[bitnami/milvus] feat!: 🔒 💥 Improve security defaults (#24683)

* [bitnami/milvus] feat!: 🔒 💥 Improve security defaults

Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com>

* Update README.md with readme-generator-for-helm

Signed-off-by: Bitnami Containers <bitnami-bot@vmware.com>

* chore: 🔧 Bump target platform size

Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com>

* chore: 🔧 Bump target platform size

Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com>

---------

Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com>
Signed-off-by: Bitnami Containers <bitnami-bot@vmware.com>
Co-authored-by: Bitnami Containers <bitnami-bot@vmware.com>
This commit is contained in:
Javier J. Salmerón-García
2024-03-27 11:30:38 +01:00
committed by GitHub
parent 31cc2456db
commit 1b97e660d5
17 changed files with 361 additions and 178 deletions

View File

@@ -116,4 +116,4 @@ Check the upstream Milvus documentation: https://milvus.io/docs
{{- include "milvus.validateValues" . }}
{{- end }}
{{- include "common.warnings.resources" (dict "sections" (list "attu" "dataCoord" "dataNode" "indexCoord" "indexNode" "initJob" "proxy" "queryCoord" "queryNode" "rootCoord") "context" $) }}
{{- include "common.warnings.resources" (dict "sections" (list "attu" "dataCoord" "dataNode" "indexCoord" "indexNode" "initJob" "proxy" "queryCoord" "queryNode" "rootCoord" "waitContainer") "context" $) }}

View File

@@ -709,6 +709,11 @@ Init container definition for waiting for the database to be ready
{{- if .Values.waitContainer.containerSecurityContext.enabled }}
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.waitContainer.containerSecurityContext "context" $) | nindent 4 }}
{{- end }}
{{- if .Values.waitContainer.resources }}
resources: {{- toYaml .Values.waitContainer.resources | nindent 4 }}
{{- else if ne .Values.waitContainer.resourcesPreset "none" }}
resources: {{- include "common.resources.preset" (dict "type" .Values.waitContainer.resourcesPreset) | nindent 4 }}
{{- end }}
command:
- bash
- -ec
@@ -785,6 +790,11 @@ Init container definition for waiting for the database to be ready
{{- if .Values.waitContainer.containerSecurityContext.enabled }}
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.waitContainer.containerSecurityContext "context" $) | nindent 4 }}
{{- end }}
{{- if .Values.waitContainer.resources }}
resources: {{- toYaml .Values.waitContainer.resources | nindent 4 }}
{{- else if ne .Values.waitContainer.resourcesPreset "none" }}
resources: {{- include "common.resources.preset" (dict "type" .Values.waitContainer.resourcesPreset) | nindent 4 }}
{{- end }}
command:
- bash
- -ec
@@ -837,6 +847,11 @@ Init container definition for waiting for the database to be ready
{{- if .Values.waitContainer.containerSecurityContext.enabled }}
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.waitContainer.containerSecurityContext "context" $) | nindent 4 }}
{{- end }}
{{- if .Values.waitContainer.resources }}
resources: {{- toYaml .Values.waitContainer.resources | nindent 4 }}
{{- else if ne .Values.waitContainer.resourcesPreset "none" }}
resources: {{- include "common.resources.preset" (dict "type" .Values.waitContainer.resourcesPreset) | nindent 4 }}
{{- end }}
command:
- bash
- -ec
@@ -899,6 +914,11 @@ Init container definition for waiting for the database to be ready
{{- if .Values.waitContainer.containerSecurityContext.enabled }}
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.waitContainer.containerSecurityContext "context" $) | nindent 4 }}
{{- end }}
{{- if .Values.waitContainer.resources }}
resources: {{- toYaml .Values.waitContainer.resources | nindent 4 }}
{{- else if ne .Values.waitContainer.resourcesPreset "none" }}
resources: {{- include "common.resources.preset" (dict "type" .Values.waitContainer.resourcesPreset) | nindent 4 }}
{{- end }}
command:
- bash
- -ec
@@ -955,6 +975,11 @@ Init container definition for waiting for the database to be ready
{{- if $block.containerSecurityContext.enabled }}
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" $block.containerSecurityContext "context" .context) | nindent 4 }}
{{- end }}
{{- if $block.resources }}
resources: {{- toYaml $block.resources | nindent 4 }}
{{- else if ne $block.resourcesPreset "none" }}
resources: {{- include "common.resources.preset" (dict "type" $block.resourcesPreset) | nindent 4 }}
{{- end }}
command:
- bash
- -ec
@@ -1030,10 +1055,12 @@ Init container definition for waiting for the database to be ready
- name: component-extra-config
mountPath: /bitnami/milvus/conf/03_extra
{{- end }}
- name: tmp
- name: empty-dir
mountPath: /tmp
- name: rendered-config
subPath: tmp-dir
- name: empty-dir
mountPath: /bitnami/milvus/rendered-conf/
subPath: app-rendered-conf-dir
{{- end -}}
{{/*

