Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(security): security contexts are now configurable #457

Merged
merged 6 commits into from
Sep 21, 2022
Merged

feat(security): security contexts are now configurable #457

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
6062b8d
feat(security): security contexts are now configurable
tthvo Sep 19, 2022
3ec6b60
test(security): update tests
tthvo Sep 19, 2022
17c08bc
docs(security): document custom security contexts
tthvo Sep 19, 2022
1ff8500
doc(security): fix headers
tthvo Sep 19, 2022
886e33b
docs(security): update docs
tthvo Sep 21, 2022
9d6b116
fix(test-resource): rename funcs
tthvo Sep 21, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 42 additions & 0 deletions api/v1beta1/cryostat_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,6 +94,10 @@ type CryostatSpec struct {
// +optional
// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Authorization Properties",xDescriptors={"urn:alm:descriptor:com.tectonic.ui:advanced"}
AuthProperties *AuthorizationProperties `json:"authProperties,omitempty"`
// Options to configure the Security Contexts for the Cryostat application.
// +optional
// +operator-sdk:csv:customresourcedefinitions:type=spec,xDescriptors={"urn:alm:descriptor:com.tectonic.ui:advanced"}
SecurityOptions *SecurityOptions `json:"securityOptions,omitempty"`
}

type ResourceConfigList struct {
Expand Down Expand Up @@ -185,6 +189,10 @@ type ReportConfiguration struct {
// +optional
// +operator-sdk:csv:customresourcedefinitions:type=spec,xDescriptors={"urn:alm:descriptor:com.tectonic.ui:number"}
SubProcessMaxHeapSize int32 `json:"subProcessMaxHeapSize,omitempty"`
// Options to configure the Security Contexts for the Cryostat report generator.
// +optional
// +operator-sdk:csv:customresourcedefinitions:type=spec,xDescriptors={"urn:alm:descriptor:com.tectonic.ui:advanced"}
SecurityOptions *ReportsSecurityOptions `json:"securityOptions,omitempty"`
}

// ServiceConfig provides customization for a service created
Expand Down Expand Up @@ -421,3 +429,37 @@ type AuthorizationProperties struct {
// +operator-sdk:csv:customresourcedefinitions:type=spec,xDescriptors={"urn:alm:descriptor:com.tectonic.ui:text"}
Filename string `json:"filename"`
}

// SecurityOptions contains Security Context customizations for the
// main Cryostat application at both the pod and container level.
type SecurityOptions struct {
// Security Context to apply to the Cryostat pod.
// +optional
// +operator-sdk:csv:customresourcedefinitions:type=spec
PodSecurityContext *corev1.PodSecurityContext `json:"podSecurityContext,omitempty"`
// Security Context to apply to the Cryostat application container.
// +optional
// +operator-sdk:csv:customresourcedefinitions:type=spec
CoreSecurityContext *corev1.SecurityContext `json:"coreSecurityContext,omitempty"`
// Security Context to apply to the JFR Data Source container.
// +optional
// +operator-sdk:csv:customresourcedefinitions:type=spec
DataSourceSecurityContext *corev1.SecurityContext `json:"dataSourceSecurityContext,omitempty"`
// Security Context to apply to the Grafana container.
// +optional
// +operator-sdk:csv:customresourcedefinitions:type=spec
GrafanaSecurityContext *corev1.SecurityContext `json:"grafanaSecurityContext,omitempty"`
}

// ReportsSecurityOptions contains Security Context customizations for the
// Cryostat report generator at both the pod and container level.
type ReportsSecurityOptions struct {
// Security Context to apply to the Cryostat report generator pod.
// +optional
// +operator-sdk:csv:customresourcedefinitions:type=spec
PodSecurityContext *corev1.PodSecurityContext `json:"podSecurityContext,omitempty"`
// Security Context to apply to the Cryostat report generator container.
// +optional
// +operator-sdk:csv:customresourcedefinitions:type=spec
ReportsSecurityContext *corev1.SecurityContext `json:"reportsSecurityContext,omitempty"`
}
70 changes: 70 additions & 0 deletions api/v1beta1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

29 changes: 29 additions & 0 deletions bundle/manifests/cryostat-operator.clusterserviceversion.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -222,6 +222,18 @@ spec:
path: reportOptions.resources
x-descriptors:
- urn:alm:descriptor:com.tectonic.ui:resourceRequirements
- description: Options to configure the Security Contexts for the Cryostat report
generator.
displayName: Security Options
path: reportOptions.securityOptions
x-descriptors:
- urn:alm:descriptor:com.tectonic.ui:advanced
- description: Security Context to apply to the Cryostat report generator pod.
displayName: Pod Security Context
path: reportOptions.securityOptions.podSecurityContext
- description: Security Context to apply to the Cryostat report generator container.
displayName: Reports Security Context
path: reportOptions.securityOptions.reportsSecurityContext
- description: When zero report sidecar replicas are requested, SubProcessMaxHeapSize
configures the maximum heap size of the basic subprocess report generator
in MiB. The default heap size is `200` (MiB).
Expand All @@ -248,6 +260,23 @@ spec:
path: resources.grafanaResources
x-descriptors:
- urn:alm:descriptor:com.tectonic.ui:resourceRequirements
- description: Options to configure the Security Contexts for the Cryostat application.
displayName: Security Options
path: securityOptions
x-descriptors:
- urn:alm:descriptor:com.tectonic.ui:advanced
- description: Security Context to apply to the Cryostat application container.
displayName: Core Security Context
path: securityOptions.coreSecurityContext
- description: Security Context to apply to the JFR Data Source container.
displayName: Data Source Security Context
path: securityOptions.dataSourceSecurityContext
- description: Security Context to apply to the Grafana container.
displayName: Grafana Security Context
path: securityOptions.grafanaSecurityContext
- description: Security Context to apply to the Cryostat pod.
displayName: Pod Security Context
path: securityOptions.podSecurityContext
- description: Options to customize the services created for the Cryostat application
and Grafana dashboard.
displayName: Service Options
Expand Down
Loading