From e3f5d51c6cc63eb082c6ff3341292543dd825ca0 Mon Sep 17 00:00:00 2001
From: Kjeld Schouten-Lebbing <kjeld@schouten-lebbing.nl>
Date: Tue, 24 Aug 2021 12:28:50 +0200
Subject: [PATCH] Fixing privileged and supplementalgroup (#803)

* Enable permissive when using deviceList

* Cleanup the renovate bump

* restructure some overrides

* remove custom psc

* append subgroups based on gpu/device settings

* Fixing a bugs and adding some annotations

* fixing some bugs and add ingressList

* slight different var definition

* fix again

* bump minor version as features are added
---
 .github/workflows/renovate-bump.yaml          |  9 +--
 charts/library/common/Chart.yaml              |  2 +-
 charts/library/common/templates/_pvc.tpl      | 18 ------
 .../common/templates/lib/chart/_values.tpl    | 62 +++++++++++++++++++
 charts/library/common/values.yaml             |  6 ++
 5 files changed, 70 insertions(+), 27 deletions(-)

diff --git a/.github/workflows/renovate-bump.yaml b/.github/workflows/renovate-bump.yaml
index bd2926c9b69..40483e0e4d8 100644
--- a/.github/workflows/renovate-bump.yaml
+++ b/.github/workflows/renovate-bump.yaml
@@ -38,9 +38,6 @@ jobs:
             changed:
             - 'charts/stable/**'
             - 'charts/incubator/**'
-            - 'charts/develop/**'
-            - 'charts/deprecated/**'
-            - 'charts/non-free/**'
             - 'charts/library/**'
       - name: Filter filter-output
         run: echo '${{ toJson(steps.filter.outputs) }}' > changes.json
@@ -57,14 +54,10 @@ jobs:
                 train="stable"
               elif test -f "./charts/incubator/${chart}/Chart.yaml"; then
                 train="incubator"
-              elif test -f "./charts/deprecated/${chart}/Chart.yaml"; then
-                train="deprecated"
-              elif test -f "./charts/non-free/${chart}/Chart.yaml"; then
-                train="non-free"
               elif test -f "./charts/library/${chart}/Chart.yaml"; then
                 train="library"
               else
-                train="develop"
+                train="incubator"
               fi
               echo "Comparing versions for ${train}/${chart}"
               master=$(pybump get --file ./master/charts/${train}/${chart}/Chart.yaml)
diff --git a/charts/library/common/Chart.yaml b/charts/library/common/Chart.yaml
index 5587bae64a4..fd48f5a9f7c 100644
--- a/charts/library/common/Chart.yaml
+++ b/charts/library/common/Chart.yaml
@@ -18,4 +18,4 @@ maintainers:
 name: common
 sources: null
 type: library
-version: 6.8.4
+version: 6.9.0
diff --git a/charts/library/common/templates/_pvc.tpl b/charts/library/common/templates/_pvc.tpl
index 76b0f0b56f7..608b4de6528 100644
--- a/charts/library/common/templates/_pvc.tpl
+++ b/charts/library/common/templates/_pvc.tpl
@@ -2,24 +2,6 @@
 Renders the Persistent Volume Claim objects required by the chart.
 */}}
 {{- define "common.pvc" -}}
-  {{- $perDict := dict }}
-  {{- range $index, $item := .Values.persistenceList -}}
-    {{- $name := ( printf "list-%s" ( $index | toString ) ) }}
-    {{- if $item.name }}
-      {{- $name = $item.name }}
-    {{- end }}
-    {{- $_ := set $perDict $name $item }}
-  {{- end }}
-  {{- range $index, $item := .Values.deviceList -}}
-    {{- $name := ( printf "device-%s" ( $index | toString ) ) }}
-    {{- if $item.name }}
-      {{- $name = $item.name }}
-    {{- end }}
-    {{- $_ := set $perDict $name $item }}
-  {{- end }}
-  {{- $per := merge .Values.persistence $perDict }}
-  {{- $_ := set .Values "persistence" (deepCopy $per) -}}
