From 6d4060fa0e2e0e66c2bbd20c107a441242132065 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Javier=20J=2E=20Salmer=C3=B3n-Garc=C3=ADa?= Date: Fri, 19 Jan 2024 11:57:05 +0100 Subject: [PATCH] [bitnami/elasticsearch] fix: :lock: Move service-account token auto-mount to pod declaration (#22396) Signed-off-by: Javier Salmeron Garcia Signed-off-by: Miguel Ruiz Co-authored-by: Miguel Ruiz --- bitnami/elasticsearch/Chart.yaml | 2 +- bitnami/elasticsearch/README.md | 5 +++++ .../templates/coordinating/statefulset.yaml | 1 + .../elasticsearch/templates/data/statefulset.yaml | 1 + .../templates/ingest/statefulset.yaml | 1 + .../templates/master/statefulset.yaml | 1 + .../templates/metrics/deployment.yaml | 1 + bitnami/elasticsearch/values.yaml | 15 +++++++++++++++ 8 files changed, 26 insertions(+), 1 deletion(-) diff --git a/bitnami/elasticsearch/Chart.yaml b/bitnami/elasticsearch/Chart.yaml index 40c0414afa..e1f982e75a 100644 --- a/bitnami/elasticsearch/Chart.yaml +++ b/bitnami/elasticsearch/Chart.yaml @@ -34,4 +34,4 @@ maintainers: name: elasticsearch sources: - https://github.com/bitnami/charts/tree/main/bitnami/elasticsearch -version: 19.16.3 +version: 19.17.0 diff --git a/bitnami/elasticsearch/README.md b/bitnami/elasticsearch/README.md index cc4efeebc1..93ea9240ef 100644 --- a/bitnami/elasticsearch/README.md +++ b/bitnami/elasticsearch/README.md @@ -196,6 +196,7 @@ helm delete --purge my-release | `master.containerSecurityContext.runAsUser` | Set master-elegible containers' Security Context runAsUser | `1001` | | `master.containerSecurityContext.runAsNonRoot` | Set master-elegible containers' Security Context runAsNonRoot | `true` | | `master.containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` | +| `master.automountServiceAccountToken` | Mount Service Account token in pod | `false` | | `master.hostAliases` | master-elegible pods host aliases | `[]` | | `master.podLabels` | Extra labels for master-elegible pods | `{}` | | `master.podAnnotations` | Annotations for master-elegible pods | `{}` | @@ -288,6 +289,7 @@ helm delete --purge my-release | `data.containerSecurityContext.runAsUser` | Set data containers' Security Context runAsUser | `1001` | | `data.containerSecurityContext.runAsNonRoot` | Set data containers' Security Context runAsNonRoot | `true` | | `data.containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` | +| `data.automountServiceAccountToken` | Mount Service Account token in pod | `false` | | `data.hostAliases` | data pods host aliases | `[]` | | `data.podLabels` | Extra labels for data pods | `{}` | | `data.podAnnotations` | Annotations for data pods | `{}` | @@ -380,6 +382,7 @@ helm delete --purge my-release | `coordinating.containerSecurityContext.runAsUser` | Set coordinating-only containers' Security Context runAsUser | `1001` | | `coordinating.containerSecurityContext.runAsNonRoot` | Set coordinating-only containers' Security Context runAsNonRoot | `true` | | `coordinating.containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` | +| `coordinating.automountServiceAccountToken` | Mount Service Account token in pod | `false` | | `coordinating.hostAliases` | coordinating-only pods host aliases | `[]` | | `coordinating.podLabels` | Extra labels for coordinating-only pods | `{}` | | `coordinating.podAnnotations` | Annotations for coordinating-only pods | `{}` | @@ -467,6 +470,7 @@ helm delete --purge my-release | `ingest.containerSecurityContext.runAsUser` | Set ingest-only containers' Security Context runAsUser | `1001` | | `ingest.containerSecurityContext.runAsNonRoot` | Set ingest-only containers' Security Context runAsNonRoot | `true` | | `ingest.containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` | +| `ingest.automountServiceAccountToken` | Mount Service Account token in pod | `false` | | `ingest.hostAliases` | ingest-only pods host aliases | `[]` | | `ingest.podLabels` | Extra labels for ingest-only pods | `{}` | | `ingest.podAnnotations` | Annotations for ingest-only pods | `{}` | @@ -566,6 +570,7 @@ helm delete --purge my-release | `metrics.image.pullSecrets` | Metrics exporter image pull secrets | `[]` | | `metrics.annotations` | Annotations for metrics | `{}` | | `metrics.extraArgs` | Extra arguments to add to the default exporter command | `[]` | +| `metrics.automountServiceAccountToken` | Mount Service Account token in pod | `false` | | `metrics.hostAliases` | Add deployment host aliases | `[]` | | `metrics.schedulerName` | Name of the k8s scheduler (other than default) | `""` | | `metrics.priorityClassName` | Elasticsearch metrics exporter pods' priorityClassName | `""` | diff --git a/bitnami/elasticsearch/templates/coordinating/statefulset.yaml b/bitnami/elasticsearch/templates/coordinating/statefulset.yaml index f2812b3617..626cbc2378 100644 --- a/bitnami/elasticsearch/templates/coordinating/statefulset.yaml +++ b/bitnami/elasticsearch/templates/coordinating/statefulset.yaml @@ -50,6 +50,7 @@ spec: spec: