Skip to content

Commit ddcc871

Browse files
yankawaiyankawai
committed
feat(opensearch): make setVMMaxMapCount configurable
1 parent 67b4e23 commit ddcc871

7 files changed

Lines changed: 66 additions & 14 deletions

File tree

‎api/apps/v1alpha1/opensearch/types.go‎

Lines changed: 3 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/apps/opensearch/README.md‎

Lines changed: 13 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -6,18 +6,19 @@
66

77
### Common parameters
88

9-
| Name | Description | Type | Value |
10-
| ---------------------- | --------------------------------------------------------------------------------------------------------------------------------- | ---------- | ----------- |
11-
| `replicas` | Number of OpenSearch nodes in the cluster. | `int` | `3` |
12-
| `resources` | Explicit CPU and memory configuration for each OpenSearch node. When omitted, the preset defined in `resourcesPreset` is applied. | `object` | `{}` |
13-
| `resources.cpu` | CPU available to each node. | `quantity` | `""` |
14-
| `resources.memory` | Memory (RAM) available to each node. | `quantity` | `""` |
15-
| `resourcesPreset` | Default sizing preset used when `resources` is omitted. OpenSearch requires minimum 2Gi memory. | `string` | `c1.medium` |
16-
| `size` | Persistent Volume Claim size available for application data. | `quantity` | `10Gi` |
17-
| `storageClass` | StorageClass used to store the data. | `string` | `""` |
18-
| `external` | Enable external access from outside the cluster. | `bool` | `false` |
19-
| `topologySpreadPolicy` | How strictly to enforce pod distribution across nodes and zones. | `string` | `soft` |
20-
| `version` | OpenSearch major version to deploy. | `string` | `v2` |
9+
| Name | Description | Type | Value |
10+
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- | ----------- |
11+
| `replicas` | Number of OpenSearch nodes in the cluster. | `int` | `3` |
12+
| `resources` | Explicit CPU and memory configuration for each OpenSearch node. When omitted, the preset defined in `resourcesPreset` is applied. | `object` | `{}` |
13+
| `resources.cpu` | CPU available to each node. | `quantity` | `""` |
14+
| `resources.memory` | Memory (RAM) available to each node. | `quantity` | `""` |
15+
| `resourcesPreset` | Default sizing preset used when `resources` is omitted. OpenSearch requires minimum 2Gi memory. | `string` | `c1.medium` |
16+
| `size` | Persistent Volume Claim size available for application data. | `quantity` | `10Gi` |
17+
| `storageClass` | StorageClass used to store the data. | `string` | `""` |
18+
| `external` | Enable external access from outside the cluster. | `bool` | `false` |
19+
| `topologySpreadPolicy` | How strictly to enforce pod distribution across nodes and zones. | `string` | `soft` |
20+
| `version` | OpenSearch major version to deploy. | `string` | `v2` |
21+
| `setVMMaxMapCount` | Let the OpenSearch operator raise `vm.max_map_count` with a privileged init container. Disable it when the node already sets the sysctl to at least 262144 — the init container is privileged, which a tenant namespace under the default `baseline` PodSecurity rejects, leaving the StatefulSet unable to create a Pod. | `bool` | `true` |
2122

2223

2324
### Image configuration

‎packages/apps/opensearch/templates/opensearch.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ spec:
1313
serviceName: {{ .Release.Name }}
1414
version: {{ include "opensearch.versionMap" $ }}
1515
httpPort: 9200
16-
setVMMaxMapCount: true
16+
setVMMaxMapCount: {{ .Values.setVMMaxMapCount }}
1717
drainDataNodes: true
1818
{{- if gt (len .Values.images.opensearch) 0 }}
1919
image: {{ .Values.images.opensearch }}

‎packages/apps/opensearch/tests/vm-max-map-count_test.yaml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
suite: setVMMaxMapCount knob
2+
3+
# The operator injects a privileged `init-sysctl` initContainer when
4+
# spec.general.setVMMaxMapCount is true, which a tenant namespace under the
5+
# default `baseline` PodSecurity rejects. See cozystack/cozystack#3022.
6+
7+
templates:
8+
- templates/opensearch.yaml
9+
10+
tests:
11+
- it: defaults to true so existing clusters keep the operator-managed sysctl
12+
release:
13+
name: test-os
14+
namespace: tenant-test
15+
set:
16+
_cluster:
17+
cluster-domain: cozy.local
18+
asserts:
19+
- equal:
20+
path: spec.general.setVMMaxMapCount
21+
value: true
22+
documentSelector:
23+
path: kind
24+
value: OpenSearchCluster
25+
26+
- it: can be disabled when the node already provides the sysctl
27+
release:
28+
name: test-os
29+
namespace: tenant-test
30+
set:
31+
_cluster:
32+
cluster-domain: cozy.local
33+
setVMMaxMapCount: false
34+
asserts:
35+
- equal:
36+
path: spec.general.setVMMaxMapCount
37+
value: false
38+
documentSelector:
39+
path: kind
40+
value: OpenSearchCluster

‎packages/apps/opensearch/values.schema.json‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -146,6 +146,11 @@
146146
"v1"
147147
]
148148
},
149+
"setVMMaxMapCount": {
150+
"description": "Let the OpenSearch operator raise `vm.max_map_count` with a privileged init container. Disable it when the node already sets the sysctl to at least 262144 — the init container is privileged, which a tenant namespace under the default `baseline` PodSecurity rejects, leaving the StatefulSet unable to create a Pod.",
151+
"type": "boolean",
152+
"default": true
153+
},
149154
"images": {
150155
"description": "Container images used by the operator.",
151156
"type": "object",

‎packages/apps/opensearch/values.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,9 @@ topologySpreadPolicy: "soft"
9191
## @param {Version} version - OpenSearch major version to deploy.
9292
version: v2
9393

94+
## @param {bool} setVMMaxMapCount - Let the OpenSearch operator raise `vm.max_map_count` with a privileged init container. Disable it when the node already sets the sysctl to at least 262144 — the init container is privileged, which a tenant namespace under the default `baseline` PodSecurity rejects, leaving the StatefulSet unable to create a Pod.
95+
setVMMaxMapCount: true
96+
9497
##
9598
## @section Image configuration
9699
##

0 commit comments

Comments
 (0)