Skip to content

Commit 98fe7f6

Browse files
frances-barcelosjaronoff97
frances-barcelos
and
jaronoff97
authored
Add targetallocator securityContext configuration (#2419)
* Add targetallocator securitycontext Signed-off-by: Frances Barcelos <[email protected]> * Add targetallocator securitycontext Signed-off-by: Frances Barcelos <[email protected]> * Adding perms for servicemonitors * Update 00-assert.yaml --------- Signed-off-by: Frances Barcelos <[email protected]> Co-authored-by: Jacob Aronoff <[email protected]>
1 parent 498f8fb commit 98fe7f6

File tree

10 files changed

+614
-0
lines changed

10 files changed

+614
-0
lines changed

‎.chloggen/ta-securitycontext.yaml

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
2+
change_type: enhancement
3+
4+
# The name of the component, or a single word describing the area of concern, (e.g. operator, target allocator, github action)
5+
component: target allocator
6+
7+
# A brief description of the change. Surround your text with quotes ("") if it needs to start with a backtick (`).
8+
note: add target allocator securityContext configuration
9+
10+
# One or more tracking issues related to the change
11+
issues: [2397]
12+
13+
# (Optional) One or more lines of additional information to render under the primary note.
14+
# These lines will be padded with 2 spaces and then inserted directly into the document.
15+
# Use pipe (|) for multiline entries.
16+
subtext:

‎apis/v1alpha1/opentelemetrycollector_types.go

+4
Original file line numberDiff line numberDiff line change
@@ -322,6 +322,10 @@ type OpenTelemetryTargetAllocator struct {
322322
// All CR instances which the ServiceAccount has access to will be retrieved. This includes other namespaces.
323323
// +optional
324324
PrometheusCR OpenTelemetryTargetAllocatorPrometheusCR `json:"prometheusCR,omitempty"`
325+
// SecurityContext configures the container security context for
326+
// the targetallocator.
327+
// +optional
328+
SecurityContext *v1.PodSecurityContext `json:"securityContext,omitempty"`
325329
// TopologySpreadConstraints embedded kubernetes pod configuration option,
326330
// controls how pods are spread across your cluster among failure-domains
327331
// such as regions, zones, nodes, and other user-defined topology domains

‎apis/v1alpha1/zz_generated.deepcopy.go

+5
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎bundle/manifests/opentelemetry.io_opentelemetrycollectors.yaml

