From eae5657116318041dcf41b7bf85e6e84fc832dc1 Mon Sep 17 00:00:00 2001 From: Stavros kois Date: Sat, 28 Jan 2023 22:23:53 +0200 Subject: [PATCH] more --- .../resources_test.yaml | 546 ++++++++++++------ .../securityContext_test.yaml | 229 ++++++-- .../various_options_test.yaml | 59 +- .../tests/deployment/dns-network_test.yaml | 3 + library/common-test/tests/pvc/pvc_test.yaml | 2 +- .../templates/lib/container/_resources.tpl | 2 +- .../templates/lib/container/_security.tpl | 4 +- .../common/1.0.0/templates/lib/pod/_dns.tpl | 8 +- .../templates/lib/pod/_mainContainer.tpl | 2 +- library/common/1.0.0/values.yaml | 85 ++- 10 files changed, 623 insertions(+), 317 deletions(-) diff --git a/library/common-test/tests/container_in_deployment/resources_test.yaml b/library/common-test/tests/container_in_deployment/resources_test.yaml index 5261b53f6f..9d8b3a0cbf 100644 --- a/library/common-test/tests/container_in_deployment/resources_test.yaml +++ b/library/common-test/tests/container_in_deployment/resources_test.yaml @@ -22,8 +22,13 @@ tests: - it: should fail with inherit defined in main container documentIndex: *deploymentDoc set: - resources: - inherit: + controllers: + main: + pod: + containers: + main: + resources: + inherit: asserts: - failedTemplate: errorMessage: key is only available for additional/init/install/upgrade containers. @@ -33,13 +38,18 @@ tests: set: scaleGPU: somekey: - resources: - limits: - cpu: 3000m - memory: 4Gi - requests: - cpu: 20m - memory: 100Mi + controllers: + main: + pod: + containers: + main: + resources: + limits: + cpu: 3000m + memory: 4Gi + requests: + cpu: 20m + memory: 100Mi asserts: - failedTemplate: errorMessage: Value is not provided for GPU ( somekey) @@ -47,13 +57,18 @@ tests: - it: should fail with empty requests.cpu documentIndex: *deploymentDoc set: - resources: - limits: - cpu: 3000m - memory: 4Gi - requests: - cpu: - memory: 100Mi + controllers: + main: + pod: + containers: + main: + resources: + limits: + cpu: 3000m + memory: 4Gi + requests: + cpu: + memory: 100Mi asserts: - failedTemplate: errorMessage: cannot be empty. @@ -61,13 +76,18 @@ tests: - it: should fail with empty requests.memory documentIndex: *deploymentDoc set: - resources: - limits: - cpu: 3000m - memory: 4Gi - requests: - cpu: 20m - memory: + controllers: + main: + pod: + containers: + main: + resources: + limits: + cpu: 3000m + memory: 4Gi + requests: + cpu: 20m + memory: asserts: - failedTemplate: errorMessage: cannot be empty. @@ -77,13 +97,18 @@ tests: set: scaleGPU: somekey: - resources: - limits: - cpu: 3000m - memory: 4Gi - requests: - cpu: 20m - memory: 0.0 + controllers: + main: + pod: + containers: + main: + resources: + limits: + cpu: 3000m + memory: 4Gi + requests: + cpu: 20m + memory: 0.0 asserts: - failedTemplate: errorMessage: has invalid format in value (0). Valid formats are (Suffixed with EPTGMK eg. 1G) (Suffixed with EPTGMK + i eg. 1Gi) (Plain integer (in bytes) eg. 1024) (Exponent eg. 134e6). @@ -93,13 +118,18 @@ tests: set: scaleGPU: somekey: - resources: - limits: - cpu: 3000m - memory: 4Gi - requests: - cpu: 20m - memory: 0e0 + controllers: + main: + pod: + containers: + main: + resources: + limits: + cpu: 3000m + memory: 4Gi + requests: + cpu: 20m + memory: 0e0 asserts: - failedTemplate: errorMessage: has invalid format in value (0). Valid formats are (Suffixed with EPTGMK eg. 1G) (Suffixed with EPTGMK + i eg. 1Gi) (Plain integer (in bytes) eg. 1024) (Exponent eg. 134e6). @@ -109,13 +139,18 @@ tests: set: scaleGPU: somekey: - resources: - limits: - cpu: 3000m - memory: 4Gi - requests: - cpu: 20m - memory: 0M + controllers: + main: + pod: + containers: + main: + resources: + limits: + cpu: 3000m + memory: 4Gi + requests: + cpu: 20m + memory: 0M asserts: - failedTemplate: errorMessage: has invalid format in value (0M). Valid formats are (Suffixed with EPTGMK eg. 1G) (Suffixed with EPTGMK + i eg. 1Gi) (Plain integer (in bytes) eg. 1024) (Exponent eg. 134e6). @@ -125,13 +160,18 @@ tests: set: scaleGPU: somekey: - resources: - limits: - cpu: 3000m - memory: 4Gi - requests: - cpu: 20m - memory: not-valid + controllers: + main: + pod: + containers: + main: + resources: + limits: + cpu: 3000m + memory: 4Gi + requests: + cpu: 20m + memory: not-valid asserts: - failedTemplate: errorMessage: has invalid format in value (not-valid). Valid formats are (Suffixed with EPTGMK eg. 1G) (Suffixed with EPTGMK + i eg. 1Gi) (Plain integer (in bytes) eg. 1024) (Exponent eg. 134e6). @@ -139,13 +179,18 @@ tests: - it: should fail with invalid format in limits.memory (zero) documentIndex: *deploymentDoc set: - resources: - limits: - cpu: 3000m - memory: 0.0 - requests: - cpu: 20m - memory: 100Mi + controllers: + main: + pod: + containers: + main: + resources: + limits: + cpu: 3000m + memory: 0.0 + requests: + cpu: 20m + memory: 100Mi asserts: - failedTemplate: errorMessage: has invalid format in value (0). Valid formats are (Suffixed with EPTGMK eg. 1G) (Suffixed with EPTGMK + i eg. 1Gi) (Plain integer (in bytes) eg. 1024) (Exponent eg. 134e6). @@ -153,13 +198,18 @@ tests: - it: should fail with invalid format in limits.memory (zero exponent) documentIndex: *deploymentDoc set: - resources: - limits: - cpu: 3000m - memory: 0e0 - requests: - cpu: 20m - memory: 100Mi + controllers: + main: + pod: + containers: + main: + resources: + limits: + cpu: 3000m + memory: 0e0 + requests: + cpu: 20m + memory: 100Mi asserts: - failedTemplate: errorMessage: has invalid format in value (0). Valid formats are (Suffixed with EPTGMK eg. 1G) (Suffixed with EPTGMK + i eg. 1Gi) (Plain integer (in bytes) eg. 1024) (Exponent eg. 134e6). @@ -167,13 +217,18 @@ tests: - it: should fail with invalid format in requests.limits (zero with suffix) documentIndex: *deploymentDoc set: - resources: - limits: - cpu: 3000m - memory: 0M - requests: - cpu: 20m - memory: 100Mi + controllers: + main: + pod: + containers: + main: + resources: + limits: + cpu: 3000m + memory: 0M + requests: + cpu: 20m + memory: 100Mi asserts: - failedTemplate: errorMessage: has invalid format in value (0M). Valid formats are (Suffixed with EPTGMK eg. 1G) (Suffixed with EPTGMK + i eg. 1Gi) (Plain integer (in bytes) eg. 1024) (Exponent eg. 134e6). @@ -181,13 +236,18 @@ tests: - it: should fail with invalid format in limits.memory (string) documentIndex: *deploymentDoc set: - resources: - limits: - cpu: 3000m - memory: not-valid - requests: - cpu: 20m - memory: 100Mi + controllers: + main: + pod: + containers: + main: + resources: + limits: + cpu: 3000m + memory: not-valid + requests: + cpu: 20m + memory: 100Mi asserts: - failedTemplate: errorMessage: has invalid format in value (not-valid). Valid formats are (Suffixed with EPTGMK eg. 1G) (Suffixed with EPTGMK + i eg. 1Gi) (Plain integer (in bytes) eg. 1024) (Exponent eg. 134e6). @@ -195,13 +255,18 @@ tests: - it: should fail with invalid format in limits.cpu (zero) documentIndex: *deploymentDoc set: - resources: - limits: - cpu: 0.0 - memory: 4Gi - requests: - cpu: 20m - memory: 100Mi + controllers: + main: + pod: + containers: + main: + resources: + limits: + cpu: 0.0 + memory: 4Gi + requests: + cpu: 20m + memory: 100Mi asserts: - failedTemplate: errorMessage: has invalid format in value (0). Valid formats are (Plain Integer eg. 1) (Float eg. 0.5) (Milicpu 500m). @@ -209,13 +274,18 @@ tests: - it: should fail with invalid format in limits.cpu (zero with suffix) documentIndex: *deploymentDoc set: - resources: - limits: - cpu: 0m - memory: 4Gi - requests: - cpu: 20m - memory: 100Mi + controllers: + main: + pod: + containers: + main: + resources: + limits: + cpu: 0m + memory: 4Gi + requests: + cpu: 20m + memory: 100Mi asserts: - failedTemplate: errorMessage: has invalid format in value (0m). Valid formats are (Plain Integer eg. 1) (Float eg. 0.5) (Milicpu 500m). @@ -223,13 +293,18 @@ tests: - it: should fail with invalid format in limits.cpu (string) documentIndex: *deploymentDoc set: - resources: - limits: - cpu: not-valid - memory: 4Gi - requests: - cpu: 20m - memory: 100Mi + controllers: + main: + pod: + containers: + main: + resources: + limits: + cpu: not-valid + memory: 4Gi + requests: + cpu: 20m + memory: 100Mi asserts: - failedTemplate: errorMessage: has invalid format in value (not-valid). Valid formats are (Plain Integer eg. 1) (Float eg. 0.5) (Milicpu 500m). @@ -237,13 +312,18 @@ tests: - it: should fail with invalid format in requests.cpu (zero) documentIndex: *deploymentDoc set: - resources: - limits: - cpu: 4000m - memory: 4Gi - requests: - cpu: 0.0 - memory: 100Mi + controllers: + main: + pod: + containers: + main: + resources: + limits: + cpu: 4000m + memory: 4Gi + requests: + cpu: 0.0 + memory: 100Mi asserts: - failedTemplate: errorMessage: has invalid format in value (0). Valid formats are (Plain Integer eg. 1) (Float eg. 0.5) (Milicpu 500m). @@ -251,13 +331,18 @@ tests: - it: should fail with invalid format in requests.cpu (zero with suffix) documentIndex: *deploymentDoc set: - resources: - limits: - cpu: 4000m - memory: 4Gi - requests: - cpu: 0m - memory: 100Mi + controllers: + main: + pod: + containers: + main: + resources: + limits: + cpu: 4000m + memory: 4Gi + requests: + cpu: 0m + memory: 100Mi asserts: - failedTemplate: errorMessage: has invalid format in value (0m). Valid formats are (Plain Integer eg. 1) (Float eg. 0.5) (Milicpu 500m). @@ -265,13 +350,18 @@ tests: - it: should fail with invalid format in requests.cpu (string) documentIndex: *deploymentDoc set: - resources: - limits: - cpu: 4000m - memory: 4Gi - requests: - cpu: not-valid - memory: 100Mi + controllers: + main: + pod: + containers: + main: + resources: + limits: + cpu: 4000m + memory: 4Gi + requests: + cpu: not-valid + memory: 100Mi asserts: - failedTemplate: errorMessage: has invalid format in value (not-valid). Valid formats are (Plain Integer eg. 1) (Float eg. 0.5) (Milicpu 500m). @@ -279,13 +369,18 @@ tests: - it: should pass with changed resources documentIndex: *deploymentDoc set: - resources: - limits: - cpu: 3000m - memory: 4Gi - requests: - cpu: 20m - memory: 100Mi + controllers: + main: + pod: + containers: + main: + resources: + limits: + cpu: 3000m + memory: 4Gi + requests: + cpu: 20m + memory: 100Mi asserts: - equal: path: spec.template.spec.containers[0].resources @@ -300,9 +395,14 @@ tests: - it: should pass with only limits.cpu resource changed documentIndex: *deploymentDoc set: - resources: - limits: - cpu: 3000m + controllers: + main: + pod: + containers: + main: + resources: + limits: + cpu: 3000m asserts: - equal: path: spec.template.spec.containers[0].resources @@ -317,9 +417,14 @@ tests: - it: should pass with only limits.memory resource changed documentIndex: *deploymentDoc set: - resources: - limits: - memory: 4Gi + controllers: + main: + pod: + containers: + main: + resources: + limits: + memory: 4Gi asserts: - equal: path: spec.template.spec.containers[0].resources @@ -334,9 +439,14 @@ tests: - it: should pass with only requests.cpu resource changed documentIndex: *deploymentDoc set: - resources: - requests: - cpu: 20m + controllers: + main: + pod: + containers: + main: + resources: + requests: + cpu: 20m asserts: - equal: path: spec.template.spec.containers[0].resources @@ -351,9 +461,14 @@ tests: - it: should pass with only requests.memory resource changed documentIndex: *deploymentDoc set: - resources: - requests: - memory: 25Mi + controllers: + main: + pod: + containers: + main: + resources: + requests: + memory: 25Mi asserts: - equal: path: spec.template.spec.containers[0].resources @@ -387,13 +502,18 @@ tests: set: scaleGPU: gpu.intel.com/i915: "1" - resources: - limits: - cpu: 3000m - memory: 4Gi - requests: - cpu: 20m - memory: 100Mi + controllers: + main: + pod: + containers: + main: + resources: + limits: + cpu: 3000m + memory: 4Gi + requests: + cpu: 20m + memory: 100Mi asserts: - equal: path: spec.template.spec.containers[0].resources @@ -409,10 +529,15 @@ tests: - it: should pass with empty resources.limits documentIndex: *deploymentDoc set: - resources: - limits: - cpu: - memory: + controllers: + main: + pod: + containers: + main: + resources: + limits: + cpu: + memory: asserts: - equal: path: spec.template.spec.containers[0].resources @@ -425,10 +550,15 @@ tests: documentIndex: *deploymentDoc set: scaleGPU: {} - resources: - limits: - cpu: 3000m - memory: + controllers: + main: + pod: + containers: + main: + resources: + limits: + cpu: 3000m + memory: asserts: - equal: path: spec.template.spec.containers[0].resources @@ -443,10 +573,15 @@ tests: documentIndex: *deploymentDoc set: scaleGPU: {} - resources: - limits: - cpu: - memory: 4Gi + controllers: + main: + pod: + containers: + main: + resources: + limits: + cpu: + memory: 4Gi asserts: - equal: path: spec.template.spec.containers[0].resources @@ -461,12 +596,17 @@ tests: documentIndex: *deploymentDoc set: scaleGPU: {} - resources: - limits: - cpu: - memory: - requests: - cpu: 30m + controllers: + main: + pod: + containers: + main: + resources: + limits: + cpu: + memory: + requests: + cpu: 30m asserts: - equal: path: spec.template.spec.containers[0].resources @@ -479,12 +619,17 @@ tests: documentIndex: *deploymentDoc set: scaleGPU: {} - resources: - limits: - cpu: - memory: - requests: - memory: 15Mi + controllers: + main: + pod: + containers: + main: + resources: + limits: + cpu: + memory: + requests: + memory: 15Mi asserts: - equal: path: spec.template.spec.containers[0].resources @@ -498,10 +643,15 @@ tests: set: scaleGPU: gpu.intel.com/i915: "1" - resources: - limits: - cpu: - memory: + controllers: + main: + pod: + containers: + main: + resources: + limits: + cpu: + memory: asserts: - equal: path: spec.template.spec.containers[0].resources @@ -516,13 +666,18 @@ tests: documentIndex: *deploymentDoc set: scaleGPU: {} - resources: - limits: - cpu: - memory: - requests: - cpu: 10m - memory: 50Mi + controllers: + main: + pod: + containers: + main: + resources: + limits: + cpu: + memory: + requests: + cpu: 10m + memory: 50Mi asserts: - equal: path: spec.template.spec.containers[0].resources @@ -535,10 +690,15 @@ tests: documentIndex: *deploymentDoc set: scaleGPU: {} - resources: - limits: - cpu: 1000m - memory: 1Gi + controllers: + main: + pod: + containers: + main: + resources: + limits: + cpu: 1000m + memory: 1Gi asserts: - equal: path: spec.template.spec.containers[0].resources @@ -550,16 +710,20 @@ tests: cpu: 10m memory: 50Mi - - it: should pass with only gpu defined documentIndex: *deploymentDoc set: scaleGPU: gpu.intel.com/i915: "1" - resources: - limits: - cpu: - memory: + controllers: + main: + pod: + containers: + main: + resources: + limits: + cpu: + memory: asserts: - equal: path: spec.template.spec.containers[0].resources diff --git a/library/common-test/tests/container_in_deployment/securityContext_test.yaml b/library/common-test/tests/container_in_deployment/securityContext_test.yaml index 27bb7e7966..20ae3482ec 100644 --- a/library/common-test/tests/container_in_deployment/securityContext_test.yaml +++ b/library/common-test/tests/container_in_deployment/securityContext_test.yaml @@ -26,18 +26,23 @@ tests: - it: should pass with securityContext changed documentIndex: *deploymentDoc set: - securityContext: - runAsNonRoot: false - runAsUser: 0 - runAsGroup: 0 - readOnlyRootFilesystem: false - allowPrivilegeEscalation: true - privileged: true - capabilities: - add: - - SYS_MODULE - drop: - - NET_ADMIN + controllers: + main: + pod: + containers: + main: + securityContext: + runAsNonRoot: false + runAsUser: 0 + runAsGroup: 0 + readOnlyRootFilesystem: false + allowPrivilegeEscalation: true + privileged: true + capabilities: + add: + - SYS_MODULE + drop: + - NET_ADMIN asserts: - equal: path: spec.template.spec.containers[0].securityContext @@ -60,12 +65,17 @@ tests: source: addCap: SYS_MODULE remCap: NET_ADMIN - securityContext: - capabilities: - add: - - "{{ .Values.source.addCap }}" - drop: - - "{{ .Values.source.remCap }}" + controllers: + main: + pod: + containers: + main: + securityContext: + capabilities: + add: + - "{{ .Values.source.addCap }}" + drop: + - "{{ .Values.source.remCap }}" asserts: - equal: path: spec.template.spec.containers[0].securityContext @@ -84,158 +94,253 @@ tests: - it: should fail with inherit key added in securityContext on main container set: - securityContext: - inherit: true + controllers: + main: + pod: + containers: + main: + securityContext: + inherit: true asserts: - failedTemplate: errorMessage: key is only available for additional/init/install/upgrade containers. - it: should fail with securityContext changed, runAsNonRoot true and runAsUser 0 set: - securityContext: - runAsNonRoot: true - runAsUser: 0 + controllers: + main: + pod: + containers: + main: + securityContext: + runAsNonRoot: true + runAsUser: 0 asserts: - failedTemplate: errorMessage: You are trying to run as root (user or group), but runAsNonRoot is set to true - it: should fail with securityContext changed, runAsNonRoot true and runAsGroup 0 set: - securityContext: - runAsNonRoot: true - runAsUser: 0 + controllers: + main: + pod: + containers: + main: + securityContext: + runAsNonRoot: true + runAsUser: 0 asserts: - failedTemplate: errorMessage: You are trying to run as root (user or group), but runAsNonRoot is set to true - it: should fail with securityContext changed and runAsNonRoot set to a non-bool value set: - securityContext: - runAsNonRoot: non-bool + controllers: + main: + pod: + containers: + main: + securityContext: + runAsNonRoot: non-bool asserts: - failedTemplate: errorMessage: key has value (non-bool). But it must be boolean. - it: should fail with securityContext changed and privileged set to a non-bool value set: - securityContext: - privileged: non-bool + controllers: + main: + pod: + containers: + main: + securityContext: + privileged: non-bool asserts: - failedTemplate: errorMessage: key has value (non-bool). But it must be boolean. - it: should fail with securityContext changed and readOnlyRootFilesystem set to a non-bool value set: - securityContext: - readOnlyRootFilesystem: non-bool + controllers: + main: + pod: + containers: + main: + securityContext: + readOnlyRootFilesystem: non-bool asserts: - failedTemplate: errorMessage: key has value (non-bool). But it must be boolean. - it: should fail with securityContext changed and allowPrivilegeEscalation set to a non-bool value set: - securityContext: - allowPrivilegeEscalation: non-bool + controllers: + main: + pod: + containers: + main: + securityContext: + allowPrivilegeEscalation: non-bool asserts: - failedTemplate: errorMessage: key has value (non-bool). But it must be boolean. - it: should fail with securityContext changed and capabilities.add is not a list set: - securityContext: - capabilities: - add: non-a-list + controllers: + main: + pod: + containers: + main: + securityContext: + capabilities: + add: non-a-list asserts: - failedTemplate: errorMessage: key has value (non-a-list). But it must be a list. Set a list value or remove the key for the default ([]) to take effect. - it: should fail with securityContext changed and capabilities.drop is not a list set: - securityContext: - capabilities: - drop: non-a-list + controllers: + main: + pod: + containers: + main: + securityContext: + capabilities: + drop: non-a-list asserts: - failedTemplate: errorMessage: key has value (non-a-list). But it must be a list. Set a list value or remove the key for the default ([ALL]) to take effect. - it: should fail with empty capabilities.drop in securityContext set: - securityContext: - capabilities: - drop: + controllers: + main: + pod: + containers: + main: + securityContext: + capabilities: + drop: asserts: - failedTemplate: errorMessage: key has value (). But it must be a list. Set a list value or remove the key for the default ([ALL]) to take effect. - it: should fail with empty capabilities.add in securityContext set: - securityContext: - capabilities: - add: + controllers: + main: + pod: + containers: + main: + securityContext: + capabilities: + add: asserts: - failedTemplate: errorMessage: key has value (). But it must be a list. Set a list value or remove the key for the default ([]) to take effect. - it: should fail