View File

@@ -152,14 +152,18 @@ spec:
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.attu.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
volumeMounts:
- name: tmp
- name: empty-dir
mountPath: /tmp
- name: tmp-npm
subPath: tmp-dir
- name: empty-dir
mountPath: /.npm
- name: tmp-yarn
subPath: npm-tmp-dir
- name: empty-dir
mountPath: /.yarn
- name: tmp-yarn-cache
subPath: yarn-dir
- name: empty-dir
mountPath: /.cache/yarn
subPath: yarn-cache-dir
{{- if .Values.attu.extraVolumeMounts }}
{{- include "common.tplvalues.render" (dict "value" .Values.attu.extraVolumeMounts "context" $) | nindent 12 }}
{{- end }}
@@ -167,13 +171,7 @@ spec:
{{- include "common.tplvalues.render" ( dict "value" .Values.attu.sidecars "context" $) | nindent 8 }}
{{- end }}
volumes:
- name: tmp-yarn
emptyDir: {}
- name: tmp-yarn-cache
emptyDir: {}
- name: tmp-npm
emptyDir: {}
- name: tmp
- name: empty-dir
emptyDir: {}
{{- if .Values.attu.extraVolumes }}
{{- include "common.tplvalues.render" (dict "value" .Values.attu.extraVolumes "context" $) | nindent 8 }}

View File

@@ -163,15 +163,19 @@ spec:
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.dataCoord.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
volumeMounts:
- name: rendered-config
- name: empty-dir
mountPath: /opt/bitnami/milvus/configs
- name: tmp
subPath: app-rendered-conf-dir
- name: empty-dir
mountPath: /tmp
- name: tmp-milvus
subPath: tmp-dir
- name: empty-dir
mountPath: /opt/bitnami/milvus/tmp
subPath: app-tmp-dir
# We are using a s3 backend, so this data dir is temporary
- name: tmp-data-milvus
- name: empty-dir
mountPath: /bitnami/milvus/data
subPath: app-data-dir
{{- if and .Values.externalEtcd.tls.enabled (not (empty .Values.externalEtcd.tls.existingSecret)) }}
- name: etcd-client-certs
mountPath: /opt/bitnami/milvus/configs/cert/etcd/client
@@ -184,11 +188,7 @@ spec:
{{- include "common.tplvalues.render" ( dict "value" .Values.dataCoord.sidecars "context" $) | nindent 8 }}
{{- end }}
volumes:
- name: tmp-data-milvus
emptyDir: {}
- name: tmp-milvus
emptyDir: {}
- name: tmp
- name: empty-dir
emptyDir: {}
- name: config-common
configMap:
@@ -212,8 +212,6 @@ spec:
secretName: {{ .Values.externalEtcd.tls.existingSecret }}
defaultMode: 256
{{- end }}
- name: rendered-config
emptyDir: {}
{{- if .Values.dataCoord.extraVolumes }}
{{- include "common.tplvalues.render" (dict "value" .Values.dataCoord.extraVolumes "context" $) | nindent 8 }}
{{- end }}

View File

@@ -163,15 +163,19 @@ spec:
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.dataNode.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
volumeMounts:
- name: rendered-config
- name: empty-dir
mountPath: /opt/bitnami/milvus/configs
- name: tmp
subPath: app-rendered-conf-dir
- name: empty-dir
mountPath: /tmp
- name: tmp-milvus
subPath: tmp-dir
- name: empty-dir
mountPath: /opt/bitnami/milvus/tmp
subPath: app-tmp-dir
# We are using a s3 backend, so this data dir is temporary
- name: tmp-data-milvus
- name: empty-dir
mountPath: /bitnami/milvus/data
subPath: app-data-dir
{{- if and .Values.externalEtcd.tls.enabled (not (empty .Values.externalEtcd.tls.existingSecret)) }}
- name: etcd-client-certs
mountPath: /opt/bitnami/milvus/configs/cert/etcd/client
@@ -184,11 +188,7 @@ spec:
{{- include "common.tplvalues.render" ( dict "value" .Values.dataNode.sidecars "context" $) | nindent 8 }}
{{- end }}
volumes:
- name: tmp-data-milvus
emptyDir: {}
- name: tmp-milvus
emptyDir: {}
- name: tmp
- name: empty-dir
emptyDir: {}
- name: config-common
configMap:
@@ -212,8 +212,6 @@ spec:
secretName: {{ .Values.externalEtcd.tls.existingSecret }}
defaultMode: 256
{{- end }}
- name: rendered-config
emptyDir: {}
{{- if .Values.dataNode.extraVolumes }}
{{- include "common.tplvalues.render" (dict "value" .Values.dataNode.extraVolumes "context" $) | nindent 8 }}
{{- end }}

