Skip to content

Commit

Permalink
chart(update): replace another mininal kubectl container for patch job
Browse files Browse the repository at this point in the history
Signed-off-by: Viet Nguyen Duc <[email protected]>
  • Loading branch information
VietND96 committed Sep 19, 2024
1 parent 35fafaf commit e27f6ed
Show file tree
Hide file tree
Showing 3 changed files with 23 additions and 4 deletions.
4 changes: 3 additions & 1 deletion charts/selenium-grid/CONFIGURATION.md
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ A Helm chart for creating a Selenium Grid Server in Kubernetes
| global.seleniumGrid.imageTag | string | `"4.24.0-20240907"` | Image tag for all selenium components |
| global.seleniumGrid.nodesImageTag | string | `"4.24.0-20240907"` | Image tag for browser's nodes |
| global.seleniumGrid.videoImageTag | string | `"ffmpeg-7.0.2-20240907"` | Image tag for browser's video recorder |
| global.seleniumGrid.kubectlImage | string | `"bitnami/kubectl:latest"` | kubectl image is used to execute kubectl commands in utility jobs |
| global.seleniumGrid.kubectlImage | string | `"jitesoft/kubectl:latest"` | kubectl image is used to execute kubectl commands in utility jobs |
| global.seleniumGrid.imagePullSecret | string | `""` | Pull secret for all components, can be overridden individually |
| global.seleniumGrid.logLevel | string | `"INFO"` | Log level for all components. Possible values describe here: https://www.selenium.dev/documentation/grid/configuration/cli_options/#logging |
| global.seleniumGrid.defaultNodeStartupProbe | string | `"exec"` | Set default startup probe method for all nodes (supplied values: httpGet, exec). If not set, the default is httpGet |
Expand Down Expand Up @@ -305,6 +305,8 @@ A Helm chart for creating a Selenium Grid Server in Kubernetes
| autoscaling.patchObjectFinalizers.enabled | bool | `true` | Enable patching finalizers for KEDA scaled resources. Workaround for Hook post-upgrade selenium-grid/templates/x-node-hpa.yaml failed: object is being deleted: scaledobjects.keda.sh "x" already exists |
| autoscaling.patchObjectFinalizers.activeDeadlineSeconds | int | `120` | Deadline (in seconds) for patch job to complete |
| autoscaling.patchObjectFinalizers.annotations | object | `{"helm.sh/hook":"post-install,post-upgrade,post-rollback,pre-delete","helm.sh/hook-delete-policy":"hook-succeeded,before-hook-creation","helm.sh/hook-weight":"-1"}` | Annotations for patch job |
| autoscaling.patchObjectFinalizers.imagePullSecret | string | `""` | Custom pull secret for container in patch job |
| autoscaling.patchObjectFinalizers.resources | object | `{"limits":{"cpu":"50m","memory":"50Mi"},"requests":{"cpu":"10m","memory":"10Mi"}}` | Define resources for container in patch job |
| autoscaling.scaledOptions | object | `{"maxReplicaCount":8,"minReplicaCount":0,"pollingInterval":10}` | Options for KEDA scaled resources (keep only common options used for both ScaledJob and ScaledObject) |
| autoscaling.scaledOptions.minReplicaCount | int | `0` | Minimum number of replicas |
| autoscaling.scaledOptions.maxReplicaCount | int | `8` | Maximum number of replicas |
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -30,12 +30,19 @@ spec:
containers:
- name: {{ template "seleniumGrid.keda.patchObjectsJob.fullname" $ }}
image: {{ $.Values.global.seleniumGrid.kubectlImage }}
command: ["/bin/bash", "-c"]
command: ["/bin/sh", "-c"]
args:
- |
echo "Cleaning up ScaledObjects, ScaledJobs and HPAs for {{ .Release.Name }} when upgrading or disabling autoscaling."
kubectl get ScaledObjects,ScaledJobs -n {{ .Release.Namespace }} -l component.autoscaling={{ .Release.Name }} -o=json | jq '.metadata.finalizers = null' | kubectl apply -f - || true ;
kubectl patch ScaledObjects,ScaledJobs -n {{ .Release.Namespace }} -l component.autoscaling={{ .Release.Name }} -p '{"metadata":{"finalizers":null}}' || true ;
kubectl delete ScaledObjects,ScaledJobs -n {{ .Release.Namespace }} -l component.autoscaling={{ .Release.Name }} --wait || true ;
kubectl delete hpa -n {{ .Release.Namespace }} -l component.autoscaling={{ .Release.Name }} --wait || true ;
{{- with $.Values.autoscaling.patchObjectFinalizers.resources }}
resources: {{ toYaml . | nindent 12 }}
{{- end }}
{{- if or $.Values.global.seleniumGrid.imagePullSecret $.Values.autoscaling.patchObjectFinalizers.imagePullSecret }}
imagePullSecrets:
- name: {{ default $.Values.global.seleniumGrid.imagePullSecret $.Values.autoscaling.patchObjectFinalizers.imagePullSecret }}
{{- end }}
restartPolicy: Never
{{- end }}
12 changes: 11 additions & 1 deletion charts/selenium-grid/values.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ global:
# -- Image tag for browser's video recorder
videoImageTag: ffmpeg-7.0.2-20240907
# -- kubectl image is used to execute kubectl commands in utility jobs
kubectlImage: bitnami/kubectl:latest
kubectlImage: jitesoft/kubectl:latest
# -- Pull secret for all components, can be overridden individually
imagePullSecret: ""
# -- Log level for all components. Possible values describe here: https://www.selenium.dev/documentation/grid/configuration/cli_options/#logging
Expand Down Expand Up @@ -796,6 +796,16 @@ autoscaling:
"helm.sh/hook": post-install,post-upgrade,post-rollback,pre-delete
"helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation
"helm.sh/hook-weight": "-1"
# -- Custom pull secret for container in patch job
imagePullSecret: ""
# -- Define resources for container in patch job
resources:
requests:
cpu: 10m
memory: 10Mi
limits:
cpu: 50m
memory: 50Mi
# -- Options for KEDA scaled resources (keep only common options used for both ScaledJob and ScaledObject)
scaledOptions:
# -- Minimum number of replicas
Expand Down

2 comments on commit e27f6ed

@amardeep2006
Copy link
Contributor

@amardeep2006 amardeep2006 commented on e27f6ed Sep 20, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@VietND96
We scan the images via Sysdig before putting them into production and I did today for new image.

  1. jitesoft/kubectl:latest does not pass the security scan with golang related vulnerabilities while Bitnami image passes.
  2. The release frequency for jitesoft/kubectl:latest is less than bitnami image which means slower fixes for vulnerabilities.
  3. For people like me , Debian/Ubuntu is easy sell in Enterprise environments.
    We could stay with bitnami image but looking at chart changes I can say it does not look compatible .

Image

@VietND96
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for your fast feedback. Let me rollback the bitnami registry as default
One thing in part of commit is the script in job updated to use kubectl command alone, without jq needed. So I guess people can easily replace another minimal image themselves.

Please sign in to comment.