Add option to disable initContainer chown update (#102)

* Add option to disable initContainer chown update Signed-off-by: Aaron Layfield <[email protected]> * True default, not false. Signed-off-by: Aaron Layfield <[email protected]> * Remove trailing spaces Signed-off-by: Aaron Layfield <[email protected]> * Updating CHANGELOG and README Signed-off-by: Aaron Layfield <[email protected]>
opensearch-project · Oct 28, 2021 · 2565fb1 · 2565fb1
1 parent 9c407b9
commit 2565fb1
Show file tree

Hide file tree

Showing 5 changed files with 19 additions and 2 deletions.
diff --git a/charts/opensearch/CHANGELOG.md b/charts/opensearch/CHANGELOG.md
@@ -13,6 +13,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Fixed
 ### Security
 
+---
+## [1.2.3]
+### Added
+- Support to disable the initContainer `fsgroup-volume` for chown updates.
+
 ---
 ## [1.2.2]
 ### Added
@@ -21,6 +26,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Removed
 ### Fixed
 - [Issue #105](https://github.com/opensearch-project/helm-charts/issues/105) OpenSearch chart fails when RBAC is enabled.
+### Security
+
+---
+## [1.2.1]
+### Added
+### Changed
+### Deprecated
+### Removed
+### Fixed
 - Missing `labels` key is added into role.yaml.
 ### Security
 

diff --git a/charts/opensearch/Chart.yaml b/charts/opensearch/Chart.yaml
@@ -15,7 +15,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 1.2.2
+version: 1.2.3
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

diff --git a/charts/opensearch/README.md b/charts/opensearch/README.md
@@ -70,6 +70,7 @@ helm uninstall my-release
 | `nodeGroup`                        | This is the name that will be used for each group of nodes in the cluster. The name will be `clusterName-nodeGroup-X` , `nameOverride-nodeGroup-X` if a `nameOverride` is specified, and `fullnameOverride-X` if a `fullnameOverride` is specified        | `master`                                        |
 | `nodeSelector`                     | Configurable [nodeSelector][] so that you can target specific nodes for your OpenSearch cluster                                                                                                                                                        | `{}`                                            |
 | `persistence`                      | Enables a persistent volume for OpenSearch data.                                                                                      | see [values.yaml][]                             |
+| `persistence.enableInitChown`      | Disable the `fsgroup-volume` initContainer that will update permissions on the persistent disk.                                                                                      | `true`                             |
 | `podAnnotations`                   | Configurable [annotations][] applied to all OpenSearch pods                                                                                                                                                                                            | `{}`                                            |
 | `podManagementPolicy`              | By default Kubernetes [deploys StatefulSets serially][]. This deploys them in parallel so that they can discover each other                                                                                                                               | `Parallel`                                      |
 | `podSecurityContext`               | Allows you to set the [securityContext][] for the pod                                                                                                                                                                                                     | see [values.yaml][]                             |

diff --git a/charts/opensearch/templates/statefulset.yaml b/charts/opensearch/templates/statefulset.yaml
@@ -211,7 +211,7 @@ spec:
       {{- end }}
       {{- if or (.Values.extraInitContainers) (.Values.keystore) (.Values.persistence.enabled) }}
       initContainers:
-{{- if .Values.persistence.enabled }}
+{{- if and .Values.persistence.enabled .Values.persistence.enableInitChown }}
       - name: fsgroup-volume
         image: "{{ template "opensearch.dockerRegistry" . }}busybox:latest"
         command: ['sh', '-c']

diff --git a/charts/opensearch/values.yaml b/charts/opensearch/values.yaml
@@ -171,6 +171,8 @@ podSecurityPolicy:
 
 persistence:
   enabled: true
+  # Set to false to disable the `fsgroup-volume` initContainer that will update permissions on the persistent disk.
+  enableInitChown: true
   labels:
     # Add default labels for the volumeClaimTemplate of the StatefulSet
     enabled: false