View File

@@ -163,15 +163,19 @@ spec:
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.indexCoord.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
volumeMounts:
- name: rendered-config
- name: empty-dir
mountPath: /opt/bitnami/milvus/configs
- name: tmp
subPath: app-rendered-conf-dir
- name: empty-dir
mountPath: /tmp
- name: tmp-milvus
subPath: tmp-dir
- name: empty-dir
mountPath: /opt/bitnami/milvus/tmp
subPath: app-tmp-dir
# We are using a s3 backend, so this data dir is temporary
- name: tmp-data-milvus
- name: empty-dir
mountPath: /bitnami/milvus/data
subPath: app-data-dir
{{- if and .Values.externalEtcd.tls.enabled (not (empty .Values.externalEtcd.tls.existingSecret)) }}
- name: etcd-client-certs
mountPath: /opt/bitnami/milvus/configs/cert/etcd/client
@@ -184,11 +188,7 @@ spec:
{{- include "common.tplvalues.render" ( dict "value" .Values.indexCoord.sidecars "context" $) | nindent 8 }}
{{- end }}
volumes:
- name: tmp-data-milvus
emptyDir: {}
- name: tmp-milvus
emptyDir: {}
- name: tmp
- name: empty-dir
emptyDir: {}
- name: config-common
configMap:
@@ -212,8 +212,6 @@ spec:
secretName: {{ .Values.externalEtcd.tls.existingSecret }}
defaultMode: 256
{{- end }}
- name: rendered-config
emptyDir: {}
{{- if .Values.indexCoord.extraVolumes }}
{{- include "common.tplvalues.render" (dict "value" .Values.indexCoord.extraVolumes "context" $) | nindent 8 }}
{{- end }}

View File

@@ -163,15 +163,19 @@ spec:
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.indexNode.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
volumeMounts:
- name: rendered-config
- name: empty-dir
mountPath: /opt/bitnami/milvus/configs
- name: tmp
subPath: app-rendered-conf-dir
- name: empty-dir
mountPath: /tmp
- name: tmp-milvus
subPath: tmp-dir
- name: empty-dir
mountPath: /opt/bitnami/milvus/tmp
subPath: app-tmp-dir
# We are using a s3 backend, so this data dir is temporary
- name: tmp-data-milvus
- name: empty-dir
mountPath: /bitnami/milvus/data
subPath: app-data-dir
{{- if and .Values.externalEtcd.tls.enabled (not (empty .Values.externalEtcd.tls.existingSecret)) }}
- name: etcd-client-certs
mountPath: /opt/bitnami/milvus/configs/cert/etcd/client
@@ -184,11 +188,7 @@ spec:
{{- include "common.tplvalues.render" ( dict "value" .Values.indexNode.sidecars "context" $) | nindent 8 }}
{{- end }}
volumes:
- name: tmp-data-milvus
emptyDir: {}
- name: tmp-milvus
emptyDir: {}
- name: tmp
- name: empty-dir
emptyDir: {}
- name: config-common
configMap:
@@ -212,8 +212,6 @@ spec:
secretName: {{ .Values.externalEtcd.tls.existingSecret }}
defaultMode: 256
{{- end }}
- name: rendered-config
emptyDir: {}
{{- if .Values.indexNode.extraVolumes }}
{{- include "common.tplvalues.render" (dict "value" .Values.indexNode.extraVolumes "context" $) | nindent 8 }}
{{- end }}

