[stable/jenkins] Added backup service account annotations and pod securitycontext #22730

KrzesloSzatan · 2020-06-10T10:53:33Z

Ive checked this on my local project and it works fine, adds annotation to the service account Jenkins-backup and sets proper securitycontext to the backup pod.

What this PR does / why we need it: Adds annotations to the jenkins-backup service account and securitycontext runAsUser and fsGroup to the pod generated by backup Cronjob

Which issue this PR fixes

fixes 22670

Special notes for your reviewer:

This is my first PR so dunno if ive done everything right, please guide me if there is something wrong.

Checklist

[Place an '[x]' (no spaces) in all applicable fields. Please remove unrelated fields.]

Variables are documented in the README.md
Title of the PR starts with chart name (e.g. [stable/mychartname])

k8s-ci-robot · 2020-06-10T10:53:44Z

Hi @KrzesloSzatan. Thanks for your PR.

I'm waiting for a helm member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

torstenwalter · 2020-06-14T17:59:04Z

stable/jenkins/templates/jenkins-backup-cronjob.yaml

+            runAsUser: {{ default 0 .Values.backup.runAsUser }}
+{{- if and (.Values.backup.runAsUser) (.Values.backup.fsGroup) }}
+{{- if not (eq (int .Values.backup.runAsUser) 0) }}
+            fsGroup: {{ .Values.backup.fsGroup }}


Do you see a use case where runAsUser for backup and Jenkins would be different? Otherwise we could re-use the existing value master.runAdUser. Then we only need to configure the user in one place.

Unfortunately, i have absolutely no idea atm. I have never needed that so cant tell if it is crucial to have them separated. For my case now, there shouldnt be any difference, but didnt check what will happen if i set the runAsUser and fsGroup in master values, untill few days ago i was working with older version ;) If there is no big problem i would leave 2 separate options, but probably either way works for me. Dunno about others.

I suggest to use master.runAsUser

Could you change it and merge changes from Master into your branch?

torstenwalter · 2020-06-20T07:42:09Z

@KrzesloSzatan please also look into the DCO check. That needs to be fixed before it can be merged.

torstenwalter · 2020-07-02T11:43:24Z

@KrzesloSzatan any update here?

KrzesloSzatan · 2020-07-08T20:29:45Z

@KrzesloSzatan please also look into the DCO check. That needs to be fixed before it can be merged.

I dont know what is wrong, ive done what is written in the guide like 15 times already and its always the same. Could you please tell me what im doing wrong ?
Ive done

git commit --amend --signoff
then
git push --force-with-lease origin master

But there is still a problem i dont know how to resolve :/

torstenwalter · 2020-07-15T20:53:03Z

@KrzesloSzatan your PR has three commits. One of them (85d941e) is not signed.

You could rebase your changes on master interactively (git rebase -i master) and squash those commits into one and sign it.

) * [stable/stackdriver-exporter] update k8s deployement api version As of v1.16, k8s won't accept a deploymement with apps/v1beta1 or apps/v1beta2 apiVersion. The accepted apiVersion is apps/v1 that is available since k8s v1.9. See https://kubernetes.io/blog/2019/07/18/api-deprecations-in-1-16 Signed-off-by: Jordan Abderrachid <[email protected]> * bump chart version to 1.2.3 Signed-off-by: Jordan Abderrachid <[email protected]> Signed-off-by: Maciej <[email protected]>

* Add support for GCP BackendConfig. Signed-off-by: Anas <[email protected]> * Bump chart version. Signed-off-by: Anas <[email protected]> * Document new variable. Signed-off-by: Anas <[email protected]> Signed-off-by: Maciej <[email protected]>

…#22654) Signed-off-by: Joseph Stanton <[email protected]> Signed-off-by: Maciej <[email protected]>

* [stable/unifi] adding functionality to mount extra volumes This change adds possibility to specify additional volumes when deploying Unifi controller. Signed-off-by: Marcin Iwinski <[email protected]> * fixing defaults in README.md Signed-off-by: Marcin Iwinski <[email protected]> * [stable/unifi] bumping version to 0.9.0 Signed-off-by: Marcin Iwinski <[email protected]> Signed-off-by: Maciej <[email protected]>

