Skip to content

Commit fed3f35

Browse files
pseudomutopseudomuto
authored
Allow option to automount service account token (#898)
In #107 auto-mounting of the default service account token was disabled. Presumably this was because it wasn't necessary in order to run Cockroach. We've had a number of users request the ability to re-enable this as it's the default behaviour in Kubernetes and is often used to grant access to other systems through IAM grants (e.g. backups in S3). This PR adds an `AutomountServiceAccountToken` field to the cluster spec. When set, the service account token will be mounted. By default this value is `false` for backward compatibility reasons.
1 parent 26cf8ef commit fed3f35

14 files changed

+270
-36
lines changed

‎CHANGELOG.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,10 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
1515

1616
# [v2.7.0](https://github.com/cockroachdb/cockroach-operator/compare/v2.6.0...v2.7.0)
1717

18+
## Added
19+
20+
* `AutomountServiceAccountToken` field for cluster spec to allow mounting the default service account token.
21+
1822
## Fixed
1923

2024
* Grant operator deletecollection permissions to fix fullcluster restart flow

‎apis/v1alpha1/cluster_types.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -139,6 +139,12 @@ type CrdbClusterSpec struct {
139139
// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="Cockroach Database Logging configuration config map"
140140
// +optional
141141
LogConfigMap string `json:"logConfigMap,omitempty"`
142+
// (Optional) AutomountServiceAccountToken determines whether or not the stateful set pods should
143+
// automount the service account token. This is the default behavior in Kubernetes. For backward
144+
// compatibility reasons, this value defaults to `false` here.
145+
// Default: false
146+
// +optional
147+
AutomountServiceAccountToken bool `json:"automountServiceAccountToken,omitempty"`
142148
}
143149

144150
// +k8s:openapi-gen=true

‎config/crd/bases/crdb.cockroachlabs.com_crdbclusters.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -665,6 +665,13 @@ spec:
665665
type: array
666666
type: object
667667
type: object
668+
automountServiceAccountToken:
669+
description: '(Optional) AutomountServiceAccountToken determines whether
670+
or not the stateful set pods should automount the service account
671+
token. This is the default behavior in Kubernetes. For backward
672+
compatibility reasons, this value defaults to `false` here. Default:
673+
false'
674+
type: boolean
668675
cache:
669676
description: '(Optional) The total size for caches (`--cache` command
670677
line parameter) Default: "25%"'

‎e2e/upgrades/upgrades_test.go‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -204,7 +204,10 @@ func TestUpgradesMinorVersionThenRollback(t *testing.T) {
204204
sb := testenv.NewDiffingSandbox(t, env)
205205
sb.StartManager(t, controller.InitClusterReconcilerWithLogger(testLog))
206206

207-
builder := testutil.NewBuilder("crdb").WithNodeCount(3).WithTLS().
207+
builder := testutil.NewBuilder("crdb").
208+
WithAutomountServiceAccountToken(true).
209+
WithNodeCount(3).
210+
WithTLS().
208211
WithImage(e2e.MinorVersion1).
209212
WithPVDataStore("1Gi")
210213

‎install/crds.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -663,6 +663,13 @@ spec:
663663
type: array
664664
type: object
665665
type: object
666+
automountServiceAccountToken:
667+
description: '(Optional) AutomountServiceAccountToken determines whether
668+
or not the stateful set pods should automount the service account
669+
token. This is the default behavior in Kubernetes. For backward
670+
compatibility reasons, this value defaults to `false` here. Default:
671+
false'
672+
type: boolean
666673
cache:
667674
description: '(Optional) The total size for caches (`--cache` command
668675
line parameter) Default: "25%"'

‎pkg/resource/statefulset.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -211,7 +211,7 @@ func (b StatefulSetBuilder) makePodTemplate() corev1.PodTemplateSpec {
211211
},
212212
TerminationGracePeriodSeconds: ptr.Int64(terminationGracePeriodSecs),
213213
Containers: b.MakeContainers(),
214-
AutomountServiceAccountToken: ptr.Bool(false),
214+
AutomountServiceAccountToken: ptr.Bool(b.Spec().AutomountServiceAccountToken),
215215
ServiceAccountName: b.ServiceAccountName(),
216216
},
217217
}

