Skip to content

Commit

Permalink
remove code
Browse files Browse the repository at this point in the history
Signed-off-by: souravbiswassanto <[email protected]>
  • Loading branch information
souravbiswassanto committed Feb 9, 2024
1 parent dac61fd commit f56dbdb
Showing 1 changed file with 1 addition and 43 deletions.
44 changes: 1 addition & 43 deletions apis/kubedb/v1alpha2/postgres_helpers.go
Original file line number Diff line number Diff line change
Expand Up @@ -296,16 +296,7 @@ func (p *Postgres) setDefaultInitContainerSecurityContext(podTemplate *ofst.PodT
container = &core.Container{
Name: PostgresInitContainerName,
SecurityContext: &core.SecurityContext{},
Resources: core.ResourceRequirements{
Limits: core.ResourceList{
core.ResourceCPU: resource.MustParse(".200"),
core.ResourceMemory: resource.MustParse("128Mi"),
},
Requests: core.ResourceList{
core.ResourceCPU: resource.MustParse(".200"),
core.ResourceMemory: resource.MustParse("128Mi"),
},
},
Resources: DefaultInitContainerResource,
}
} else if container.SecurityContext == nil {
container.SecurityContext = &core.SecurityContext{}
Expand Down Expand Up @@ -337,42 +328,9 @@ func (p *Postgres) setDefaultContainerSecurityContext(podTemplate *ofst.PodTempl
if podTemplate.Spec.SecurityContext.FSGroup == nil {
podTemplate.Spec.SecurityContext.FSGroup = pgVersion.Spec.SecurityContext.RunAsUser
}
p.setDefaultCapabilitiesForPostgres(podTemplate.Spec.ContainerSecurityContext)
p.assignDefaultContainerSecurityContext(podTemplate.Spec.ContainerSecurityContext, pgVersion)
}

func (p *Postgres) setDefaultCapabilitiesForPostgres(sc *core.SecurityContext) {
if sc.Capabilities == nil {
sc.Capabilities = &core.Capabilities{
Drop: []core.Capability{"ALL"},
}
} else if sc.Capabilities.Drop == nil && p.matchedPreviousCapabilities(sc) {
sc.Capabilities = &core.Capabilities{
Drop: []core.Capability{"ALL"},
}
}
}

func (p *Postgres) matchedPreviousCapabilities(sc *core.SecurityContext) bool {
caps := sc.Capabilities.Add
capPattern := []core.Capability{IPS_LOCK, SYS_RESOURCE}
if len(caps) != len(capPattern) {
return false
}
for i := range caps {
found := false
for _, capability := range capPattern {
if caps[i] == capability {
found = true
}
}
if !found {
return false
}
}
return true
}

func (p *Postgres) assignDefaultContainerSecurityContext(sc *core.SecurityContext, pgVersion *catalog.PostgresVersion) {
if sc.AllowPrivilegeEscalation == nil {
sc.AllowPrivilegeEscalation = pointer.BoolP(false)
Expand Down

0 comments on commit f56dbdb

Please sign in to comment.