Signed-off-by: thomaszimmer <[email protected]> Signed-off-by: Maciej <[email protected]>

Signed-off-by: William Hutcheson <[email protected]> Co-authored-by: William Hutcheson <[email protected]> Signed-off-by: Maciej <[email protected]>

… the Cluster Agent Pod(s) (#22715) Signed-off-by: Matheus Weber da Conceição <[email protected]> Signed-off-by: Maciej <[email protected]>

* Revert "[stable/fluentd] Fix missing serviceName in HPA (#21202)" This reverts commit 1a877e5. Signed-off-by: Jeremy Mathevet <[email protected]> * Remove trailing tab Signed-off-by: Jeremy Mathevet <[email protected]> * newline at EOF Signed-off-by: Jeremy Mathevet <[email protected]> Signed-off-by: Maciej <[email protected]>

Signed-off-by: Harshavardhana <[email protected]> Signed-off-by: Maciej <[email protected]>

…rvice. (#22703) Fixes #21887 Bump version to 0.10.0 Signed-off-by: Stephen Liang <[email protected]> Signed-off-by: Maciej <[email protected]>

* update rabbitm-ha chart version from 1.46.1 to 1.46.2 Signed-off-by: yj.zeng <[email protected]> * rabbitmq readiness probe fails in some cases. Signed-off-by: yj.zeng <[email protected]> Signed-off-by: Maciej <[email protected]>

Signed-off-by: Kévin Dunglas <[email protected]> Signed-off-by: Maciej <[email protected]>

…ontext added Signed-off-by: Maciej <[email protected]>

k8s-ci-robot · 2020-07-16T09:15:50Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: KrzesloSzatan
To complete the pull request process, please assign mattfarina
You can assign the PR to them by writing /assign @mattfarina in a comment when ready.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

KrzesloSzatan · 2020-07-16T09:17:47Z

@KrzesloSzatan your PR has three commits. One of them (85d941e) is not signed.

You could rebase your changes on master interactively (git rebase -i master) and squash those commits into one and sign it.

Well, ive done something, all commits are signed off. But dunno if i havent done more mess than it was before.

torstenwalter · 2020-07-16T18:16:08Z

@KrzesloSzatan DCO check passes, but we have quite some conflicts...

KrzesloSzatan · 2020-07-17T07:39:49Z

@KrzesloSzatan DCO check passes, but we have quite some conflicts...

Maybe i should just clone repo once again and do my changes, then just push it again and create another PR ?

torstenwalter · 2020-07-19T05:38:30Z

That's also ok. Looking forward to your PR.

stale · 2020-08-22T18:58:04Z

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Any further update will cause the issue/pull request to no longer be considered stale. Thank you for your contributions.

torstenwalter · 2020-08-24T22:59:53Z

/hold This chart will be moved to https://github.com/jenkinsci/helm-charts see for details #23562
Would be great if you could create the PR in the new location.

scottrigby · 2020-09-02T16:07:02Z

👍

k8s-ci-robot requested review from mogaal and viglesiasce June 10, 2020 10:53

helm-bot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Jun 10, 2020

k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Jun 10, 2020

KrzesloSzatan changed the title ~~[stable/jenkins] Added backup serbice account annotations and pod securitycontext~~ [stable/jenkins] Added backup service account annotations and pod securitycontext Jun 10, 2020

torstenwalter reviewed Jun 14, 2020

View reviewed changes

KrzesloSzatan mentioned this pull request Jun 22, 2020

[stable/jenkins] Backup issue with serviceaccount and IAM roles #22670

Closed

helm-bot added Contribution Allowed If the contributor has signed the DCO or the CNCF CLA (prior to the move to a DCO). size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Jul 16, 2020

jordanabderrachid and others added 13 commits July 16, 2020 11:15

[stable/minecraft] Added option to use existing persistentVolumeClaim (…

b7aa77f

…#22654) Signed-off-by: Joseph Stanton <[email protected]> Signed-off-by: Maciej <[email protected]>

Make kube-slack compatible with EKS 1.16 (#22583)

5f78fae

Signed-off-by: thomaszimmer <[email protected]> Signed-off-by: Maciej <[email protected]>

[stable/coredns] Allow extra volumes and mounts (#22685)

c592268

Signed-off-by: William Hutcheson <[email protected]> Co-authored-by: William Hutcheson <[email protected]> Signed-off-by: Maciej <[email protected]>

[stable/datadog] Add clusterAgent.podLabels variable to add labels to…

1136be9

… the Cluster Agent Pod(s) (#22715) Signed-off-by: Matheus Weber da Conceição <[email protected]> Signed-off-by: Maciej <[email protected]>

[stable/minio] remove unnecessary annotation (#22724)

ef536bc

Signed-off-by: Harshavardhana <[email protected]> Signed-off-by: Maciej <[email protected]>

Add ingress for Unifi controller sevice when not using the unified se…

c6c58b3

…rvice. (#22703) Fixes #21887 Bump version to 0.10.0 Signed-off-by: Stephen Liang <[email protected]> Signed-off-by: Maciej <[email protected]>

rabbitmq readiness probe fails in some cases. (#22720)

b6c5754

* update rabbitm-ha chart version from 1.46.1 to 1.46.2 Signed-off-by: yj.zeng <[email protected]> * rabbitmq readiness probe fails in some cases. Signed-off-by: yj.zeng <[email protected]> Signed-off-by: Maciej <[email protected]>

[stable/mercure] Use the /healthz URL for probes (#22729)

3e5ef1b

Signed-off-by: Kévin Dunglas <[email protected]> Signed-off-by: Maciej <[email protected]>

[stable/jenkins] Backup service account annotations and pod securityc…

42f01ff

…ontext added Signed-off-by: Maciej <[email protected]>

stale bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Aug 22, 2020

k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 24, 2020

stale bot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Aug 24, 2020

KrzesloSzatan mentioned this pull request Aug 26, 2020

[stable/jenkins] Added backup service account annotations and pod securitycontext #23616

Closed

2 tasks

scottrigby closed this Sep 2, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[stable/jenkins] Added backup service account annotations and pod securitycontext #22730

[stable/jenkins] Added backup service account annotations and pod securitycontext #22730

KrzesloSzatan commented Jun 10, 2020 •

edited

Loading

k8s-ci-robot commented Jun 10, 2020

torstenwalter Jun 14, 2020

KrzesloSzatan Jun 14, 2020

torstenwalter Jun 20, 2020

torstenwalter commented Jun 20, 2020

torstenwalter commented Jul 2, 2020

KrzesloSzatan commented Jul 8, 2020

torstenwalter commented Jul 15, 2020

k8s-ci-robot commented Jul 16, 2020

KrzesloSzatan commented Jul 16, 2020

torstenwalter commented Jul 16, 2020

KrzesloSzatan commented Jul 17, 2020

torstenwalter commented Jul 19, 2020

stale bot commented Aug 22, 2020

torstenwalter commented Aug 24, 2020

scottrigby commented Sep 2, 2020

[stable/jenkins] Added backup service account annotations and pod securitycontext #22730

[stable/jenkins] Added backup service account annotations and pod securitycontext #22730

Conversation

KrzesloSzatan commented Jun 10, 2020 • edited Loading

What this PR does / why we need it: Adds annotations to the jenkins-backup service account and securitycontext runAsUser and fsGroup to the pod generated by backup Cronjob

Which issue this PR fixes

Special notes for your reviewer:

Checklist

k8s-ci-robot commented Jun 10, 2020

torstenwalter Jun 14, 2020

Choose a reason for hiding this comment

KrzesloSzatan Jun 14, 2020

Choose a reason for hiding this comment

torstenwalter Jun 20, 2020

Choose a reason for hiding this comment

torstenwalter commented Jun 20, 2020

torstenwalter commented Jul 2, 2020

KrzesloSzatan commented Jul 8, 2020

torstenwalter commented Jul 15, 2020

k8s-ci-robot commented Jul 16, 2020

KrzesloSzatan commented Jul 16, 2020

torstenwalter commented Jul 16, 2020

KrzesloSzatan commented Jul 17, 2020

torstenwalter commented Jul 19, 2020

stale bot commented Aug 22, 2020

torstenwalter commented Aug 24, 2020

scottrigby commented Sep 2, 2020

KrzesloSzatan commented Jun 10, 2020 •

edited

Loading