Skip to content

Commit 215d73b

Browse files
kane8nkane8n
authored
Merge pull request #119 from st-tech/support-security-context
Supports PodSecurityContext and Gatling runner container securityContext
2 parents 2b2b470 + 68ef585 commit 215d73b

File tree

8 files changed

+417
-19
lines changed

8 files changed

+417
-19
lines changed

‎api/v1alpha1/gatling_types.go

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,14 @@ type PodSpec struct {
100100
// (Optional) volumes specification.
101101
// +kubebuilder:validation:Optional
102102
Volumes []corev1.Volume `json:"volumes,omitempty"`
103+
104+
// (Optional) SecurityContext specification.
105+
// +kubebuilder:validation:Optional
106+
SecurityContext *corev1.PodSecurityContext `json:"securityContext,omitempty"`
107+
108+
// (Optional) RunnerContainerSecurityContext specifies the SecurityContext of the Gatling runner container.
109+
// +kubebuilder:validation:Optional
110+
RunnerContainerSecurityContext *corev1.SecurityContext `json:"runnerContainerSecurityContext,omitempty"`
103111
}
104112

105113
// TestScenarioSpec defines the load testing scenario

‎api/v1alpha1/zz_generated.deepcopy.go

Lines changed: 10 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/bases/gatling-operator.tech.zozo.com_gatlings.yaml

Lines changed: 339 additions & 0 deletions
Large diffs are not rendered by default.

‎config/samples/gatling-operator_v1alpha1_gatling01.yaml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,13 @@ spec:
88
notifyReport: false # The flag of notifying gatling report
99
cleanupAfterJobDone: true # The flag of cleaning up gatling jobs resources after the job done
1010
podSpec:
11+
securityContext:
12+
sysctls:
13+
- name: net.ipv4.ip_local_port_range
14+
value: "1024 65535"
15+
runnerContainerSecurityContext:
16+
runAsUser: 1000
17+
runAsGroup: 1000
1118
serviceAccountName: "gatling-operator-worker"
1219
gatlingImage: ghcr.io/st-tech/gatling:latest # Optional. Default: ghcr.io/st-tech/gatling:latest. The image that will be used for Gatling container.
1320
rcloneImage: rclone/rclone # Optional. Default: rclone/rclone:latest. The image that will be used for rclone conatiner.

‎controllers/gatling_controller.go

Lines changed: 34 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -563,6 +563,7 @@ func (r *GatlingReconciler) newGatlingRunnerJobForCR(gatling *gatlingv1alpha1.Ga
563563
Affinity: r.getPodAffinity(gatling),
564564
Tolerations: r.getPodTolerations(gatling),
565565
ServiceAccountName: r.getPodServiceAccountName(gatling),
566+
SecurityContext: r.getPodSecurityContext(gatling),
566567
InitContainers: []corev1.Container{
567568
{
568569
Name: "gatling-waiter",
@@ -580,13 +581,14 @@ func (r *GatlingReconciler) newGatlingRunnerJobForCR(gatling *gatlingv1alpha1.Ga
580581
},
581582
Containers: []corev1.Container{
582583
{
583-
Name: "gatling-runner",
584-
Image: r.getGatlingContainerImage(gatling),
585-
Command: []string{"/bin/sh", "-c"},
586-
Args: []string{gatlingRunnerCommand},
587-
Env: envVars,
588-
Resources: r.getPodResources(gatling),
589-
VolumeMounts: r.getGatlingRunnerJobVolumeMounts(gatling),
584+
Name: "gatling-runner",
585+
Image: r.getGatlingContainerImage(gatling),
586+
Command: []string{"/bin/sh", "-c"},
587+
Args: []string{gatlingRunnerCommand},
588+
Env: envVars,
589+
Resources: r.getPodResources(gatling),
590+
VolumeMounts: r.getGatlingRunnerJobVolumeMounts(gatling),
591+
SecurityContext: r.getRunnerContainerSecurityContext(gatling),
590592
},
591593
{
592594
Name: "gatling-result-transferer",
@@ -630,6 +632,7 @@ func (r *GatlingReconciler) newGatlingRunnerJobForCR(gatling *gatlingv1alpha1.Ga
630632
Affinity: r.getPodAffinity(gatling),
631633
Tolerations: r.getPodTolerations(gatling),
632634
ServiceAccountName: r.getPodServiceAccountName(gatling),
635+
SecurityContext: r.getPodSecurityContext(gatling),
633636
InitContainers: []corev1.Container{
634637
{
635638
Name: "gatling-waiter",
@@ -647,13 +650,14 @@ func (r *GatlingReconciler) newGatlingRunnerJobForCR(gatling *gatlingv1alpha1.Ga
647650
},
648651
Containers: []corev1.Container{
649652
{
650-
Name: "gatling-runner",
651-
Image: r.getGatlingContainerImage(gatling),
652-
Command: []string{"/bin/sh", "-c"},
653-
Args: []string{gatlingRunnerCommand},
654-
Env: envVars,
655-
Resources: r.getPodResources(gatling),
656-
VolumeMounts: r.getGatlingRunnerJobVolumeMounts(gatling),
653+
Name: "gatling-runner",
654+
Image: r.getGatlingContainerImage(gatling),
655+
Command: []string{"/bin/sh", "-c"},
656+
Args: []string{gatlingRunnerCommand},
657+
Env: envVars,
658+
Resources: r.getPodResources(gatling),
659+
VolumeMounts: r.getGatlingRunnerJobVolumeMounts(gatling),
660+
SecurityContext: r.getRunnerContainerSecurityContext(gatling),
657661
},
658662
},
659663
RestartPolicy: "Never",
@@ -1110,6 +1114,22 @@ func (r *GatlingReconciler) getResultsDirectoryPath(gatling *gatlingv1alpha1.Gat
11101114
return path
11111115
}
11121116

