Skip to content

Commit

Permalink
Add securitycontext to keystore container (#820)
Browse files Browse the repository at this point in the history
### Description
This fixes the issue found in this kubernetes event log:

```log
create Pod opensearch-data-0 in StatefulSet opensearch-data failed error: pods "opensearch-data-0" is forbidden: violates PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "keystore" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "keystore" must set securityContext.capabilities.drop=["ALL"])  
```

When we are running

```yaml
labels:
    pod-security.kubernetes.io/enforce: restricted
```

### Issues Resolved
_List any issues this PR will resolve, e.g. Closes [...]._ 

### Check List
- [x] Commits are signed per the DCO using --signoff 
- [ ] Unittest added for the new/changed functionality and all unit
tests are successful
- [x] Customer-visible features documented
- [x] No linter warnings (`make lint`)

If CRDs are changed:
- [ ] CRD YAMLs updated (`make manifests`) and also copied into the helm
chart
- [ ] Changes to CRDs documented

Please refer to the [PR
guidelines](https://github.com/opensearch-project/opensearch-k8s-operator/blob/main/docs/developing.md#submitting-a-pr)
before submitting this pull request.

By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and
signing off your commits, please check
[here](https://github.com/opensearch-project/OpenSearch/blob/main/CONTRIBUTING.md#developer-certificate-of-origin).

Signed-off-by: Casper Thygesen <[email protected]>
  • Loading branch information
cthtrifork authored May 28, 2024
1 parent 4f59766 commit f58948e
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion opensearch-operator/pkg/builders/cluster.go
Original file line number Diff line number Diff line change
Expand Up @@ -436,7 +436,8 @@ func NewSTSForNodePool(
cp -a /usr/share/opensearch/config/opensearch.keystore /tmp/keystore/
`,
},
VolumeMounts: initContainerVolumeMounts,
VolumeMounts: initContainerVolumeMounts,
SecurityContext: securityContext,
}

initContainers = append(initContainers, keystoreInitContainer)
Expand Down

0 comments on commit f58948e

Please sign in to comment.