‎pkg/resource/testdata/TestStatefulSetBuilder/automount_sa.golden‎

Lines changed: 165 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,165 @@
1+
apiVersion: apps/v1
2+
kind: StatefulSet
3+
metadata:
4+
annotations:
5+
crdb.io/containerimage: ""
6+
crdb.io/version: ""
7+
creationTimestamp: null
8+
name: test-cluster
9+
spec:
10+
podManagementPolicy: Parallel
11+
replicas: 1
12+
selector:
13+
matchLabels:
14+
app.kubernetes.io/component: database
15+
app.kubernetes.io/instance: test-cluster
16+
app.kubernetes.io/name: cockroachdb
17+
car: koenigsegg
18+
serviceName: test-cluster
19+
template:
20+
metadata:
21+
creationTimestamp: null
22+
labels:
23+
app.kubernetes.io/component: database
24+
app.kubernetes.io/instance: test-cluster
25+
app.kubernetes.io/name: cockroachdb
26+
car: koenigsegg
27+
spec:
28+
automountServiceAccountToken: true
29+
containers:
30+
- command:
31+
- /bin/bash
32+
- -ecx
33+
- 'exec /cockroach/cockroach.sh start --advertise-host=$(POD_NAME).test-cluster.test-ns
34+
--certs-dir=/cockroach/cockroach-certs/ --http-port=8080 --sql-addr=:26257
35+
--listen-addr=:26258 --log="{sinks: {stderr: {channels: [OPS, HEALTH], redact:
36+
true}}}" --cache $(expr $MEMORY_LIMIT_MIB / 4)MiB --max-sql-memory $(expr
37+
$MEMORY_LIMIT_MIB / 4)MiB --join=test-cluster-0.test-cluster.test-ns:26258'
38+
env:
39+
- name: COCKROACH_CHANNEL
40+
value: kubernetes-operator-gke
41+
- name: POD_NAME
42+
valueFrom:
43+
fieldRef:
44+
fieldPath: metadata.name
45+
- name: GOMAXPROCS
46+
valueFrom:
47+
resourceFieldRef:
48+
divisor: "1"
49+
resource: limits.cpu
50+
- name: MEMORY_LIMIT_MIB
51+
valueFrom:
52+
resourceFieldRef:
53+
divisor: 1Mi
54+
resource: limits.memory
55+
image: cockroachdb/cockroach:v21.1.0
56+
imagePullPolicy: IfNotPresent
57+
lifecycle:
58+
preStop:
59+
exec:
60+
command:
61+
- sh
62+
- -c
63+
- /cockroach/cockroach node drain --certs-dir=/cockroach/cockroach-certs/
64+
|| exit 0
65+
name: db
66+
ports:
67+
- containerPort: 26258
68+
name: grpc
69+
protocol: TCP
70+
- containerPort: 8080
71+
name: http
72+
protocol: TCP
73+
- containerPort: 26257
74+
name: sql
75+
protocol: TCP
76+
readinessProbe:
77+
failureThreshold: 2
78+
httpGet:
79+
path: /health?ready=1
80+
port: http
81+
scheme: HTTPS
82+
initialDelaySeconds: 10
83+
periodSeconds: 5
84+
resources: {}
85+
volumeMounts:
86+
- mountPath: /cockroach/cockroach-data/
87+
name: datadir
88+
- mountPath: /cockroach/cockroach-certs/
89+
name: emptydir
90+
initContainers:
91+
- command:
92+
- /bin/sh
93+
- -c
94+
- '>- cp -p /cockroach/cockroach-certs-prestage/..data/* /cockroach/cockroach-certs/
95+
&& chmod 700 /cockroach/cockroach-certs/*.key && chown 1000581000:1000581000
96+
/cockroach/cockroach-certs/*.key'
97+
image: cockroachdb/cockroach:v21.1.0
98+
imagePullPolicy: IfNotPresent
99+
name: db-init
100+
resources: {}
101+
securityContext:
102+
allowPrivilegeEscalation: false
103+
runAsUser: 0
104+
volumeMounts:
105+
- mountPath: /cockroach/cockroach-certs-prestage/
106+
name: certs
107+
- mountPath: /cockroach/cockroach-certs/
108+
name: emptydir
109+
securityContext:
110+
fsGroup: 1000581000
111+
runAsUser: 1000581000
112+
serviceAccountName: test-cluster-sa
113+
terminationGracePeriodSeconds: 300
114+
volumes:
115+
- name: datadir
116+
persistentVolumeClaim:
117+
claimName: ""
118+
- emptyDir: {}
119+
name: emptydir
120+
- name: certs
121+
projected:
122+
defaultMode: 400
123+
sources:
124+
- secret:
125+
items:
126+
- key: ca.crt
127+
mode: 504
128+
path: ca.crt
129+
- key: tls.crt
130+
mode: 504
131+
path: node.crt
132+
- key: tls.key
133+
mode: 400
134+
path: node.key
135+
name: test-cluster-node
136+
- secret:
137+
items:
138+
- key: tls.crt
139+
mode: 504
140+
path: client.root.crt
141+
- key: tls.key
142+
mode: 400
143+
path: client.root.key
144+
name: test-cluster-root
145+
updateStrategy:
146+
rollingUpdate: {}
147+
volumeClaimTemplates:
148+
- metadata:
149+
creationTimestamp: null
150+
labels:
151+
app.kubernetes.io/component: database
152+
app.kubernetes.io/instance: test-cluster
153+
app.kubernetes.io/name: cockroachdb
154+
car: koenigsegg
155+
name: datadir
156+
spec:
157+
accessModes:
158+
- ReadWriteOnce
159+
resources:
160+
requests:
161+
storage: 1Gi
162+
volumeMode: Filesystem
163+
status: {}
164+
status:
165+
replicas: 0