with empty runAsGroup in securityContext set: - securityContext: - runAsGroup: + controllers: + main: + pod: + containers: + main: + securityContext: + runAsGroup: asserts: - failedTemplate: errorMessage: key cannot be empty. Set a value or remove the key for the default (568) to take effect. - it: should fail with non int runAsGroup in securityContext set: - securityContext: - runAsGroup: "1000" + controllers: + main: + pod: + containers: + main: + securityContext: + runAsGroup: "1000" asserts: - failedTemplate: errorMessage: key has value of ("1000"). But must be an int. - it: should fail with non int runAsUser in securityContext set: - securityContext: - runAsUser: "1000" + controllers: + main: + pod: + containers: + main: + securityContext: + runAsUser: "1000" asserts: - failedTemplate: errorMessage: key has value of ("1000"). But must be an int. - it: should fail with empty runAsUser in securityContext set: - securityContext: - runAsUser: + controllers: + main: + pod: + containers: + main: + securityContext: + runAsUser: asserts: - failedTemplate: errorMessage: key cannot be empty. Set a value or remove the key for the default (568) to take effect. - it: should fail with empty privileged in securityContext set: - securityContext: - privileged: + controllers: + main: + pod: + containers: + main: + securityContext: + privileged: asserts: - failedTemplate: errorMessage: key has value (). But it must be boolean. - it: should fail with empty allowPrivilegeEscalation in securityContext set: - securityContext: - allowPrivilegeEscalation: + controllers: + main: + pod: + containers: + main: + securityContext: + allowPrivilegeEscalation: asserts: - failedTemplate: errorMessage: key has value (). But it must be boolean. - it: should fail with empty readOnlyRootFilesystem in securityContext set: - securityContext: - readOnlyRootFilesystem: + controllers: + main: + pod: + containers: + main: + securityContext: + readOnlyRootFilesystem: asserts: - failedTemplate: errorMessage: key has value (). But it must be boolean. - it: should fail with empty runAsNonRoot in securityContext set: - securityContext: - runAsNonRoot: + controllers: + main: + pod: + containers: + main: + securityContext: + runAsNonRoot: asserts: - failedTemplate: errorMessage: key has value (). But it must be boolean. diff --git a/library/common-test/tests/container_in_deployment/various_options_test.yaml b/library/common-test/tests/container_in_deployment/various_options_test.yaml index e5e1aa5be8..31af5696fe 100644 --- a/library/common-test/tests/container_in_deployment/various_options_test.yaml +++ b/library/common-test/tests/container_in_deployment/various_options_test.yaml @@ -14,7 +14,12 @@ tests: - it: should pass with tty set documentIndex: *deploymentDoc set: - tty: true + controllers: + main: + pod: + containers: + main: + tty: true asserts: - equal: path: spec.template.spec.containers[0].tty @@ -23,7 +28,12 @@ tests: - it: should pass with stdin set documentIndex: *deploymentDoc set: - stdin: true + controllers: + main: + pod: + containers: + main: + stdin: true asserts: - equal: path: spec.template.spec.containers[0].stdin @@ -32,8 +42,13 @@ tests: - it: should pass with terminationMessagePath set documentIndex: *deploymentDoc set: - termination: - messagePath: /tmp/log + controllers: + main: + pod: + containers: + main: + termination: + messagePath: /tmp/log asserts: - equal: path: spec.template.spec.containers[0].terminationMessagePath @@ -43,8 +58,13 @@ tests: documentIndex: *deploymentDoc set: some_path: /tmp/log - termination: - messagePath: "{{ .Values.some_path }}" + controllers: + main: + pod: + containers: + main: + termination: + messagePath: "{{ .Values.some_path }}" asserts: - equal: path: spec.template.spec.containers[0].terminationMessagePath @@ -53,8 +73,13 @@ tests: - it: should pass with terminationMessagePolicy set documentIndex: *deploymentDoc set: - termination: - messagePolicy: FallbackToLogsOnError + controllers: + main: + pod: + containers: + main: + termination: + messagePolicy: FallbackToLogsOnError asserts: - equal: path: spec.template.spec.containers[0].terminationMessagePolicy @@ -64,8 +89,13 @@ tests: documentIndex: *deploymentDoc set: some_key: FallbackToLogsOnError - termination: - messagePolicy: "{{ .Values.some_key }}" + controllers: + main: + pod: + containers: + main: + termination: + messagePolicy: "{{ .Values.some_key }}" asserts: - equal: path: spec.template.spec.containers[0].terminationMessagePolicy @@ -74,8 +104,13 @@ tests: - it: should fail with invalid terminationMessagePolicy set: some_key: invalid - termination: - messagePolicy: "{{ .Values.some_key }}" + controllers: + main: + pod: + containers: + main: + termination: + messagePolicy: "{{ .Values.some_key }}" asserts: - failedTemplate: errorMessage: Not valid option for messagePolicy (invalid). Valid options are FallbackToLogsOnError and File diff --git a/library/common-test/tests/deployment/dns-network_test.yaml b/library/common-test/tests/deployment/dns-network_test.yaml index f7dc1b349d..64251346b4 100644 --- a/library/common-test/tests/deployment/dns-network_test.yaml +++ b/library/common-test/tests/deployment/dns-network_test.yaml @@ -319,3 +319,6 @@ tests: hostnames: - hostname3 - hostname4 + +# TODO: default dns on root level and on pod +# TODO: default dns on root level and not on pod diff --git a/library/common-test/tests/pvc/pvc_test.yaml b/library/common-test/tests/pvc/pvc_test.yaml index c88be64690..51f0e3bbd2 100644 --- a/library/common-test/tests/pvc/pvc_test.yaml +++ b/library/common-test/tests/pvc/pvc_test.yaml @@ -24,7 +24,7 @@ tests: mountPath: /somepath asserts: - failedTemplate: - errorMessage: A storageClass must be defined in global.defaults.scaleZFSStorageClass + errorMessage: A storageClass must be defined in globalDefaults.scaleZFSStorageClass - it: should fail with invalid accessMode set: diff --git a/library/common/1.0.0/templates/lib/container/_resources.tpl b/library/common/1.0.0/templates/lib/container/_resources.tpl index 0be3bb1e7e..a7879ad10c 100644 --- a/library/common/1.0.0/templates/lib/container/_resources.tpl +++ b/library/common/1.0.0/templates/lib/container/_resources.tpl @@ -10,7 +10,7 @@ {{- end -}} {{/* Get defaults from global */}} - {{- $defautlResources := $root.Values.globalDefaults.resources -}} + {{- $defautlResources := $root.Values.resources -}} {{- $newResources := (mustDeepCopy $defautlResources) -}} {{- if and $resources.inherit (not $isMainContainer) -}} {{/* if inherit is set, overwrite defaults with values from mainContainer */}} diff --git a/library/common/1.0.0/templates/lib/container/_security.tpl b/library/common/1.0.0/templates/lib/container/_security.tpl index 1f36525f25..0d89ee1352 100644 --- a/library/common/1.0.0/templates/lib/container/_security.tpl +++ b/library/common/1.0.0/templates/lib/container/_security.tpl @@ -14,7 +14,7 @@ The reason is not splitted, is that on one of the places needs a combo of all va {{- $isMainContainer := .isMainContainer -}} {{/* Initialiaze Values */}} - {{- $defaultSecCont := $root.Values.globalDefaults.securityContext -}} + {{- $defaultSecCont := $root.Values.securityContext -}} {{- $returnValue := (mustDeepCopy $defaultSecCont) -}} {{- if and (hasKey $secCont "inherit") $isMainContainer -}} @@ -112,7 +112,7 @@ The reason is not splitted, is that on one of the places needs a combo of all va {{- $podSecCont := .podSecCont -}} {{/* Initialiaze Values */}} - {{- $defaultPodSecCont := $root.Values.globalDefaults.podSecurityContext -}} + {{- $defaultPodSecCont := $root.Values.podSecurityContext -}} {{- $returnValue := (mustDeepCopy $defaultPodSecCont) -}} {{/* Overwrite from values that user/dev passed */}} diff --git a/library/common/1.0.0/templates/lib/pod/_dns.tpl b/library/common/1.0.0/templates/lib/pod/_dns.tpl index 4fd3c2c45c..9fac5be993 100644 --- a/library/common/1.0.0/templates/lib/pod/_dns.tpl +++ b/library/common/1.0.0/templates/lib/pod/_dns.tpl @@ -4,7 +4,7 @@ {{- $hostNetwork := .hostNetwork -}} {{- $root := .root -}} - {{- $policy := $root.Values.globalDefaults.dnsPolicy -}} + {{- $policy := $root.Values.dnsPolicy -}} {{- if $dnsPolicy -}} {{- if not (mustHas $dnsPolicy (list "Default" "ClusterFirst" "ClusterFirstWithHostNet" "None")) -}} {{- fail (printf "Not valid dnsPolicy (%s). Valid options are ClusterFirst, Default, ClusterFirstWithHostNet, None" $dnsPolicy) -}} @@ -23,6 +23,12 @@ {{- $dnsConfig := .dnsConfig -}} {{- $root := .root -}} + {{- $config := $root.Values.dnsConfig -}} + + {{- if not $dnsConfig -}} + {{- $dnsConfig = $config -}} + {{- end -}} + {{- if and (eq $dnsPolicy "None") (not $dnsConfig.nameservers) -}} {{- fail "With dnsPolicy set to None, you must specify at least 1 nameservers on dnsConfig" -}} {{- end -}} diff --git a/library/common/1.0.0/templates/lib/pod/_mainContainer.tpl b/library/common/1.0.0/templates/lib/pod/_mainContainer.tpl index ea0ef7cf98..5817b38ade 100644 --- a/library/common/1.0.0/templates/lib/pod/_mainContainer.tpl +++ b/library/common/1.0.0/templates/lib/pod/_mainContainer.tpl @@ -24,7 +24,7 @@ So it can work on multiple places, like additional containers and not only the m {{- end -}} {{- with (include "ix.v1.common.container.securityContext" (dict "secCont" $values.securityContext "isMainContainer" true - "deviceList" $values.deviceList + "deviceList" $root.Values.deviceList "scaleGPU" $values.scaleGPU "root" $root)) | trim }} securityContext: diff --git a/library/common/1.0.0/values.yaml b/library/common/1.0.0/values.yaml index 720c5fe8a6..aee378a90b 100644 --- a/library/common/1.0.0/values.yaml +++ b/library/common/1.0.0/values.yaml @@ -52,23 +52,6 @@ globalDefaults: # Default security context used for all # init/install/upgrade/additional # and main containers if not specified - securityContext: - runAsNonRoot: true - runAsUser: 568 - runAsGroup: 568 - readOnlyRootFilesystem: true - allowPrivilegeEscalation: false - privileged: false - capabilities: - add: [] - drop: - - ALL - # Default podSecurityContext, used if - # no other is specified - podSecurityContext: - fsGroup: 568 - supplementalGroups: [] - fsGroupChangePolicy: OnRootMismatch # Whether to inject fixedEnvs on containers # Can be overruled per container injectFixedEnvs: true @@ -78,13 +61,7 @@ globalDefaults: - all # Default Resources values, if no others # are specified, use those - resources: - limits: - cpu: 4000m - memory: 8Gi - requests: - cpu: 10m - memory: 50Mi + # If no probe Type is defined, assume this probeType: auto # If no probe Path is defined, assume this @@ -118,8 +95,6 @@ globalDefaults: successfulJobsHistoryLimit: 3 backoffLimit: 6 completionMode: NonIndexed - # If not defined on the pod, assume this - dnsPolicy: ClusterFirst # Defines image info image: @@ -230,26 +205,44 @@ controllers: enabled: true startup: enabled: true - # Default securityContext for main container - securityContext: - runAsNonRoot: true - runAsUser: 568 - runAsGroup: 568 - readOnlyRootFilesystem: true - allowPrivilegeEscalation: false - privileged: false - capabilities: - add: [] - drop: - - ALL - # Default resources for main container - resources: - limits: - cpu: 4000m - memory: 8Gi - requests: - cpu: 10m - memory: 50Mi + +# Default DNS Policy that applies to all pods +# Can be overruled per pod +dnsPolicy: ClusterFirst + +# Default DNS Config that applies to all pods +# Can be overruled per pod +dnsConfig: {} + +# Security Context that applies to all containers +# Can be overruled per container +securityContext: + runAsNonRoot: true + runAsUser: 568 + runAsGroup: 568 + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + privileged: false + capabilities: + add: [] + drop: + - ALL +# Default podSecurityContext that applies to all pods +# Can be overruled per pod +podSecurityContext: + fsGroup: 568 + supplementalGroups: [] + fsGroupChangePolicy: OnRootMismatch + +# Resources that apply to all containers +# Can be overruled per container +resources: + limits: + cpu: 4000m + memory: 8Gi + requests: + cpu: 10m + memory: 50Mi # Values that will be exposed to UI # Defines the timezone for the container