mirror of
https://github.com/BerriAI/litellm.git
synced 2026-09-13 23:11:40 +00:00
97ec0470bf
The litellm-helm proxy Deployment renders a pod-level securityContext from .Values.podSecurityContext, but the Prisma migration Job rendered only the container-level securityContext from .Values.securityContext. Clusters that enforce pod-level admission policies (OPA Gatekeeper K8sPSPAllowedUsers, or a PSP-style fsGroup MustRunAs rule) therefore admitted the Deployment and denied the Job, which blocks install and upgrade because the Job runs as an ArgoCD PreSync or Helm pre-install/pre-upgrade hook. The Job now renders the same pod-level securityContext the Deployment does. Charts that leave podSecurityContext unset render an empty securityContext, matching what the Deployment already emitted, so default installs are unchanged. Resolves LIT-4928
292 lines
7.9 KiB
YAML
292 lines
7.9 KiB
YAML
suite: test migrations job
|
|
templates:
|
|
- migrations-job.yaml
|
|
tests:
|
|
- it: should work with envVars
|
|
template: migrations-job.yaml
|
|
set:
|
|
envVars:
|
|
TEST_ENV_VAR: "test_value"
|
|
ANOTHER_VAR: "another_value"
|
|
migrationJob:
|
|
enabled: true
|
|
asserts:
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: TEST_ENV_VAR
|
|
value: "test_value"
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: ANOTHER_VAR
|
|
value: "another_value"
|
|
|
|
- it: should work with extraEnvVars
|
|
template: migrations-job.yaml
|
|
set:
|
|
extraEnvVars:
|
|
- name: EXTRA_ENV_VAR
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.labels['env']
|
|
- name: SIMPLE_EXTRA_VAR
|
|
value: "simple_value"
|
|
migrationJob:
|
|
enabled: true
|
|
asserts:
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: EXTRA_ENV_VAR
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.labels['env']
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: SIMPLE_EXTRA_VAR
|
|
value: "simple_value"
|
|
|
|
- it: should work with both envVars and extraEnvVars
|
|
template: migrations-job.yaml
|
|
set:
|
|
envVars:
|
|
ENV_VAR: "env_var_value"
|
|
extraEnvVars:
|
|
- name: EXTRA_ENV_VAR
|
|
value: "extra_env_var_value"
|
|
migrationJob:
|
|
enabled: true
|
|
asserts:
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: ENV_VAR
|
|
value: "env_var_value"
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: EXTRA_ENV_VAR
|
|
value: "extra_env_var_value"
|
|
|
|
- it: should not render when migrations job is disabled
|
|
template: migrations-job.yaml
|
|
set:
|
|
migrationJob:
|
|
enabled: false
|
|
asserts:
|
|
- hasDocuments:
|
|
count: 0
|
|
|
|
- it: should still include default env vars
|
|
template: migrations-job.yaml
|
|
set:
|
|
envVars:
|
|
CUSTOM_VAR: "custom_value"
|
|
migrationJob:
|
|
enabled: true
|
|
db:
|
|
useExisting: true
|
|
endpoint: "test-db"
|
|
database: "testdb"
|
|
url: "postgresql://user:pass@test-db:5432/testdb"
|
|
secret:
|
|
name: "test-secret"
|
|
usernameKey: "username"
|
|
passwordKey: "password"
|
|
asserts:
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: DISABLE_SCHEMA_UPDATE
|
|
value: "false"
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: DATABASE_HOST
|
|
value: "test-db"
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: CUSTOM_VAR
|
|
value: "custom_value"
|
|
|
|
- it: should not include DATABASE_URL when deployStandalone is false
|
|
template: migrations-job.yaml
|
|
set:
|
|
migrationJob:
|
|
enabled: true
|
|
db:
|
|
deployStandalone: false
|
|
useExisting: false
|
|
asserts:
|
|
- notContains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: DATABASE_URL
|
|
|
|
- it: should use default service account for helm hooks when serviceAccount.create is true
|
|
template: migrations-job.yaml
|
|
set:
|
|
migrationJob:
|
|
enabled: true
|
|
hooks:
|
|
helm:
|
|
enabled: true
|
|
serviceAccount:
|
|
create: true
|
|
