From 6abf2fae1ae33b3f2a2cc9c24cb750f09e37f176 Mon Sep 17 00:00:00 2001 From: Kjeld Schouten-Lebbing Date: Thu, 15 Apr 2021 14:28:28 +0200 Subject: [PATCH] Fixup the permissions script and make it more efficient (#355) * Fixup the permissions script and make it more efficient * update common and common-test versions --- library/common-test/Chart.yaml | 2 +- library/common-test/ci/default-values.yaml | 104 +++++++++++------- library/common-test/values.yaml | 1 + library/common/Chart.yaml | 2 +- .../lib/storage/_mountPermissions.tpl | 49 ++------- 5 files changed, 77 insertions(+), 81 deletions(-) diff --git a/library/common-test/Chart.yaml b/library/common-test/Chart.yaml index 43cd9492289..fdfb4e5066c 100644 --- a/library/common-test/Chart.yaml +++ b/library/common-test/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v2 kubeVersion: ">=1.16.0-0" name: common-test -version: 2.1.1 +version: 2.1.2 # upstream_version: appVersion: none description: Helper chart to test different use cases of the common library diff --git a/library/common-test/ci/default-values.yaml b/library/common-test/ci/default-values.yaml index 6f6bf77ea2d..229bf3140ce 100644 --- a/library/common-test/ci/default-values.yaml +++ b/library/common-test/ci/default-values.yaml @@ -20,47 +20,75 @@ env: {} # PUID: 1001 # PGID: 1001 - -persistence: - config: - enabled: false - emptyDir: false - - torrentblackhole: - enabled: false - emptyDir: false - mountPath: /downloads - ## Persistent Volume Storage Class - ## If defined, storageClassName: - ## If set to "-", storageClassName: "", which disables dynamic provisioning - ## If undefined (the default) or set to null, no storageClassName spec is - ## set, choosing the default provisioner. (gp2 on AWS, standard on - ## GKE, AWS & OpenStack) - # storageClass: "-" - # accessMode: ReadWriteOnce - # size: 1Gi - ## Do not delete the pvc upon helm uninstall - # skipuninstall: false - # existingClaim: "" - - -## TrueCharts Values - -ingress: +services: main: enabled: true - # Used when including ingress using {{ include "common.ingress" . }} - type: "HTTP" - entrypoint: "websecure" - certType: "" - annotations: {} - hosts: - - host: chart-example.local - path: / + port: + port: 9117 -appVolumeMounts: - config: +additionalServices: + - name: test3 + enabled: true + type: ClusterIP + port: + port: 8083 + name: extra-tcp-test + protocol: TCP + targetPort: 8083 + - name: test4 + enabled: true + type: ClusterIP + port: + port: 8084 + name: extra-udp-test + protocol: UDP + targetPort: 8084 + +ingress: + test1: + enabled: true + test2: + enabled: true + +additionalIngress: + - name: "test3" + enabled: true + - name: "test4" + enabled: true + +persistence: + config: + enabled: true + mountPath: "/config" + emptyDir: true + accessMode: ReadWriteOnce + size: 1Gi + storageClass: "" + +# these values and names are set specifically with the unittests in mind. +fixMountPermissions: false +deviceMounts: + test1: enabled: true emptyDir: true + mountPath: "/test1" + hostPath: "/tmp" + test2: + enabled: true + emptyDir: false + mountPath: "/test2" + hostPath: "/tmp" + +# these values and names are set specifically with the unittests in mind. +customStorage: + - name: "test3" + enabled: true + emptyDir: true + mountPath: "/test3" + hostPath: "" + - name: "test4" + enabled: true + emptyDir: false setPermissions: true - mountPath: "/config" + mountPath: "/test4" + hostPath: "/tmp" diff --git a/library/common-test/values.yaml b/library/common-test/values.yaml index a0b427a0985..302591eb5e1 100644 --- a/library/common-test/values.yaml +++ b/library/common-test/values.yaml @@ -78,5 +78,6 @@ customStorage: - name: "test4" enabled: true emptyDir: false + setPermissions: true mountPath: "/test4" hostPath: "/tmp" diff --git a/library/common/Chart.yaml b/library/common/Chart.yaml index e28c28584a0..c603c6ed871 100644 --- a/library/common/Chart.yaml +++ b/library/common/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v2 kubeVersion: ">=1.16.0-0" name: common -version: 3.0.2 +version: 3.0.3 # upstream_version: appVersion: none description: Function library for TrueCharts diff --git a/library/common/templates/lib/storage/_mountPermissions.tpl b/library/common/templates/lib/storage/_mountPermissions.tpl index 2c33f57ae3d..8ff1f1b691a 100644 --- a/library/common/templates/lib/storage/_mountPermissions.tpl +++ b/library/common/templates/lib/storage/_mountPermissions.tpl @@ -5,55 +5,26 @@ before chart installation. {{- define "common.storage.permissions" -}} {{- if .Values.fixMountPermissions }} -{{- range $index, $avm := .Values.customStorage -}} -{{- if and $avm.enabled $avm.setPermissions}} + +{{- $jobName := include "common.names.fullname" . -}} +{{- $values := .Values -}} + + {{- print "---" | nindent 0 -}} -{{- $AVMValues := $avm -}} -{{- if not $AVMValues.nameSuffix -}} - {{- $_ := set $AVMValues "nameSuffix" $index -}} -{{ end -}} -{{- $_ := set $ "ObjectValues" (dict "appVolumeMounts" $AVMValues) -}} - -{{ include "common.storage.permissions.job" $ | nindent 0 }} - - -{{- $values := .Values.appVolumeMounts -}} -{{- if hasKey . "ObjectValues" -}} - {{- with .ObjectValues.appVolumeMounts -}} - {{- $values = . -}} - {{- end -}} -{{ end -}} -{{- $JobName := include "common.names.fullname" . -}} -{{- if hasKey $values "nameSuffix" -}} - {{- $JobName = printf "%v-%v" $JobName $values.nameSuffix -}} -{{ end -}} - apiVersion: batch/v1 kind: Job metadata: - name: {{ $JobName }} + name: {{ $jobName }}-autopermissions labels: {{- include "common.labels" . | nindent 4 }} - {{- with .Values.controllerLabels }} - {{- toYaml . | nindent 4 }} - {{- end }} annotations: "helm.sh/hook": pre-install,pre-upgrade "helm.sh/hook-weight": "-10" "helm.sh/hook-delete-policy": hook-succeeded,hook-failed,before-hook-creation - {{- with .Values.controllerAnnotations }} - {{- toYaml . | nindent 4 }} - {{- end }} spec: template: metadata: - {{- with .Values.podAnnotations }} - annotations: - {{- toYaml . | nindent 8 }} - {{- end }} - labels: - {{- include "common.labels.selectorLabels" . | nindent 8 }} spec: restartPolicy: Never containers: @@ -62,8 +33,8 @@ spec: command: - /bin/sh - -c - - | - chown -R{{ if eq .podSecurityContext.runAsNonRoot false }}{{ print .Values.PUID }}{{ else }}{{ print .podSecurityContext.runAsUser }}{{ end }}:{{ print .podSecurityContext.fsGroup }} {{ print $values.mountPath }} + - | {{ range $index, $cs := .Values.customStorage}}{{ if and $cs.enabled $cs.setPermissions}} + chown -R {{ if eq $values.podSecurityContext.runAsNonRoot false }}{{ print $values.PUID }}{{ else }}{{ print $values.podSecurityContext.runAsUser }}{{ end }}:{{ print $values.podSecurityContext.fsGroup }} {{ print $cs.mountPath }}{{ end }}{{ end }} #args: # #securityContext: @@ -78,7 +49,3 @@ spec: {{- end }} {{- end }} - - -{{- end }} -{{- end }}