serviceAccountName: {{ template "elasticsearch.coordinating.serviceAccountName" . }} {{- include "elasticsearch.imagePullSecrets" . | nindent 6 }} + automountServiceAccountToken: {{ .Values.coordinating.automountServiceAccountToken }} {{- if .Values.coordinating.hostAliases }} hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.coordinating.hostAliases "context" $) | nindent 8 }} {{- end }} diff --git a/bitnami/elasticsearch/templates/data/statefulset.yaml b/bitnami/elasticsearch/templates/data/statefulset.yaml index 54a837e0b8..8e719a2957 100644 --- a/bitnami/elasticsearch/templates/data/statefulset.yaml +++ b/bitnami/elasticsearch/templates/data/statefulset.yaml @@ -50,6 +50,7 @@ spec: spec: serviceAccountName: {{ template "elasticsearch.data.serviceAccountName" . }} {{- include "elasticsearch.imagePullSecrets" . | nindent 6 }} + automountServiceAccountToken: {{ .Values.data.automountServiceAccountToken }} {{- if .Values.data.hostAliases }} hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.data.hostAliases "context" $) | nindent 8 }} {{- end }} diff --git a/bitnami/elasticsearch/templates/ingest/statefulset.yaml b/bitnami/elasticsearch/templates/ingest/statefulset.yaml index d79d51e7b6..606ff295b9 100644 --- a/bitnami/elasticsearch/templates/ingest/statefulset.yaml +++ b/bitnami/elasticsearch/templates/ingest/statefulset.yaml @@ -50,6 +50,7 @@ spec: spec: serviceAccountName: {{ template "elasticsearch.ingest.serviceAccountName" . }} {{- include "elasticsearch.imagePullSecrets" . | nindent 6 }} + automountServiceAccountToken: {{ .Values.ingest.automountServiceAccountToken }} {{- if .Values.ingest.hostAliases }} hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.ingest.hostAliases "context" $) | nindent 8 }} {{- end }} diff --git a/bitnami/elasticsearch/templates/master/statefulset.yaml b/bitnami/elasticsearch/templates/master/statefulset.yaml index a812d97ed4..70adc88693 100644 --- a/bitnami/elasticsearch/templates/master/statefulset.yaml +++ b/bitnami/elasticsearch/templates/master/statefulset.yaml @@ -50,6 +50,7 @@ spec: spec: serviceAccountName: {{ template "elasticsearch.master.serviceAccountName" . }} {{- include "elasticsearch.imagePullSecrets" . | nindent 6 }} + automountServiceAccountToken: {{ .Values.master.automountServiceAccountToken }} {{- if .Values.master.hostAliases }} hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.master.hostAliases "context" $) | nindent 8 }} {{- end }} diff --git a/bitnami/elasticsearch/templates/metrics/deployment.yaml b/bitnami/elasticsearch/templates/metrics/deployment.yaml index 74ab439694..306a1af188 100644 --- a/bitnami/elasticsearch/templates/metrics/deployment.yaml +++ b/bitnami/elasticsearch/templates/metrics/deployment.yaml @@ -39,6 +39,7 @@ spec: spec: {{- include "elasticsearch.imagePullSecrets" . | nindent 6 }} serviceAccountName: {{ template "elasticsearch.metrics.serviceAccountName" . }} + automountServiceAccountToken: {{ .Values.metrics.automountServiceAccountToken }} {{- if .Values.metrics.hostAliases }} hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.hostAliases "context" $) | nindent 8 }} {{- end }} diff --git a/bitnami/elasticsearch/values.yaml b/bitnami/elasticsearch/values.yaml index 914e3fb77d..cac41b3acc 100644 --- a/bitnami/elasticsearch/values.yaml +++ b/bitnami/elasticsearch/values.yaml @@ -555,6 +555,9 @@ master: runAsNonRoot: true seccompProfile: type: "RuntimeDefault" + ## @param master.automountServiceAccountToken Mount Service Account token in pod + ## + automountServiceAccountToken: false ## @param master.hostAliases master-elegible pods host aliases ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ ## @@ -877,6 +880,9 @@ data: runAsNonRoot: true seccompProfile: type: "RuntimeDefault" + ## @param data.automountServiceAccountToken Mount Service Account token in pod + ## + automountServiceAccountToken: false ## @param data.hostAliases data pods host aliases ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ ## @@ -1200,6 +1206,9 @@ coordinating: runAsNonRoot: true seccompProfile: type: "RuntimeDefault" + ## @param coordinating.automountServiceAccountToken Mount Service Account token in pod + ## + automountServiceAccountToken: false ## @param coordinating.hostAliases coordinating-only pods host aliases ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ ## @@ -1492,6 +1501,9 @@ ingest: runAsNonRoot: true seccompProfile: type: "RuntimeDefault" + ## @param ingest.automountServiceAccountToken Mount Service Account token in pod + ## + automountServiceAccountToken: false ## @param ingest.hostAliases ingest-only pods host aliases ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ ## @@ -1908,6 +1920,9 @@ metrics: ## - --es.indices ## extraArgs: [] + ## @param metrics.automountServiceAccountToken Mount Service Account token in pod + ## + automountServiceAccountToken: false ## @param metrics.hostAliases Add deployment host aliases ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ ##