akirn opened a new pull request, #7790:
URL: https://github.com/apache/kyuubi/pull/7790
### Why are the changes needed?
The chart only exposes a pod-level `securityContext`. Fields such as
`allowPrivilegeEscalation`, `readOnlyRootFilesystem` and `capabilities` exist
only on the container `securityContext`, so clusters whose admission policies
require them (for example Pod Security Standards "restricted", or
Kyverno/Gatekeeper equivalents) can't run the chart without patching the
template. This adds a `containerSecurityContext` value applied to the
`kyuubi-server` container, as the Apache Polaris and Dagster charts already
offer.
It also adds an `annotations` value for the StatefulSet's own metadata.
`podAnnotations` only reaches the pod template, but some controllers read the
workload's annotations. For example, Stakater Reloader'
`secret.reloader.stakater.com/reload` must be on the StatefulSet to roll the
pods when a TLS keystore Secret is renewed, since the Kyuubi server reads its
keystore only at startup.
Both values default to `{}`, so the rendered output is unchanged for
existing users.
### How was this patch tested?
The chart has no unit tests, so this was checked by rendering:
1. `helm lint charts/kyuubi` passes.
2. With default values, `helm template t charts/kyuubi` is byte-identical to
master.
3. With both values set:
```
helm template t charts/kyuubi -s templates/kyuubi-statefulset.yaml
--set-json 'annotations={"secret.reloader.stakater.com/reload":"kyuubi-tls"}'
--set-json
'containerSecurityContext={"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true,"capabilities":{"drop":["ALL"]}}'
the annotation renders under the StatefulSet's `metadata.annotations` and
the security context under the `kyuubi-server` container. The output passes
`kubectl apply --dry-run=client`.
```
### Was this patch assisted by generative AI tooling?
No. The patch wasn't assisted. The description was.
cc @pan3793 @dnskr
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
