Skip to content
This repository was archived by the owner on May 28, 2021. It is now read-only.

Commit 8f46c93

Browse files
KashifSaadatprydie
authored andcommitted
Add support for defining securityContext in cluster spec (#218)
Signed-off-by: Kashif Saadat <kashifsaadat@gmail.com>
1 parent e3e3197 commit 8f46c93

File tree

3 files changed

+26
-0
lines changed

3 files changed

+26
-0
lines changed

pkg/apis/mysql/v1alpha1/types.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,8 @@ type ClusterSpec struct {
6464
// and server key for group replication SSL.
6565
// +optional
6666
SSLSecret *corev1.LocalObjectReference `json:"sslSecret,omitempty"`
67+
// SecurityContext holds pod-level security attributes and common container settings.
68+
SecurityContext *corev1.PodSecurityContext `json:"securityContext,omitempty"`
6769
}
6870

6971
// ClusterConditionType represents a valid condition of a Cluster.

pkg/resources/statefulsets/statefulset.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -391,5 +391,8 @@ func NewForCluster(cluster *v1alpha1.Cluster, images operatoropts.Images, servic
391391
if cluster.Spec.BackupVolumeClaimTemplate != nil {
392392
ss.Spec.VolumeClaimTemplates = append(ss.Spec.VolumeClaimTemplates, *cluster.Spec.BackupVolumeClaimTemplate)
393393
}
394+
if cluster.Spec.SecurityContext != nil {
395+
ss.Spec.Template.Spec.SecurityContext = cluster.Spec.SecurityContext
396+
}
394397
return ss
395398
}

pkg/resources/statefulsets/statefulset_test.go

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -165,3 +165,24 @@ func TestClusterCustomSSLSetup(t *testing.T) {
165165

166166
assert.True(t, hasExpectedVolumeMount, "Cluster is missing expected volume mount for custom SSL certs")
167167
}
168+
169+
func TestClusterCustomSecurityContext(t *testing.T) {
170+
userID := int64(27)
171+
cluster := &v1alpha1.Cluster{
172+
Spec: v1alpha1.ClusterSpec{
173+
SecurityContext: &corev1.PodSecurityContext{
174+
RunAsUser: &userID,
175+
FSGroup: &userID,
176+
},
177+
},
178+
}
179+
180+
statefulSet := NewForCluster(cluster, mockOperatorConfig().Images, "mycluster")
181+
182+
if statefulSet.Spec.Template.Spec.SecurityContext != nil {
183+
assert.EqualValues(t, userID, *statefulSet.Spec.Template.Spec.SecurityContext.RunAsUser, "SecurityContext Spec runAsUser does not have expected value")
184+
assert.Equal(t, userID, *statefulSet.Spec.Template.Spec.SecurityContext.FSGroup, "SecurityContext Spec fsGroup does not have expected value")
185+
} else {
186+
t.Errorf("StatefulSet Spec is missing SecurityContext definition")
187+
}
188+
}

0 commit comments

Comments
 (0)