Skip to content

Commit 9efc64b

Browse files
egeguneshors
egegunes
and
hors
authored
K8SPSMDB-1262: Fix demand-backup-fs on openshift (#1945)
Co-authored-by: Viacheslav Sarzhan <slava.sarzhan@percona.com>
1 parent 2a08f7a commit 9efc64b

File tree

5 files changed

+163
-52
lines changed

5 files changed

+163
-52
lines changed

‎e2e-tests/demand-backup-fs/conf/nfs-server.yaml renamed to ‎e2e-tests/demand-backup-fs/conf/nfs-server.yml

Lines changed: 21 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,21 @@
1+
---
2+
apiVersion: v1
3+
kind: ServiceAccount
4+
metadata:
5+
name: nfs-server
6+
---
7+
apiVersion: rbac.authorization.k8s.io/v1
8+
kind: RoleBinding
9+
metadata:
10+
name: system:openshift:scc:privileged
11+
roleRef:
12+
apiGroup: rbac.authorization.k8s.io
13+
kind: ClusterRole
14+
name: system:openshift:scc:privileged
15+
subjects:
16+
- kind: ServiceAccount
17+
name: nfs-server
18+
---
119
kind: PersistentVolumeClaim
220
apiVersion: v1
321
metadata:
@@ -8,7 +26,7 @@ spec:
826
- ReadWriteOnce
927
resources:
1028
requests:
11-
storage: 50Gi
29+
storage: 5Gi
1230
---
1331
apiVersion: apps/v1
1432
kind: Deployment
@@ -24,9 +42,10 @@ spec:
2442
labels:
2543
app: nfs-server
2644
spec:
45+
serviceAccountName: nfs-server
2746
containers:
2847
- name: nfs-server
29-
image: k8s.gcr.io/volume-nfs:0.8
48+
image: egegunes/nfs-server:0.9.0
3049
ports:
3150
- name: nfs
3251
containerPort: 2049

‎e2e-tests/demand-backup-fs/conf/rbac-oc.yml

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
name: psmdb-pods
5+
---
6+
apiVersion: security.openshift.io/v1
7+
kind: SecurityContextConstraints
8+
metadata:
9+
name: custom-psmdb-scc
10+
runAsUser:
11+
type: RunAsAny
12+
seLinuxContext:
13+
type: RunAsAny
14+
fsGroup:
15+
type: RunAsAny
16+
supplementalGroups:
17+
type: RunAsAny
18+
volumes:
19+
- "*"
20+
---
21+
apiVersion: rbac.authorization.k8s.io/v1
22+
kind: Role
23+
metadata:
24+
name: use-custom-psmdb-scc
25+
rules:
26+
- apiGroups:
27+
- security.openshift.io
28+
resources:
29+
- securitycontextconstraints
30+
resourceNames:
31+
- custom-psmdb-scc
32+
verbs:
33+
- use
34+
---
35+
apiVersion: rbac.authorization.k8s.io/v1
36+
kind: RoleBinding
37+
metadata:
38+
name: custom-psmdb-scc
39+
roleRef:
40+
apiGroup: rbac.authorization.k8s.io
41+
kind: Role
42+
name: use-custom-psmdb-scc
43+
subjects:
44+
- kind: ServiceAccount
45+
name: psmdb-pods

‎e2e-tests/demand-backup-fs/conf/some-name.yaml renamed to ‎e2e-tests/demand-backup-fs/conf/some-name-oc.yml

Lines changed: 12 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,9 @@ spec:
2222
volumeMounts:
2323
- mountPath: /mnt/nfs/
2424
name: backup-nfs
25+
containerSecurityContext:
26+
runAsNonRoot: true
27+
runAsUser: 1001210000
2528
image: perconalab/percona-server-mongodb-operator:main-mongod8.0
2629
imagePullPolicy: Always
2730
pmm:
@@ -30,6 +33,7 @@ spec:
3033
serverHost: monitoring-service
3134
replsets:
3235
- name: rs0
36+
size: 3
3337
expose:
3438
enabled: false
3539
type: ClusterIP
@@ -47,52 +51,21 @@ spec:
4751
nfs:
4852
server: "nfs-service.storage.svc.cluster.local"
4953
path: "/psmdb-some-name-rs0"
50-
size: 3
5154
volumeSpec:
5255
persistentVolumeClaim:
5356
resources:
5457
requests:
5558
storage: 3Gi
59+
serviceAccountName: psmdb-pods
60+
containerSecurityContext:
61+
runAsNonRoot: true
62+
runAsUser: 1001210000
63+
podSecurityContext:
64+
runAsNonRoot: true
65+
runAsUser: 1001210000
66+
fsGroup: 1001210000
5667
secrets:
5768
users: some-users
58-
sharding:
59-
configsvrReplSet:
60-
affinity:
61-
antiAffinityTopologyKey: none
62-
expose:
63-
enabled: false
64-
type: ClusterIP
65-
podDisruptionBudget:
66-
maxUnavailable: 1
67-
resources:
68-
limits:
69-
cpu: 300m
70-
memory: 0.5G
71-
requests:
72-
cpu: 300m
73-
memory: 0.5G
74-
size: 3
75-
volumeSpec:
76-
persistentVolumeClaim:
77-
resources:
78-
requests:
79-
storage: 3Gi
80-
enabled: false
81-
mongos:
82-
affinity:
83-
antiAffinityTopologyKey: none
84-
expose:
85-
type: ClusterIP
86-
podDisruptionBudget:
87-
maxUnavailable: 1
88-
resources:
89-
limits:
90-
cpu: 300m
91-
memory: 0.5G
92-
requests:
93-
cpu: 300m
94-
memory: 0.5G
95-
size: 3
9669
updateStrategy: SmartUpdate
9770
upgradeOptions:
9871
apply: disabled