‎pkg/resource/testdata/TestStatefulSetBuilder/automount_sa_in.yaml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
# Copyright 2022 The Cockroach Authors
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# https://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
apiVersion: crdb.cockroachlabs.com/v1alpha1
16+
kind: CrdbCluster
17+
metadata:
18+
creationTimestamp: null
19+
name: test-cluster
20+
namespace: test-ns
21+
spec:
22+
automountServiceAccountToken: true
23+
dataStore:
24+
pvc:
25+
spec:
26+
accessModes:
27+
- ReadWriteOnce
28+
resources:
29+
requests:
30+
storage: "1Gi"
31+
volumeMode: Filesystem
32+
grpcPort: 26258
33+
httpPort: 8080
34+
image:
35+
name: cockroachdb/cockroach:v21.1.0
36+
nodes: 1
37+
tlsEnabled: true
38+
topology:
39+
zones:
40+
- locality: ""
41+
additionalLabels:
42+
car: koenigsegg
43+
status: {}

‎pkg/resource/testdata/TestStatefulSetBuilder/default_insecure_statefulset.golden‎

100755100644
Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -28,12 +28,10 @@ spec:
2828
- command:
2929
- /bin/bash
3030
- -ecx
31-
- 'exec /cockroach/cockroach.sh start
32-
--advertise-host=$(POD_NAME).test-cluster.test-ns --insecure --http-port=8080
33-
--sql-addr=:26257 --listen-addr=:26258 --log="{sinks: {stderr: {channels:
34-
[OPS, HEALTH], redact: true}}}" --cache $(expr $MEMORY_LIMIT_MIB / 4)MiB
35-
--max-sql-memory $(expr $MEMORY_LIMIT_MIB / 4)MiB
36-
--join=test-cluster-0.test-cluster.test-ns:26258'
31+
- 'exec /cockroach/cockroach.sh start --advertise-host=$(POD_NAME).test-cluster.test-ns
32+
--insecure --http-port=8080 --sql-addr=:26257 --listen-addr=:26258 --log="{sinks:
33+
{stderr: {channels: [OPS, HEALTH], redact: true}}}" --cache $(expr $MEMORY_LIMIT_MIB
34+
/ 4)MiB --max-sql-memory $(expr $MEMORY_LIMIT_MIB / 4)MiB --join=test-cluster-0.test-cluster.test-ns:26258'
3735
env:
3836
- name: COCKROACH_CHANNEL
3937
value: kubernetes-operator-gke

‎pkg/resource/testdata/TestStatefulSetBuilder/default_secure.golden‎

100755100644
Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -30,12 +30,11 @@ spec:
3030
- command:
3131
- /bin/bash
3232
- -ecx
33-
- 'exec /cockroach/cockroach.sh start
34-
--advertise-host=$(POD_NAME).test-cluster.test-ns --certs-dir=/cockroach/cockroach-certs/
35-
--http-port=8080 --sql-addr=:26257 --listen-addr=:26258 --log="{sinks: {stderr:
36-
{channels: [OPS, HEALTH], redact: true}}}" --cache $(expr $MEMORY_LIMIT_MIB
37-
/ 4)MiB --max-sql-memory $(expr $MEMORY_LIMIT_MIB / 4)MiB
38-
--join=test-cluster-0.test-cluster.test-ns:26258'
33+
- 'exec /cockroach/cockroach.sh start --advertise-host=$(POD_NAME).test-cluster.test-ns
34+
--certs-dir=/cockroach/cockroach-certs/ --http-port=8080 --sql-addr=:26257
35+
--listen-addr=:26258 --log="{sinks: {stderr: {channels: [OPS, HEALTH], redact:
36+
true}}}" --cache $(expr $MEMORY_LIMIT_MIB / 4)MiB --max-sql-memory $(expr
37+
$MEMORY_LIMIT_MIB / 4)MiB --join=test-cluster-0.test-cluster.test-ns:26258'
3938
env:
4039
- name: COCKROACH_CHANNEL
4140
value: kubernetes-operator-gke

0 commit comments

Comments
 (0)