View File

@@ -118,6 +118,43 @@ spec:
{{- if .Values.initJob.containerSecurityContext.enabled }}
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.initJob.containerSecurityContext "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.initJob.customLivenessProbe }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.initJob.customLivenessProbe "context" $) | nindent 12 }}
{{- else if .Values.initJob.livenessProbe.enabled }}
livenessProbe:
exec:
command:
- pgrep
- python
initialDelaySeconds: {{ .Values.initJob.livenessProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.initJob.livenessProbe.periodSeconds }}
timeoutSeconds: {{ .Values.initJob.livenessProbe.timeoutSeconds }}
successThreshold: {{ .Values.initJob.livenessProbe.successThreshold }}
failureThreshold: {{ .Values.initJob.livenessProbe.failureThreshold }}
{{- end }}
{{- if .Values.initJob.customReadinessProbe }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.initJob.customReadinessProbe "context" $) | nindent 12 }}
{{- else if .Values.initJob.readinessProbe.enabled }}
readinessProbe:
exec:
command:
- pgrep
- python
initialDelaySeconds: {{ .Values.initJob.readinessProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.initJob.readinessProbe.periodSeconds }}
timeoutSeconds: {{ .Values.initJob.readinessProbe.timeoutSeconds }}
successThreshold: {{ .Values.initJob.readinessProbe.successThreshold }}
failureThreshold: {{ .Values.initJob.readinessProbe.failureThreshold }}
{{- end }}
{{- if .Values.initJob.customStartupProbe }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.initJob.customStartupProbe "context" $) | nindent 12 }}
{{- else if .Values.initJob.startupProbe.enabled }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.initJob.startupProbe "enabled") "context" $) | nindent 12 }}
exec:
command:
- pgrep
- python
{{- end }}
{{- if or .Values.initJob.extraEnvVarsCM .Values.initJob.extraEnvVarsSecret }}
envFrom:
{{- if .Values.initJob.extraEnvVarsCM }}
@@ -130,8 +167,9 @@ spec:
{{- end }}
{{- end }}
volumeMounts:
- name: tmp
- name: empty-dir
mountPath: /tmp
subPath: tmp-dir
{{- if and (ne (int .Values.proxy.tls.mode) 0) (not (empty .Values.initJob.tls.existingSecret)) }}
- name: milvus-client-certs
mountPath: /opt/bitnami/milvus/configs/cert/milvus/client
@@ -146,7 +184,7 @@ spec:
resources: {{- include "common.resources.preset" (dict "type" .Values.initJob.resourcesPreset) | nindent 12 }}
{{- end }}
volumes:
- name: tmp
- name: empty-dir
emptyDir: {}
{{- if and (ne (int .Values.proxy.tls.mode) 0) (not (empty .Values.initJob.tls.existingSecret)) }}
- name: milvus-client-certs

View File

@@ -165,15 +165,19 @@ spec:
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.proxy.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
volumeMounts:
- name: rendered-config
- name: empty-dir
mountPath: /opt/bitnami/milvus/configs
- name: tmp
subPath: app-rendered-conf-dir
- name: empty-dir
mountPath: /tmp
- name: tmp-milvus
subPath: tmp-dir
- name: empty-dir
mountPath: /opt/bitnami/milvus/tmp
subPath: app-tmp-dir
# We are using a s3 backend, so this data dir is temporary
- name: tmp-data-milvus
- name: empty-dir
mountPath: /bitnami/milvus/data
subPath: app-data-dir
{{- if and .Values.externalEtcd.tls.enabled (not (empty .Values.externalEtcd.tls.existingSecret)) }}
- name: etcd-client-certs
mountPath: /opt/bitnami/milvus/configs/cert/etcd/client
@@ -191,11 +195,7 @@ spec:
{{- include "common.tplvalues.render" ( dict "value" .Values.proxy.sidecars "context" $) | nindent 8 }}
{{- end }}
volumes:
- name: tmp-data-milvus
emptyDir: {}
- name: tmp-milvus
emptyDir: {}
- name: tmp
- name: empty-dir
emptyDir: {}
- name: config-common
configMap:
@@ -225,8 +225,6 @@ spec:
secretName: {{ .Values.proxy.tls.existingSecret }}
defaultMode: 256
{{- end }}
- name: rendered-config
emptyDir: {}
{{- if .Values.proxy.extraVolumes }}
{{- include "common.tplvalues.render" (dict "value" .Values.proxy.extraVolumes "context" $) | nindent 8 }}
{{- end }}