‎e2e-tests/demand-backup-fs/conf/some-name.yml

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
apiVersion: psmdb.percona.com/v1
2+
kind: PerconaServerMongoDB
3+
metadata:
4+
finalizers:
5+
- percona.com/delete-psmdb-pods-in-order
6+
name: some-name
7+
spec:
8+
backup:
9+
enabled: true
10+
image: perconalab/percona-server-mongodb-operator:main-backup
11+
pitr:
12+
compressionLevel: 6
13+
compressionType: gzip
14+
enabled: true
15+
oplogOnly: false
16+
oplogSpanMin: 1
17+
storages:
18+
nfs:
19+
filesystem:
20+
path: /mnt/nfs/
21+
type: filesystem
22+
volumeMounts:
23+
- mountPath: /mnt/nfs/
24+
name: backup-nfs
25+
image: perconalab/percona-server-mongodb-operator:main-mongod8.0
26+
imagePullPolicy: Always
27+
pmm:
28+
enabled: false
29+
image: perconalab/pmm-client:dev-latest
30+
serverHost: monitoring-service
31+
replsets:
32+
- name: rs0
33+
size: 3
34+
expose:
35+
enabled: false
36+
type: ClusterIP
37+
podDisruptionBudget:
38+
maxUnavailable: 1
39+
resources:
40+
limits:
41+
cpu: 300m
42+
memory: 0.5G
43+
requests:
44+
cpu: 300m
45+
memory: 0.5G
46+
sidecarVolumes:
47+
- name: backup-nfs
48+
nfs:
49+
server: "nfs-service.storage.svc.cluster.local"
50+
path: "/psmdb-some-name-rs0"
51+
volumeSpec:
52+
persistentVolumeClaim:
53+
resources:
54+
requests:
55+
storage: 3Gi
56+
secrets:
57+
users: some-users
58+
updateStrategy: SmartUpdate
59+
upgradeOptions:
60+
apply: disabled
61+
schedule: 0 2 * * *
62+
setFCV: false
63+
versionServiceEndpoint: https://check-dev.percona.com

‎e2e-tests/demand-backup-fs/run

Lines changed: 22 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -6,14 +6,11 @@ test_dir=$(realpath $(dirname $0))
66
. ${test_dir}/../functions
77
set_debug
88

9-
if [[ "${OPENSHIFT}" ]]; then
10-
echo "This test is not supported on OpenShift due to nfs privileged. See K8SPSMDB-1262"
11-
exit 0
12-
fi
13-
149
deploy_nfs_server() {
10+
local uid=$1
11+
1512
kubectl_bin create namespace storage
16-
kubectl_bin apply -n storage -f ${test_dir}/conf/nfs-server.yaml
13+
kubectl_bin apply -n storage -f ${test_dir}/conf/nfs-server.yml
1714
sleep 5 # wait for NFS server pod to be created
1815

1916
local nfsPod=$(kubectl_bin get pod -n storage -l app=nfs-server -o jsonpath={.items[].metadata.name})
@@ -23,7 +20,7 @@ deploy_nfs_server() {
2320
done
2421

2522
kubectl_bin exec -n storage ${nfsPod} -- mkdir /exports/psmdb-${cluster}-rs0
26-
kubectl_bin exec -n storage ${nfsPod} -- chown 1001:1001 /exports/psmdb-${cluster}-rs0
23+
kubectl_bin exec -n storage ${nfsPod} -- chown ${uid}:${uid} /exports/psmdb-${cluster}-rs0
2724
}
2825

2926
run_recovery_check() {
@@ -60,21 +57,35 @@ if [[ $GKE != 1 ]]; then
6057
kubectl_bin annotate storageclass ${sc} storageclass.kubernetes.io/is-default-class=true
6158
fi
6259

60+
uid=1001
61+
if [[ "${OPENSHIFT}" ]]; then
62+
uid=1001210000
63+
fi
64+
6365
log "deploying NFS server"
64-
deploy_nfs_server
66+
deploy_nfs_server ${uid}
6567

6668
log 'creating secrets and start client'
6769
kubectl_bin apply \
6870
-f "${conf_dir}/secrets.yml" \
6971
-f "${conf_dir}/client.yml"
7072

73+
if [[ "${OPENSHIFT}" ]]; then
74+
log "creating custom security context constraints to allow NFS volumes"
75+
kubectl_bin apply -f ${test_dir}/conf/rbac-oc.yml
76+
fi
77+
7178
log "creating PSMDB cluster ${cluster}"
7279
if [[ $GKE != 1 ]]; then
80+
cluster_yaml=${test_dir}/conf/${cluster}.yml
81+
if [[ "${OPENSHIFT}" ]]; then
82+
cluster_yaml=${test_dir}/conf/${cluster}-oc.yml
83+
fi
84+
7385
nfs_ip=$(kubectl_bin -n storage get svc nfs-service -o jsonpath={.spec.clusterIP})
74-
sed "s/nfs-service.storage.svc.cluster.local/${nfs_ip}/g" ${test_dir}/conf/${cluster}.yaml \
75-
| kubectl_bin apply -f -
86+
sed "s/nfs-service.storage.svc.cluster.local/${nfs_ip}/g" ${cluster_yaml} | kubectl_bin apply -f -
7687
else
77-
apply_cluster ${test_dir}/conf/${cluster}.yaml
88+
apply_cluster ${test_dir}/conf/${cluster}.yml
7889
fi
7990

8091
log 'wait for all 3 pods to start'

0 commit comments

Comments
 (0)