zilliztech/milvus-helm

Support setting the security context and pod topology spread constraints for MinIO

Open

#107 opened on Jul 12, 2024

View on GitHub
 (0 comments) (0 reactions) (0 assignees)Go Template (77 forks)auto 404
enhancementgood first issue

Repository metrics

Stars
 (119 stars)
PR merge metrics
 (PR metrics pending)

Description

For security reasons, we use Kyverno's admission controller on our cluster to ensure that certain Linux capabilities are dropped and that containers run as non-root, along with other policies. While we can change the security contexts of the components using the Bitnami Helm charts (etcd, Kafka, etc.) we are unable to do this for MinIO.

In addition, in order to improve resiliency, we would like to be able to set Pod Topology Spread Constraints for the same components.

This is a feature request to expose these in the MinIO Helm chart.

Related to https://github.com/zilliztech/milvus-operator/issues/144

Contributor guide

Research direction
Examine the MinIO statefulset template in the Helm chart (templates/minio statefulset.yaml) and add securityContext and topologySpreadConstraints fields from the values.yaml file. Ensure defaults maintain backward compatibility.
Tech stack
kubernetes
Domain
backenddevopsinfrastructuresecurity
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Half day
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Fresh
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
HelmKubernetesSecurity Context
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
40