+128
Original file line numberDiff line numberDiff line change
@@ -5050,6 +5050,134 @@ spec:
50505050
resources required.
50515051
type: object
50525052
type: object
5053+
securityContext:
5054+
description: SecurityContext configures the container security
5055+
context for the targetallocator.
5056+
properties:
5057+
fsGroup:
5058+
description: "A special supplemental group that applies to
5059+
all containers in a pod. Some volume types allow the Kubelet
5060+
to change the ownership of that volume to be owned by the
5061+
pod: \n 1."
5062+
format: int64
5063+
type: integer
5064+
fsGroupChangePolicy:
5065+
description: fsGroupChangePolicy defines behavior of changing
5066+
ownership and permission of the volume before being exposed
5067+
inside Pod.
5068+
type: string
5069+
runAsGroup:
5070+
description: The GID to run the entrypoint of the container
5071+
process. Uses runtime default if unset. May also be set
5072+
in SecurityContext.
5073+
format: int64
5074+
type: integer
5075+
runAsNonRoot:
5076+
description: Indicates that the container must run as a non-root
5077+
user.
5078+
type: boolean
5079+
runAsUser:
5080+
description: The UID to run the entrypoint of the container
5081+
process. Defaults to user specified in image metadata if
5082+
unspecified. May also be set in SecurityContext.
5083+
format: int64
5084+
type: integer
5085+
seLinuxOptions:
5086+
description: The SELinux context to be applied to all containers.
5087+
If unspecified, the container runtime will allocate a random
5088+
SELinux context for each container. May also be set in
5089+
SecurityContext.
5090+
properties:
5091+
level:
5092+
description: Level is SELinux level label that applies
5093+
to the container.
5094+
type: string
5095+
role:
5096+
description: Role is a SELinux role label that applies
5097+
to the container.
5098+
type: string
5099+
type:
5100+
description: Type is a SELinux type label that applies
5101+
to the container.
5102+
type: string
5103+
user:
5104+
description: User is a SELinux user label that applies
5105+
to the container.
5106+
type: string
5107+
type: object
5108+
seccompProfile:
5109+
description: The seccomp options to use by the containers
5110+
in this pod. Note that this field cannot be set when spec.os.name
5111+
is windows.
5112+
properties:
5113+
localhostProfile:
5114+
description: localhostProfile indicates a profile defined
5115+
in a file on the node should be used. The profile must
5116+
be preconfigured on the node to work.
5117+
type: string
5118+
type:
5119+
description: "type indicates which kind of seccomp profile
5120+
will be applied. Valid options are: \n Localhost - a
5121+
profile defined in a file on the node should be used."
5122+
type: string
5123+
required:
5124+
- type
5125+
type: object
5126+
supplementalGroups:
5127+
description: A list of groups applied to the first process
5128+
run in each container, in addition to the container's primary
5129+
GID, the fsGroup (if specified), and group memberships defined
5130+
in the container image for th
5131+
items:
5132+
format: int64
5133+
type: integer
5134+
type: array
5135+
sysctls:
5136+
description: Sysctls hold a list of namespaced sysctls used
5137+
for the pod. Pods with unsupported sysctls (by the container
5138+
runtime) might fail to launch. Note that this field cannot
5139+
be set when spec.os.
5140+
items:
5141+
description: Sysctl defines a kernel parameter to be set
5142+
properties:
5143+
name:
5144+
description: Name of a property to set
5145+
type: string
5146+
value:
5147+
description: Value of a property to set
5148+
type: string
5149+
required:
5150+
- name
5151+
- value
5152+
type: object
5153+
type: array
5154+
windowsOptions:
5155+
description: The Windows specific settings applied to all
5156+
containers. If unspecified, the options within a container's
5157+
SecurityContext will be used.
5158+
properties:
5159+
gmsaCredentialSpec:
5160+
description: GMSACredentialSpec is where the GMSA admission
5161+
webhook (https://github.com/kubernetes-sigs/windows-gmsa)
5162+
inlines the contents of the GMSA credential spec named
5163+
by the GMSACredentialSpecName field.
5164+
type: string
5165+
gmsaCredentialSpecName:
5166+
description: GMSACredentialSpecName is the name of the
5167+
GMSA credential spec to use.
5168+
type: string
5169+
hostProcess:
5170+
description: HostProcess determines if a container should
5171+
be run as a 'Host Process' container.
5172+
type: boolean
5173+
runAsUserName:
5174+
description: The UserName in Windows to run the entrypoint
5175+
of the container process. Defaults to the user specified
5176+
in image metadata if unspecified. May also be set in
5177+
PodSecurityContext.
5178+
type: string
5179+
type: object
5180+
type: object
50535181
serviceAccount:
50545182
description: ServiceAccount indicates the name of an existing
50555183
service account to use with this instance. When set, the operator

