paperless-ngx: strict values.schema.json and null-safe hardening
Largest values surface of the programme, and the first chart where the null-safety covers two workloads. 1. values.schema.json (#68): additionalProperties: false on every chart-owned object level, including files.barcodes, ocr (with enums for the 3.x modes), scripts, tikaGotenberg, the oidc provider block and the SMB CronJob. 2. Null-safety for hardening, probes and resources (#99), for the server AND the SMB consume-mover CronJob. It reuses the defaultedDict helper the barcodes block already introduced (#61) instead of adding a second mechanism - one merge helper, now with more callers. The server's pod context is consumed twice: as the pod securityContext and by the /run-ownership init container, which chowns /run to runAsUser:runAsGroup because s6-overlay refuses to start unless /run is owned by the runtime uid. Both reads now go through the same helper, so the chown cannot disagree with the context it has to match. Erasing that block used to abort rendering with a nil-pointer error; it now falls back to the defaults like every other chart. The CronJob has no probes (documented exception), so only its two contexts and resources are covered. files.storage stays deliberately not null-safe: an erased value yields an invalid PVC, which is the loud class #99 excludes. Rendering is byte-identical to 11.0.0, both with the CI values (which include the #61 regression guard) and with the production paperless-jk bundle values.
This commit is contained in:
5 files changed
+505
-11
No files matched your search
@@ -189,3 +189,133 @@ fallback for the case where an override has erased the block.
|
||||
"asn" (dict "enabled" true) -}}
|
||||
{{- include "paperless-ngx.defaultedDict" (dict "defaults" $defaults "given" . "path" "paperless.files.barcodes") -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Pick one sub-block out of a values block that may itself be null.
|
||||
|
||||
Input: dict "block" <dict|nil> "key" <string> "path" <string>.
|
||||
Returns YAML of dict "value" <the sub-block, may be nil>, after rejecting a
|
||||
non-mapping block with a message that names the values path. Needed because
|
||||
".Values.paperless.securityContext" can itself be erased.
|
||||
*/}}
|
||||
{{- define "paperless-ngx.subBlock" -}}
|
||||
{{- $block := .block -}}
|
||||
{{- if kindIs "invalid" $block -}}
|
||||
{{- $block = dict -}}
|
||||
{{- end -}}
|
||||
{{- if not (kindIs "map" $block) -}}
|
||||
{{- fail (printf "%s must be a mapping or null, got %s (%v)" .path (kindOf $block) $block) -}}
|
||||
{{- end -}}
|
||||
{{- toYaml (dict "value" (index $block .key)) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
The effective security contexts, probes and resources of both workloads
|
||||
(issue #99), built on the same defaultedDict the barcodes block already uses
|
||||
(issue #61) - one mechanism, not two.
|
||||
|
||||
The defaults below MUST stay in sync with the corresponding blocks in
|
||||
values.yaml, which stays the documented, user-facing place for them; this copy
|
||||
is only the fallback for the case where an override has erased the block.
|
||||
|
||||
The pod context is consumed twice: as the pod's securityContext and by the
|
||||
/run-ownership init container, which chowns the /run emptyDir to
|
||||
runAsUser:runAsGroup because s6-overlay refuses to start unless /run is OWNED
|
||||
by the runtime uid. Both reads go through this helper, so the chown can never
|
||||
disagree with the context it is supposed to match.