1117+
func (r *GatlingReconciler) getPodSecurityContext(gatling *gatlingv1alpha1.Gatling) *corev1.PodSecurityContext {
1118+
securityContext := &corev1.PodSecurityContext{}
1119+
if &gatling.Spec.PodSpec != nil && &gatling.Spec.PodSpec.SecurityContext != nil {
1120+
securityContext = gatling.Spec.PodSpec.SecurityContext
1121+
}
1122+
return securityContext
1123+
}
1124+
1125+
func (r *GatlingReconciler) getRunnerContainerSecurityContext(gatling *gatlingv1alpha1.Gatling) *corev1.SecurityContext {
1126+
securityContext := &corev1.SecurityContext{}
1127+
if &gatling.Spec.PodSpec != nil && &gatling.Spec.PodSpec.RunnerContainerSecurityContext != nil {
1128+
securityContext = gatling.Spec.PodSpec.RunnerContainerSecurityContext
1129+
}
1130+
return securityContext
1131+
}
1132+
11131133
func (r *GatlingReconciler) getGenerateLocalReport(gatling *gatlingv1alpha1.Gatling) bool {
11141134
if &gatling.Spec.GenerateLocalReport == nil {
11151135
return false

‎controllers/gatling_controller_test.go

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,15 @@ var _ = Context("Inside of a new namespace", func() {
3737
GenerateReport: false,
3838
NotifyReport: false,
3939
CleanupAfterJobDone: false,
40+
PodSpec: gatlingv1alpha1.PodSpec{
41+
SecurityContext: &corev1.PodSecurityContext{
42+
Sysctls: []corev1.Sysctl{{Name: "net.ipv4.ip_local_port_range", Value: "1024 65535"}},
43+
},
44+
RunnerContainerSecurityContext: &corev1.SecurityContext{
45+
RunAsUser: pointer.Int64Ptr(1000),
46+
RunAsGroup: pointer.Int64Ptr(1000),
47+
},
48+
},
4049
TestScenarioSpec: gatlingv1alpha1.TestScenarioSpec{
4150
SimulationClass: "MyBasicSimulation",
4251
},

‎docs/api.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,7 @@ _Appears in:_
2424

2525
| Field | Description |
2626
| --- | --- |
27-
| `provider` _string_ | (Required) Provider specifies the cloud provider that will be used.
28-
Supported providers: `aws`, `gcp`, and `azure` |
27+
| `provider` _string_ | (Required) Provider specifies the cloud provider that will be used. Supported providers: `aws`, `gcp`, and `azure` |
2928
| `bucket` _string_ | (Required) Storage Bucket Name. |
3029
| `region` _string_ | (Optional) Region Name. |
3130
| `env` _[EnvVar](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#envvar-v1-core) array_ | (Optional) Environment variables used for connecting to the cloud providers. |
@@ -83,8 +82,7 @@ _Appears in:_
8382

8483
| Field | Description |
8584
| --- | --- |
86-
| `provider` _string_ | (Required) Provider specifies notification service provider.
87-
Supported providers: `slack` |
85+
| `provider` _string_ | (Required) Provider specifies notification service provider. Supported providers: `slack` |
8886
| `secretName` _string_ | (Required) The name of secret in which all key/value sets needed for the notification are stored. |
8987

9088

@@ -136,6 +134,8 @@ _Appears in:_
136134
| `tolerations` _[Toleration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#toleration-v1-core) array_ | (Optional) Tolerations specification. |
137135
| `serviceAccountName` _string_ | (Required) ServiceAccountName specification. |
138136
| `volumes` _[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#volume-v1-core) array_ | (Optional) volumes specification. |
137+
| `securityContext` _[PodSecurityContext](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#podsecuritycontext-v1-core)_ | (Optional) SecurityContext specification. |
138+
| `runnerContainerSecurityContext` _[SecurityContext](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#securitycontext-v1-core)_ | (Optional) RunnerContainerSecurityContext specifies the SecurityContext of the Gatling runner container. |
139139

140140

141141
#### TestScenarioSpec

‎gatling/Dockerfile

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,10 @@
55

66
FROM openjdk:21-jdk-slim-bullseye
77

8+
# create user/group
9+
RUN groupadd -g 1000 gatling && \
10+
useradd -l -u 1000 -m gatling -g gatling
11+
812
# working directory for gatling
913
WORKDIR /opt
1014

@@ -22,7 +26,8 @@ RUN apt-get update && apt-get upgrade -y && apt-get install -y wget unzip && \
2226
mkdir -p /tmp/archive && cd /tmp/archive && \
2327
unzip /tmp/downloads/gatling-$GATLING_VERSION.zip && \
2428
mv /tmp/archive/gatling-charts-highcharts-bundle-$GATLING_VERSION/* /opt/gatling/ && \
25-
rm -rf /opt/gatling/user-files/simulations/computerdatabase /tmp/*
29+
rm -rf /opt/gatling/user-files/simulations/computerdatabase /tmp/* && \
30+
chown -R gatling:gatling /opt/gatling
2631

2732
# change context to gatling directory
2833
WORKDIR /opt/gatling

0 commit comments

Comments
 (0)