Allow the Controller and Webhook Containers to run with the securityContext: readOnlyRootfilesystem: true

[npgretz]

🛑 Important:

Please open an issue to discuss significant work before you start. We appreciate your contributions and don't want your efforts to go to waste!

For guidelines on how to contribute, please review the CONTRIBUTING.md document.

Purpose of this PR

Provide a clear and concise description of the changes. Explain the motivation behind these changes and link to relevant issues or discussions.

Close #2218

Proposed changes:

• Mount an emptyDir onto the controller container to write Spark artifacts to
• Mount an emptyDir onto the webhook container to write certficates to
• Set the default securityContexts for the controller and webhook to readOnlyRootfilesystem: true

Change Category

Indicate the type of change by marking the applicable boxes:

• Bugfix (non-breaking change which fixes an issue)
• Feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that could affect existing functionality)
• Documentation update

Rationale

Please see this issue for discussion around this feature.
This feature improves the default security posture of the Spark Operator Helm Chart and allows organizations that require readOnlyRootfilesystem: true to deploy the helm chart.

Checklist

Before submitting your PR, please review the following:

• I have conducted a self-review of my own code.
• I have updated documentation accordingly.
• I have added tests that prove my changes are effective or that my feature works.
• Existing unit tests pass locally with my changes.

Additional Notes

[ChenYi015]

@npgretz Could you do a rebase as there is a merge conflict?

[npgretz]

@npgretz Could you do a rebase as there is a merge conflict?

Done. Thank you for making me aware!

[npgretz]

Sorry for the small mistakes holding up the merge; this is my first open-source contribution. I am just figuring out the process.

[ChenYi015]

It would be better to use the K8s yaml style for values.yaml file, i.e.， the array need not be indented.

[ChenYi015]

@npgretz Thanks for the contribution to enhance the security of the Spark operator. Just a few small nits, could you address them and regenerate the helm README by running make helm-docs? Then everything will be fine for me.

[npgretz]

It would be better to use the K8s yaml style for values.yaml file, i.e.， the array need not be indented.

Thank you for your suggestions! Could I ask for clarification on this suggestion. Is this referring to the array of objects for the volumes and volumeMounts I added for the controller and webhook pods? I am not sure how I could create these arrays of objects without the indentation and have valid YAML.

I also did not find a reference for K8's YAML Style. Could you direct me to a resource?

Thank you, again!

[ChenYi015]

@npgretz If you run kubectl get pod -o yaml to fetch the manifest of any pod, you will find the array objects are not indented:

$ kubectl get pod -n spark-operator spark-operator-controller-69844fbfb5-nqwts -o yaml
...
spec:
  containers:
  - args:
    - controller
    - start
    - --zap-log-level=info
    - --namespaces=default
    - --controller-threads=10
    - --enable-ui-service=true
 ...

Is this referring to the array of objects for the volumes and volumeMounts I added for the controller and webhook pods?

Yes, you can simply remove the indentation so that we can maintain a consistent YAML style.

[npgretz]

@ChenYi015, thank for you for explaining that. I hadn't realized the format of the templated manifests was off. I have adjusted the deployment templates for the controller and webhook to correctly indent volumes and volumeMounts.

[google-oss-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ChenYi015

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [ChenYi015]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ChenYi015]

/lgtm