-
   {{- /* Generate pvc as required */ -}}
   {{- range $index, $PVC := .Values.persistence }}
     {{- if and $PVC.enabled (eq (default "pvc" $PVC.type) "pvc") (not $PVC.existingClaim) -}}
diff --git a/charts/library/common/templates/lib/chart/_values.tpl b/charts/library/common/templates/lib/chart/_values.tpl
index d3c8413c8f7..bd6606461b8 100644
--- a/charts/library/common/templates/lib/chart/_values.tpl
+++ b/charts/library/common/templates/lib/chart/_values.tpl
@@ -6,4 +6,66 @@
     {{- $mergedValues := mustMergeOverwrite $defaultValues $userValues -}}
     {{- $_ := set . "Values" (deepCopy $mergedValues) -}}
   {{- end -}}
+
+  {{/* merge persistenceList with Persitence */}}
+  {{- $perDict := dict }}
+  {{- range $index, $item := .Values.persistenceList -}}
+    {{- $name := ( printf "list-%s" ( $index | toString ) ) }}
+    {{- if $item.name }}
+      {{- $name = $item.name }}
+    {{- end }}
+    {{- $_ := set $perDict $name $item }}
+  {{- end }}
+
+  {{/* merge deviceList with Persitence */}}
+  {{- range $index, $item := .Values.deviceList -}}
+    {{- $name := ( printf "device-%s" ( $index | toString ) ) }}
+    {{- if $item.name }}
+      {{- $name = $item.name }}
+    {{- end }}
+    {{- $_ := set $perDict $name $item }}
+  {{- end }}
+  {{- $per := merge .Values.persistence $perDict }}
+  {{- $_ := set .Values "persistence" (deepCopy $per) -}}
+
+
+  {{/* merge ingressList with ingress */}}
+  {{- $ingDict := dict }}
+  {{- range $index, $item := .Values.ingressList -}}
+    {{- $name := ( printf "list-%s" ( $index | toString ) ) }}
+    {{- if $item.name }}
+      {{- $name = $item.name }}
+    {{- end }}
+    {{- $_ := set $ingDict $name $item }}
+  {{- end }}
+  {{- $ing := merge .Values.ingress $ingDict }}
+  {{- $_ := set .Values "ingress" (deepCopy $ing) -}}
+
+  {{/* Enable privileged securitycontext when deviceList is used */}}
+  {{- if .Values.securityContext.privileged }}
+  {{- else if .Values.deviceList }}
+  {{- $_ := set .Values.securityContext "privileged" true -}}
+  {{- end }}
+
+  {{/* save supplementalgroups to placeholder variable */}}
+  {{- $supGroups := list }}
+  {{ if .Values.podSecurityContext.supplementalgroups }}
+  {{- $supGroups = .Values.podSecurityContext.supplementalgroups }}
+  {{- end }}
+
+  {{/* Append requered groups to supplementalgroups when deviceList is used */}}
+  {{- if .Values.deviceList}}
+  {{- $devGroups := list 5 20 24 }}
+  {{- $supGroups := list ( concat $supGroups $devGroups ) }}
+  {{- end }}
+
+  {{/* Append requered groups to supplementalgroups when scaleGPU is used */}}
+  {{- if .Values.scaleGPU }}
+  {{- $gpuGroups := list 44 107 }}
+  {{- $supGroups := list ( concat $supGroups $gpuGroups ) }}
+  {{- end }}
+
+  {{/* write appended supplementalgroups to .Values */}}
+  {{- $_ := set .Values.podSecurityContext "supplementalgroups" $supGroups -}}
+
 {{- end -}}
diff --git a/charts/library/common/values.yaml b/charts/library/common/values.yaml
index fe13cf2c5c3..9ab999d23e7 100644
--- a/charts/library/common/values.yaml
+++ b/charts/library/common/values.yaml
@@ -266,6 +266,12 @@ service:
         # [[ref]](https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport)
         nodePort:
 
+
+# -- Configure ingressList for the chart here.
+# Additional items can be added by adding a items similar to ingress
+# @default -- []
+ingressList: []
+
 # -- Configure the ingresses for the chart here.
 # Additional ingresses can be added by adding a dictionary key similar to the 'main' ingress.
 # @default -- See below