asserts:
|
|
- equal:
|
|
path: spec.template.spec.serviceAccountName
|
|
value: default
|
|
|
|
- it: should use migrationJob.serviceAccountName override for helm hooks when serviceAccount.create is true
|
|
template: migrations-job.yaml
|
|
set:
|
|
migrationJob:
|
|
enabled: true
|
|
serviceAccountName: migration-sa
|
|
hooks:
|
|
helm:
|
|
enabled: true
|
|
serviceAccount:
|
|
create: true
|
|
asserts:
|
|
- equal:
|
|
path: spec.template.spec.serviceAccountName
|
|
value: migration-sa
|
|
|
|
- it: should use chart service account when helm hooks are disabled
|
|
template: migrations-job.yaml
|
|
set:
|
|
migrationJob:
|
|
enabled: true
|
|
hooks:
|
|
helm:
|
|
enabled: false
|
|
serviceAccount:
|
|
create: true
|
|
name: my-custom-sa
|
|
asserts:
|
|
- equal:
|
|
path: spec.template.spec.serviceAccountName
|
|
value: my-custom-sa
|
|
|
|
- it: should use pre-existing service account when helm hooks are enabled but serviceAccount.create is false
|
|
template: migrations-job.yaml
|
|
set:
|
|
migrationJob:
|
|
enabled: true
|
|
hooks:
|
|
helm:
|
|
enabled: true
|
|
serviceAccount:
|
|
create: false
|
|
name: pre-existing-sa
|
|
asserts:
|
|
- equal:
|
|
path: spec.template.spec.serviceAccountName
|
|
value: pre-existing-sa
|
|
- it: should work with extraInitContainers
|
|
template: migrations-job.yaml
|
|
set:
|
|
migrationJob:
|
|
enabled: true
|
|
extraInitContainers:
|
|
- name: init-test
|
|
image: busybox:latest
|
|
command: ["echo", "hello"]
|
|
asserts:
|
|
- contains:
|
|
path: spec.template.spec.initContainers
|
|
content:
|
|
name: init-test
|
|
image: busybox:latest
|
|
command: ["echo", "hello"]
|
|
- it: should support tpl in extraInitContainers
|
|
template: migrations-job.yaml
|
|
set:
|
|
image:
|
|
repository: ghcr.io/berriai/litellm-database
|
|
tag: test
|
|
migrationJob:
|
|
enabled: true
|
|
extraInitContainers:
|
|
- name: init-tpl
|
|
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
|
|
command: ["echo", "hello"]
|
|
asserts:
|
|
- contains:
|
|
path: spec.template.spec.initContainers
|
|
content:
|
|
name: init-tpl
|
|
image: "ghcr.io/berriai/litellm-database:test"
|
|
command: ["echo", "hello"]
|
|
- it: should work with extraContainers
|
|
template: migrations-job.yaml
|
|
set:
|
|
migrationJob:
|
|
enabled: true
|
|
extraContainers:
|
|
- name: sidecar
|
|
image: busybox:latest
|
|
asserts:
|
|
- contains:
|
|
path: spec.template.spec.containers
|
|
content:
|
|
name: sidecar
|
|
image: busybox:latest
|
|
- it: should support tpl in extraContainers
|
|
template: migrations-job.yaml
|
|
set:
|
|
image:
|
|
repository: ghcr.io/berriai/litellm-database
|
|
tag: test
|
|
migrationJob:
|
|
enabled: true
|
|
extraContainers:
|
|
- name: sidecar-tpl
|
|
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
|
|
asserts:
|
|
- contains:
|
|
path: spec.template.spec.containers
|
|
content:
|
|
name: sidecar-tpl
|
|
image: "ghcr.io/berriai/litellm-database:test"
|
|
- it: should render the pod-level securityContext from podSecurityContext
|
|
template: migrations-job.yaml
|
|
set:
|
|
migrationJob:
|
|
enabled: true
|
|
podSecurityContext:
|
|
fsGroup: 10000
|
|
runAsUser: 10000
|
|
runAsNonRoot: true
|
|
asserts:
|
|
- equal:
|
|
path: spec.template.spec.securityContext
|
|
value:
|
|
fsGroup: 10000
|
|
runAsUser: 10000
|
|
runAsNonRoot: true
|
|
- it: should keep the pod-level and container-level securityContext separate
|
|
template: migrations-job.yaml
|
|
set:
|
|
migrationJob:
|
|
enabled: true
|
|
podSecurityContext:
|
|
fsGroup: 10000
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
asserts:
|
|
- equal:
|
|
path: spec.template.spec.securityContext
|
|
value:
|
|
fsGroup: 10000
|
|
- equal:
|
|
path: spec.template.spec.containers[0].securityContext
|
|
value:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|