‎config/crd/bases/opentelemetry.io_opentelemetrycollectors.yaml

+128
Original file line numberDiff line numberDiff line change
@@ -5047,6 +5047,134 @@ spec:
50475047
resources required.
50485048
type: object
50495049
type: object
5050+
securityContext:
5051+
description: SecurityContext configures the container security
5052+
context for the targetallocator.
5053+
properties:
5054+
fsGroup:
5055+
description: "A special supplemental group that applies to
5056+
all containers in a pod. Some volume types allow the Kubelet
5057+
to change the ownership of that volume to be owned by the
5058+
pod: \n 1."
5059+
format: int64
5060+
type: integer
5061+
fsGroupChangePolicy:
5062+
description: fsGroupChangePolicy defines behavior of changing
5063+
ownership and permission of the volume before being exposed
5064+
inside Pod.
5065+
type: string
5066+
runAsGroup:
5067+
description: The GID to run the entrypoint of the container
5068+
process. Uses runtime default if unset. May also be set
5069+
in SecurityContext.
5070+
format: int64
5071+
type: integer
5072+
runAsNonRoot:
5073+
description: Indicates that the container must run as a non-root
5074+
user.
5075+
type: boolean
5076+
runAsUser:
5077+
description: The UID to run the entrypoint of the container
5078+
process. Defaults to user specified in image metadata if
5079+
unspecified. May also be set in SecurityContext.
5080+
format: int64
5081+
type: integer
5082+
seLinuxOptions:
5083+
description: The SELinux context to be applied to all containers.
5084+
If unspecified, the container runtime will allocate a random
5085+
SELinux context for each container. May also be set in
5086+
SecurityContext.
5087+
properties:
5088+
level:
5089+
description: Level is SELinux level label that applies
5090+
to the container.
5091+
type: string
5092+
role:
5093+
description: Role is a SELinux role label that applies
5094+
to the container.
5095+
type: string
5096+
type:
5097+
description: Type is a SELinux type label that applies
5098+
to the container.
5099+
type: string
5100+
user:
5101+
description: User is a SELinux user label that applies
5102+
to the container.
5103+
type: string
5104+
type: object
5105+
seccompProfile:
5106+
description: The seccomp options to use by the containers
5107+
in this pod. Note that this field cannot be set when spec.os.name
5108+
is windows.
5109+
properties:
5110+
localhostProfile:
5111+
description: localhostProfile indicates a profile defined
5112+
in a file on the node should be used. The profile must
5113+
be preconfigured on the node to work.
5114+
type: string
5115+
type:
5116+
description: "type indicates which kind of seccomp profile
5117+
will be applied. Valid options are: \n Localhost - a
5118+
profile defined in a file on the node should be used."
5119+
type: string
5120+
required:
5121+
- type
5122+
type: object
5123+
supplementalGroups:
5124+
description: A list of groups applied to the first process
5125+
run in each container, in addition to the container's primary
5126+
GID, the fsGroup (if specified), and group memberships defined
5127+
in the container image for th
5128+
items:
5129+
format: int64
5130+
type: integer
5131+
type: array
5132+
sysctls:
5133+
description: Sysctls hold a list of namespaced sysctls used
5134+
for the pod. Pods with unsupported sysctls (by the container
5135+
runtime) might fail to launch. Note that this field cannot
5136+
be set when spec.os.
5137+
items:
5138+
description: Sysctl defines a kernel parameter to be set
5139+
properties:
5140+
name:
5141+
description: Name of a property to set
5142+
type: string
5143+
value:
5144+
description: Value of a property to set
5145+
type: string
5146+
required:
5147+
- name
5148+
- value
5149+
type: object
5150+
type: array
5151+
windowsOptions:
5152+
description: The Windows specific settings applied to all
5153+
containers. If unspecified, the options within a container's
5154+
SecurityContext will be used.
5155+
properties:
5156+
gmsaCredentialSpec:
5157+
description: GMSACredentialSpec is where the GMSA admission
5158+
webhook (https://github.com/kubernetes-sigs/windows-gmsa)
5159+
inlines the contents of the GMSA credential spec named
5160+
by the GMSACredentialSpecName field.
5161+
type: string
5162+
gmsaCredentialSpecName:
5163+
description: GMSACredentialSpecName is the name of the
5164+
GMSA credential spec to use.
5165+
type: string
5166+
hostProcess:
5167+
description: HostProcess determines if a container should
5168+
be run as a 'Host Process' container.
5169+
type: boolean
5170+
runAsUserName:
5171+
description: The UserName in Windows to run the entrypoint
5172+
of the container process. Defaults to the user specified
5173+
in image metadata if unspecified. May also be set in
5174+
PodSecurityContext.
5175+
type: string
5176+
type: object
5177+
type: object
50505178
serviceAccount:
50515179
description: ServiceAccount indicates the name of an existing
50525180
service account to use with this instance. When set, the operator

0 commit comments

Comments
 (0)