|
||||
*/}}
|
||||
{{- define "paperless-ngx.podSecurityContext" -}}
|
||||
{{- $given := (fromYaml (include "paperless-ngx.subBlock" (dict "block" . "key" "pod" "path" "paperless.securityContext"))).value -}}
|
||||
{{- $defaults := dict
|
||||
"runAsNonRoot" true
|
||||
"runAsUser" 1000
|
||||
"runAsGroup" 1000
|
||||
"fsGroup" 1000
|
||||
"fsGroupChangePolicy" "Always" -}}
|
||||
{{- include "paperless-ngx.defaultedDict" (dict "defaults" $defaults "given" $given "path" "paperless.securityContext.pod") -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "paperless-ngx.containerSecurityContext" -}}
|
||||
{{- $given := (fromYaml (include "paperless-ngx.subBlock" (dict "block" . "key" "container" "path" "paperless.securityContext"))).value -}}
|
||||
{{- $defaults := dict
|
||||
"allowPrivilegeEscalation" false
|
||||
"readOnlyRootFilesystem" true
|
||||
"runAsNonRoot" true
|
||||
"capabilities" (dict "drop" (list "ALL")) -}}
|
||||
{{- include "paperless-ngx.defaultedDict" (dict "defaults" $defaults "given" $given "path" "paperless.securityContext.container") -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "paperless-ngx.livenessProbe" -}}
|
||||
{{- $defaults := dict
|
||||
"httpGet" (dict "path" "/" "port" 8000)
|
||||
"periodSeconds" 30
|
||||
"failureThreshold" 3
|
||||
"successThreshold" 1
|
||||
"timeoutSeconds" 5 -}}
|
||||
{{- include "paperless-ngx.defaultedDict" (dict "defaults" $defaults "given" . "path" "paperless.livenessProbe") -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "paperless-ngx.readinessProbe" -}}
|
||||
{{- $defaults := dict
|
||||
"httpGet" (dict "path" "/" "port" 8000)
|
||||
"periodSeconds" 10
|
||||
"failureThreshold" 3
|
||||
"successThreshold" 1
|
||||
"timeoutSeconds" 5 -}}
|
||||
{{- include "paperless-ngx.defaultedDict" (dict "defaults" $defaults "given" . "path" "paperless.readinessProbe") -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
The startup budget is deliberately large (10s x 60 = 600s): paperless runs
|
||||
database migrations on startup, and since 3.0 the first start after an upgrade
|
||||
also rebuilds the search index from scratch (Whoosh -> Tantivy).
|
||||
*/}}
|
||||
{{- define "paperless-ngx.startupProbe" -}}
|
||||
{{- $defaults := dict
|
||||
"httpGet" (dict "path" "/" "port" 8000)
|
||||
"periodSeconds" 10
|
||||
"failureThreshold" 60
|
||||
"timeoutSeconds" 5 -}}
|
||||
{{- include "paperless-ngx.defaultedDict" (dict "defaults" $defaults "given" . "path" "paperless.startupProbe") -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "paperless-ngx.effectiveResources" -}}
|
||||
{{- $defaults := dict
|
||||
"limitFactor" 3
|
||||
"requests" (dict "cpu" 0.2 "memory" "1024Mi" "ephemeralStorage" "200Mi") -}}
|
||||
{{- $merged := fromYaml (include "paperless-ngx.defaultedDict" (dict "defaults" $defaults "given" . "path" "paperless.resources")) -}}
|
||||
{{- include "paperless-ngx.resources" $merged -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
The same three fallbacks for the SMB consume-mover CronJob. It has no probes
|
||||
(documented exception), so only the two contexts and resources apply.
|
||||
*/}}
|
||||
{{- define "paperless-ngx.cron.podSecurityContext" -}}
|
||||
{{- $given := (fromYaml (include "paperless-ngx.subBlock" (dict "block" . "key" "pod" "path" "smbConnection.cron.securityContext"))).value -}}
|
||||
{{- $defaults := dict
|
||||
"runAsNonRoot" true
|
||||
"runAsUser" 1000
|
||||
"runAsGroup" 1000
|
||||
"fsGroup" 1000
|
||||
"fsGroupChangePolicy" "Always" -}}
|
||||
{{- include "paperless-ngx.defaultedDict" (dict "defaults" $defaults "given" $given "path" "smbConnection.cron.securityContext.pod") -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "paperless-ngx.cron.containerSecurityContext" -}}
|
||||
{{- $given := (fromYaml (include "paperless-ngx.subBlock" (dict "block" . "key" "container" "path" "smbConnection.cron.securityContext"))).value -}}
|
||||
{{- $defaults := dict
|
||||
"allowPrivilegeEscalation" false
|
||||
"readOnlyRootFilesystem" true
|
||||
"runAsNonRoot" true
|
||||
"capabilities" (dict "drop" (list "ALL")) -}}
|
||||
{{- include "paperless-ngx.defaultedDict" (dict "defaults" $defaults "given" $given "path" "smbConnection.cron.securityContext.container") -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "paperless-ngx.cron.effectiveResources" -}}
|
||||
{{- $defaults := dict
|
||||
"limitFactor" 3
|
||||
"requests" (dict "cpu" "10m" "memory" "16Mi" "ephemeralStorage" "10Mi") -}}
|
||||
{{- $merged := fromYaml (include "paperless-ngx.defaultedDict" (dict "defaults" $defaults "given" . "path" "smbConnection.cron.resources")) -}}
|
||||
{{- include "paperless-ngx.resources" $merged -}}
|
||||
{{- end -}}
|
||||
@@ -14,13 +14,13 @@ spec:
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
securityContext:
|
||||
{{- toYaml .Values.smbConnection.cron.securityContext.pod | nindent 12 }}
|
||||
{{- include "paperless-ngx.cron.podSecurityContext" .Values.smbConnection.cron.securityContext | nindent 12 }}
|
||||
containers:
|
||||
- name: paperless-consume-cronjob
|
||||
image: "{{ .Values.paperless.busybox.image.repository }}:{{ .Values.paperless.busybox.image.tag }}"
|
||||
imagePullPolicy: IfNotPresent
|
||||
securityContext:
|
||||
{{- toYaml .Values.smbConnection.cron.securityContext.container | nindent 16 }}
|
||||
{{- include "paperless-ngx.cron.containerSecurityContext" .Values.smbConnection.cron.securityContext | nindent 16 }}
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
@@ -33,7 +33,7 @@ spec:
|
||||
mountPath: "/mnt/consume"
|
||||
readOnly: false
|
||||
resources:
|
||||
{{- include "paperless-ngx.resources" .Values.smbConnection.cron.resources | nindent 16 }}
|
||||
{{- include "paperless-ngx.cron.effectiveResources" .Values.smbConnection.cron.resources | nindent 16 }}
|
||||
restartPolicy: Never
|
||||
volumes:
|
||||
- name: smb-share
|
||||
|
||||
@@ -23,7 +23,7 @@ spec:
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
securityContext:
|
||||
{{- toYaml .Values.paperless.securityContext.pod | nindent 8 }}
|
||||
{{- include "paperless-ngx.podSecurityContext" .Values.paperless.securityContext | nindent 8 }}
|
||||
initContainers:
|
||||
# s6-overlay refuses to start unless /run is owned by the runtime uid,
|
||||
# but emptyDirs are always created root-owned. This minimal init
|
||||
@@ -36,7 +36,8 @@ spec:
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- chown {{ .Values.paperless.securityContext.pod.runAsUser }}:{{ .Values.paperless.securityContext.pod.runAsGroup }} /run
|
||||
{{- $podCtx := fromYaml (include "paperless-ngx.podSecurityContext" .Values.paperless.securityContext) }}
|
||||
- chown {{ $podCtx.runAsUser }}:{{ $podCtx.runAsGroup }} /run
|
||||
securityContext:
|
||||
runAsNonRoot: false
|
||||
runAsUser: 0
|
||||
@@ -64,7 +65,7 @@ spec:
|
||||
image: "ghcr.io/paperless-ngx/paperless-ngx:{{ .Chart.AppVersion }}"
|
||||
imagePullPolicy: IfNotPresent
|
||||
securityContext:
|
||||
{{- toYaml .Values.paperless.securityContext.container | nindent 12 }}
|
||||
{{- include "paperless-ngx.containerSecurityContext" .Values.paperless.securityContext | nindent 12 }}
|
||||
ports:
|
||||
- containerPort: 8000
|
||||
protocol: TCP
|
||||
@@ -229,13 +230,13 @@ spec:
|
||||
- mountPath: /run
|
||||
name: run
|
||||
resources:
|
||||
{{- include "paperless-ngx.resources" .Values.paperless.resources | nindent 12 }}
|
||||
{{- include "paperless-ngx.effectiveResources" .Values.paperless.resources | nindent 12 }}
|
||||
readinessProbe:
|
||||
{{- toYaml .Values.paperless.readinessProbe | nindent 12 }}
|
||||
{{- include "paperless-ngx.readinessProbe" .Values.paperless.readinessProbe | nindent 12 }}
|
||||
livenessProbe:
|
||||
{{- toYaml .Values.paperless.livenessProbe | nindent 12 }}
|
||||
{{- include "paperless-ngx.livenessProbe" .Values.paperless.livenessProbe | nindent 12 }}
|
||||
startupProbe:
|
||||
{{- toYaml .Values.paperless.startupProbe | nindent 12 }}
|
||||
{{- include "paperless-ngx.startupProbe" .Values.paperless.startupProbe | nindent 12 }}
|
||||
restartPolicy: Always
|
||||
volumes:
|
||||
- name: tmp
|
||||
|
||||
Reference in new issue
Block a user