true
+          objectName: some_object_name
+          items:
+            - key: some_key
+    asserts:
+      - failedTemplate:
+          errorMessage: No path was given for persistence item some_volume
+
+  - it: should pass with added configMap and items from tpl
+    set:
+      key: some_key
+      path: some_path
+      persistence:
+        some_volume:
+          type: configMap
+          enabled: true
+          objectName: some_object_name
+          items:
+            - key: "{{ .Values.key }}"
+              path: "{{ .Values.path }}"
+    asserts:
+      - equal:
+          path: spec.template.spec.volumes[0]
+          value:
+            name: some_volume
+            configMap:
+              name: some_object_name
+              items:
+                - key: some_key
+                  path: some_path
+
   - it: should pass with added PVC
     set:
       persistence:
diff --git a/library/common/1.0.0/templates/lib/controller/_volumes.tpl b/library/common/1.0.0/templates/lib/controller/_volumes.tpl
index 32fa33a07e..164690728a 100644
--- a/library/common/1.0.0/templates/lib/controller/_volumes.tpl
+++ b/library/common/1.0.0/templates/lib/controller/_volumes.tpl
@@ -16,7 +16,7 @@
         {{- if not (eq $persistence.nameOverride "-") -}}
           {{- $pvcName = (printf "%s-%s" (include "ix.v1.common.names.fullname" $) $persistence.nameOverride) -}}
         {{- end -}}
-      {{- else -}} {{/* Else refer to the PVC name */}}
+      {{- else -}} {{/* Else generate the PVC name from fullname + volume name */}}
         {{- $pvcName = (printf "%s-%s" (include "ix.v1.common.names.fullname" $) $index) -}}
       {{- end -}}
       {{- if $persistence.forceName -}}
@@ -26,31 +26,40 @@
   persistentVolumeClaim:
     claimName: {{ tpl $pvcName $ }}
   {{- else if eq ($persistence.type | lower) "emptydir" }} {{/* emptyDir */}}
-    {{- $emptyDir := dict -}}
-    {{- with $persistence.medium -}}
-        {{- $_ := set $emptyDir "medium" "Memory" -}}
+    {{- if not (or $persistence.medium $persistence.sizeLimit) }}
+  emptyDir: {}
+    {{- else }}
+  emptyDir:
+      {{- with $persistence.medium }}
+      {{- if eq ((tpl . $) | lower) "memory" }}
+    medium: Memory
+        {{- else }}
+          {{- fail "You can only set medium as (Memory)" }}
+        {{- end }}
+      {{- end }}
+      {{- with $persistence.sizeLimit }}
+    sizeLimit: {{ tpl . $ }}
+      {{- end }}
     {{- end }}
-    {{- with $persistence.sizeLimit -}}
-        {{- $_ := set $emptyDir "sizeLimit" . -}}
-    {{- end }}
-  emptyDir: {{- tpl (toYaml $emptyDir) $ | nindent 4 }}
   {{- else if or (eq ($persistence.type | lower) "configmap") (eq ($persistence.type | lower) "secret") }}
-    {{- $objectName := (required (printf "objectName not set for persistence item %s" $index) $persistence.objectName) }}
+    {{- $objectName := (required (printf "objectName not set for persistence item %s" (toString $index)) $persistence.objectName) }}
     {{- $objectName = tpl $objectName $ }}
     {{- if eq ($persistence.type | lower) "configmap" }} {{/* configMap */}}
   configMap:
     name: {{ $objectName }}
     {{- else }} {{/* secret */}}
-
   secret:
     secretName: {{ $objectName }}
     {{- end }}
     {{- with $persistence.defaultMode }}
-    defaultMode: {{ tpl . $ }}
+    defaultMode: {{ tpl (toString .) $ }}
     {{- end }}
     {{- with $persistence.items }}
     items:
-      {{- tpl (toYaml .) $ | nindent 6 }}
+      {{- range . }}
+      - key: {{ tpl (required (printf "No key was given for persistence item %s" (toString $index)) .key) $ }}
+        path: {{ tpl (required (printf "No path was given for persistence item %s" (toString $index)) .path) $ }}
+      {{- end }}
     {{- end }}
   {{- else if eq ($persistence.type | lower) "hostpath" }} {{/* hostPath */}}
   hostPath: