Update PVC permissions

Signed-off-by: Jason Montleon <jmontleo@redhat.com>
konveyor · Nov 7, 2024 · 90c6575 · 90c6575
1 parent 377f3e3
commit 90c6575
Show file tree

Hide file tree

Showing 5 changed files with 53 additions and 1 deletion.
diff --git a/bundle/manifests/konveyor-operator.clusterserviceversion.yaml b/bundle/manifests/konveyor-operator.clusterserviceversion.yaml
@@ -103,7 +103,7 @@ metadata:
     categories: Modernization & Migration
     certified: "false"
     containerImage: quay.io/konveyor/tackle2-operator:latest
-    createdAt: "2024-10-09T15:56:59Z"
+    createdAt: "2024-11-07T18:19:51Z"
     description: Konveyor is an open-source application modernization platform that
       helps organizations safely and predictably modernize applications to Kubernetes
       at scale.
@@ -331,6 +331,14 @@ spec:
           - '*'
           verbs:
           - '*'
+        - apiGroups:
+          - security.openshift.io
+          resourceNames:
+          - anyuid
+          resources:
+          - securitycontextconstraints
+          verbs:
+          - use
         serviceAccountName: tackle-hub
       - rules:
         - apiGroups:

diff --git a/helm/templates/rbac/hub_role.yaml b/helm/templates/rbac/hub_role.yaml
@@ -12,3 +12,11 @@ rules:
   - '*'
   verbs:
   - '*'
+- apiGroups:
+  - security.openshift.io
+  resourceNames:
+  - anyuid
+  resources:
+  - securitycontextconstraints
+  verbs:
+  - use
diff --git a/roles/tackle/tasks/main.yml b/roles/tackle/tasks/main.yml
@@ -3,6 +3,10 @@
   set_fact:
     api_groups: "{{ lookup('k8s', cluster_info='api_groups') }}"
 
+- name: "Retrieve UID"
+  set_facts:
+    hub_task_uid: "{{ lookup('ansible.builtin.env', 'UID') }}"
+
 - name: "Transfer rwx_storage_class setting if hub_bucket_storage_class is not defined"
   set_fact:
     hub_bucket_storage_class: "{{ rwx_storage_class }}"
@@ -562,6 +566,20 @@
     definition: "{{ lookup('template', 'route-ui.yml.j2') }}"
   when: openshift_cluster|bool
 
+- name: "Check if Cache PersistentVolumeClaim exists"
+  kubernetes.core.k8s_info:
+    api_version: v1
+    kind: PersistentVolumeClaim
+    namespace: "{{ app_namespace }}"
+    name: "{{ cache_data_volume_claim_name }}"
+  register: cache_pvc
+
+- name: "Delete cache PVC if non-root label is missing so it can be recreated"
+  when: cache_pvc.resources > 0 and cache_pvc.resources[1].metadata.labels.non-root is not defined
+  k8s:
+    state: absent
+    definition: "{{ lookup('template', 'persistentvolumeclaim-cache.yml.j2') }}"
+
 - name: "Setup Cache PersistentVolumeClaim"
   k8s:
     state: present

diff --git a/roles/tackle/templates/deployment-hub.yml.j2 b/roles/tackle/templates/deployment-hub.yml.j2
@@ -218,6 +218,23 @@ spec:
             - name: {{ hub_tls_secret_name }}
               mountPath: /var/run/secrets/{{ hub_tls_secret_name }}/tls.crt
 {% endif %}
+      initContainers:
+        - command:
+            - chown
+            - -R
+            - {{ hub_task_uid }}:root
+            - /buckets
+            - /database
+          image: "{{ hub_image_fqin }}"
+          imagePullPolicy: "{{ image_pull_policy }}"
+          name: update-perms
+          securityContext:
+            runAsUser: 0
+          volumeMounts:
+            - mountPath: /database
+              name: mta-hub-database
+            - mountPath: /buckets
+              name: mta-hub-bucket
       volumes:
 {% if rwx_supported|bool %}
         - name: {{ cache_data_volume_name }}

diff --git a/roles/tackle/templates/persistentvolumeclaim-cache.yml.j2 b/roles/tackle/templates/persistentvolumeclaim-cache.yml.j2
@@ -8,6 +8,7 @@ metadata:
     app.kubernetes.io/name: {{ cache_name }}
     app.kubernetes.io/part-of: {{ app_name }}
     volume: {{ cache_data_volume_name }}
+    non-root: "true"
 spec:
   accessModes:
     - "{{ cache_data_volume_claim_mode }}"