View File

@@ -163,15 +163,19 @@ spec:
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.queryCoord.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
volumeMounts:
- name: rendered-config
- name: empty-dir
mountPath: /opt/bitnami/milvus/configs
- name: tmp
subPath: app-rendered-conf-dir
- name: empty-dir
mountPath: /tmp
- name: tmp-milvus
subPath: tmp-dir
- name: empty-dir
mountPath: /opt/bitnami/milvus/tmp
subPath: app-tmp-dir
# We are using a s3 backend, so this data dir is temporary
- name: tmp-data-milvus
- name: empty-dir
mountPath: /bitnami/milvus/data
subPath: app-data-dir
{{- if and .Values.externalEtcd.tls.enabled (not (empty .Values.externalEtcd.tls.existingSecret)) }}
- name: etcd-client-certs
mountPath: /opt/bitnami/milvus/configs/cert/etcd/client
@@ -184,11 +188,7 @@ spec:
{{- include "common.tplvalues.render" ( dict "value" .Values.queryCoord.sidecars "context" $) | nindent 8 }}
{{- end }}
volumes:
- name: tmp-data-milvus
emptyDir: {}
- name: tmp-milvus
emptyDir: {}
- name: tmp
- name: empty-dir
emptyDir: {}
- name: config-common
configMap:
@@ -212,8 +212,6 @@ spec:
secretName: {{ .Values.externalEtcd.tls.existingSecret }}
defaultMode: 256
{{- end }}
- name: rendered-config
emptyDir: {}
{{- if .Values.queryCoord.extraVolumes }}
{{- include "common.tplvalues.render" (dict "value" .Values.queryCoord.extraVolumes "context" $) | nindent 8 }}
{{- end }}

View File

@@ -163,15 +163,19 @@ spec:
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.queryNode.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
volumeMounts:
- name: rendered-config
- name: empty-dir
mountPath: /opt/bitnami/milvus/configs
- name: tmp
subPath: app-rendered-conf-dir
- name: empty-dir
mountPath: /tmp
- name: tmp-milvus
subPath: tmp-dir
- name: empty-dir
mountPath: /opt/bitnami/milvus/tmp
subPath: app-tmp-dir
# We are using a s3 backend, so this data dir is temporary
- name: tmp-data-milvus
- name: empty-dir
mountPath: /bitnami/milvus/data
subPath: app-data-dir
{{- if and .Values.externalEtcd.tls.enabled (not (empty .Values.externalEtcd.tls.existingSecret)) }}
- name: etcd-client-certs
mountPath: /opt/bitnami/milvus/configs/cert/etcd/client
@@ -184,11 +188,7 @@ spec:
{{- include "common.tplvalues.render" ( dict "value" .Values.queryNode.sidecars "context" $) | nindent 8 }}
{{- end }}
volumes:
- name: tmp-data-milvus
emptyDir: {}
- name: tmp-milvus
emptyDir: {}
- name: tmp
- name: empty-dir
emptyDir: {}
- name: config-common
configMap:
@@ -212,8 +212,6 @@ spec:
secretName: {{ .Values.externalEtcd.tls.existingSecret }}
defaultMode: 256
{{- end }}
- name: rendered-config
emptyDir: {}
{{- if .Values.queryNode.extraVolumes }}
{{- include "common.tplvalues.render" (dict "value" .Values.queryNode.extraVolumes "context" $) | nindent 8 }}
{{- end }}

View File

@@ -163,15 +163,19 @@ spec:
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.rootCoord.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
volumeMounts:
- name: rendered-config
- name: empty-dir
mountPath: /opt/bitnami/milvus/configs
- name: tmp
subPath: app-rendered-conf-dir
- name: empty-dir
mountPath: /tmp
- name: tmp-milvus
subPath: tmp-dir
- name: empty-dir
mountPath: /opt/bitnami/milvus/tmp
subPath: app-tmp-dir
# We are using a s3 backend, so this data dir is temporary
- name: tmp-data-milvus
- name: empty-dir
mountPath: /bitnami/milvus/data
subPath: app-data-dir
{{- if and .Values.externalEtcd.tls.enabled (not (empty .Values.externalEtcd.tls.existingSecret)) }}
- name: etcd-client-certs
mountPath: /opt/bitnami/milvus/configs/cert/etcd/client
@@ -184,11 +188,7 @@ spec:
{{- include "common.tplvalues.render" ( dict "value" .Values.rootCoord.sidecars "context" $) | nindent 8 }}
{{- end }}
volumes:
- name: tmp-data-milvus
emptyDir: {}
- name: tmp-milvus
emptyDir: {}
- name: tmp
- name: empty-dir
emptyDir: {}
- name: config-common
configMap:
@@ -212,8 +212,6 @@ spec:
secretName: {{ .Values.externalEtcd.tls.existingSecret }}
defaultMode: 256
{{- end }}
- name: rendered-config
emptyDir: {}
{{- if .Values.rootCoord.extraVolumes }}
{{- include "common.tplvalues.render" (dict "value" .Values.rootCoord.extraVolumes "context" $) | nindent 8 }}
{{- end }}