Issue 741 fix (LangStream#748)

* Revert "[Issue LangStream#741] Add fsGroup for runtime pod (LangStream#743)" This reverts commit 2cd631c. * [Issue LangStream#741] Fixes previous commit. fsGroup will now be assign to Agent STS and not App
vectorize-io · Dec 14, 2023 · 0eb2b64 · 0eb2b64
1 parent 4a9f731
commit 0eb2b64
Show file tree

Hide file tree

Showing 4 changed files with 21 additions and 14 deletions.
diff --git a/...-deployer-core/src/main/java/ai/langstream/deployer/k8s/agents/AgentResourcesFactory.java b/...-deployer-core/src/main/java/ai/langstream/deployer/k8s/agents/AgentResourcesFactory.java
@@ -41,6 +41,8 @@
 import io.fabric8.kubernetes.api.model.PersistentVolumeClaim;
 import io.fabric8.kubernetes.api.model.PersistentVolumeClaimBuilder;
 import io.fabric8.kubernetes.api.model.Pod;
+import io.fabric8.kubernetes.api.model.PodSecurityContext;
+import io.fabric8.kubernetes.api.model.PodSecurityContextBuilder;
 import io.fabric8.kubernetes.api.model.Probe;
 import io.fabric8.kubernetes.api.model.ProbeBuilder;
 import io.fabric8.kubernetes.api.model.Quantity;
@@ -304,6 +306,7 @@ public static StatefulSet generateStatefulSet(GenerateStatefulsetParams params)
                 .withTolerations(podTemplate != null ? podTemplate.tolerations() : null)
                 .withNodeSelector(podTemplate != null ? podTemplate.nodeSelector() : null)
                 .withTerminationGracePeriodSeconds(60L)
+                .withSecurityContext(getPodSecurityContext())
                 .withInitContainers(
                         List.of(
                                 injectConfigForDownloadCodeInitContainer,
@@ -464,6 +467,10 @@ private static Map<String, String> getPodAnnotations(AgentSpec spec, PodTemplate
         return annotations;
     }
 
+    private static PodSecurityContext getPodSecurityContext() {
+        return new PodSecurityContextBuilder().withFsGroup(10_000L).build();
+    }
+
     private static String getStsImagePullPolicy(GenerateStatefulsetParams params) {
         final String imagePullPolicy = params.getImagePullPolicy();
         final String containerImagePullPolicy =

diff --git a/...-k8s-deployer-core/src/main/java/ai/langstream/deployer/k8s/apps/AppResourcesFactory.java b/...-k8s-deployer-core/src/main/java/ai/langstream/deployer/k8s/apps/AppResourcesFactory.java
@@ -32,7 +32,18 @@
 import ai.langstream.runtime.api.application.ApplicationSetupConstants;
 import ai.langstream.runtime.api.deployer.RuntimeDeployerConfiguration;
 import ai.langstream.runtime.api.deployer.RuntimeDeployerConstants;
-import io.fabric8.kubernetes.api.model.*;
+import io.fabric8.kubernetes.api.model.Container;
+import io.fabric8.kubernetes.api.model.ContainerBuilder;
+import io.fabric8.kubernetes.api.model.EmptyDirVolumeSource;
+import io.fabric8.kubernetes.api.model.EnvVar;
+import io.fabric8.kubernetes.api.model.EnvVarBuilder;
+import io.fabric8.kubernetes.api.model.KeyToPathBuilder;
+import io.fabric8.kubernetes.api.model.Pod;
+import io.fabric8.kubernetes.api.model.Quantity;
+import io.fabric8.kubernetes.api.model.Volume;
+import io.fabric8.kubernetes.api.model.VolumeBuilder;
+import io.fabric8.kubernetes.api.model.VolumeMount;
+import io.fabric8.kubernetes.api.model.VolumeMountBuilder;
 import io.fabric8.kubernetes.api.model.batch.v1.Job;
 import io.fabric8.kubernetes.api.model.batch.v1.JobBuilder;
 import io.fabric8.kubernetes.client.KubernetesClient;
@@ -382,7 +393,6 @@ private static Job generateJob(
                 .withLabels(labels)
                 .endMetadata()
                 .withNewSpec()
-                .withSecurityContext(getPodSecurityContext())
                 .withTolerations(podTemplate != null ? podTemplate.tolerations() : null)
                 .withNodeSelector(podTemplate != null ? podTemplate.nodeSelector() : null)
                 .withServiceAccountName(serviceAccountName)
@@ -456,10 +466,6 @@ private static Map<String, String> getPodAnnotations(PodTemplate podTemplate) {
         return annotations;
     }
 
-    private static PodSecurityContext getPodSecurityContext() {
-        return new PodSecurityContextBuilder().withFsGroup(10_000L).build();
-    }
-
     public static Map<String, String> getLabelsForDeployer(boolean delete, String applicationId) {
         return Map.of(
                 CRDConstants.COMMON_LABEL_APP,

diff --git a/...loyer-core/src/test/java/ai/langstream/deployer/k8s/agents/AgentResourcesFactoryTest.java b/...loyer-core/src/test/java/ai/langstream/deployer/k8s/agents/AgentResourcesFactoryTest.java
@@ -179,6 +179,8 @@ void testStatefulsetAndService() {
                                   name: download-config
                                 - mountPath: /app-code-download
                                   name: code-download
+                              securityContext:
+                                fsGroup: 10000
                               serviceAccountName: runtime-my-tenant
                               terminationGracePeriodSeconds: 60
                               volumes:

diff --git a/...-deployer-core/src/test/java/ai/langstream/deployer/k8s/apps/AppResourcesFactoryTest.java b/...-deployer-core/src/test/java/ai/langstream/deployer/k8s/apps/AppResourcesFactoryTest.java
@@ -127,8 +127,6 @@ void testDeployerJob() {
                                 - mountPath: /cluster-runtime-config
                                   name: cluster-runtime-config
                               restartPolicy: Never
-                              securityContext:
-                                fsGroup: 10000
                               serviceAccountName: my-tenant
                               volumes:
                               - emptyDir: {}
@@ -228,8 +226,6 @@ void testDeployerJob() {
                                 - mountPath: /cluster-runtime-config
                                   name: cluster-runtime-config
                               restartPolicy: Never
-                              securityContext:
-                                fsGroup: 10000
                               serviceAccountName: my-tenant
                               volumes:
                               - emptyDir: {}
@@ -346,8 +342,6 @@ void testSetupJob() {
                                 - mountPath: /cluster-runtime-config
                                   name: cluster-runtime-config
                               restartPolicy: Never
-                              securityContext:
-                                fsGroup: 10000
                               serviceAccountName: runtime-my-tenant
                               volumes:
                               - emptyDir: {}
@@ -444,8 +438,6 @@ void testSetupJob() {
                                 - mountPath: /cluster-runtime-config
                                   name: cluster-runtime-config
                               restartPolicy: Never
-                              securityContext:
-                                fsGroup: 10000
                               serviceAccountName: runtime-my-tenant
                               volumes:
                               - emptyDir: {}