defaultDeployment returns a default Deployment for the RustFS server
(namespace string, pvc corev1.PersistentVolumeClaim)
| 151 | |
| 152 | // defaultDeployment returns a default Deployment for the RustFS server |
| 153 | func defaultDeployment(namespace string, pvc corev1.PersistentVolumeClaim) appsv1.Deployment { |
| 154 | seccompProfile := &corev1.SeccompProfile{ |
| 155 | Type: corev1.SeccompProfileTypeRuntimeDefault, |
| 156 | } |
| 157 | |
| 158 | // RustFS runs as a non-root user and writes its data and logs to these |
| 159 | // subdirectories, which the init container creates and makes writable. |
| 160 | const ( |
| 161 | dataDir = "/data/rustfs" |
| 162 | logDir = "/logs/rustfs" |
| 163 | ) |
| 164 | |
| 165 | deployment := appsv1.Deployment{ |
| 166 | ObjectMeta: metav1.ObjectMeta{ |
| 167 | Name: "object-store", |
| 168 | Namespace: namespace, |
| 169 | }, |
| 170 | Spec: appsv1.DeploymentSpec{ |
| 171 | Replicas: ptr.To(int32(1)), |
| 172 | Selector: &metav1.LabelSelector{ |
| 173 | MatchLabels: map[string]string{"app": "object-store"}, |
| 174 | }, |
| 175 | Template: corev1.PodTemplateSpec{ |
| 176 | ObjectMeta: metav1.ObjectMeta{ |
| 177 | Labels: map[string]string{"app": "object-store"}, |
| 178 | }, |
| 179 | Spec: corev1.PodSpec{ |
| 180 | Volumes: []corev1.Volume{ |
| 181 | { |
| 182 | Name: "data", |
| 183 | VolumeSource: corev1.VolumeSource{ |
| 184 | PersistentVolumeClaim: &corev1.PersistentVolumeClaimVolumeSource{ |
| 185 | ClaimName: pvc.Name, |
| 186 | }, |
| 187 | }, |
| 188 | }, |
| 189 | { |
| 190 | Name: "logs", |
| 191 | VolumeSource: corev1.VolumeSource{ |
| 192 | EmptyDir: &corev1.EmptyDirVolumeSource{}, |
| 193 | }, |
| 194 | }, |
| 195 | }, |
| 196 | // RustFS runs as a non-root user but the PVC is root-owned, and |
| 197 | // a non-root init container cannot chown it on OpenShift. |
| 198 | // Instead the init creates a subdirectory it owns and makes it |
| 199 | // world-writable, which works as root (kind, cloud) or as the |
| 200 | // SCC-assigned UID (OpenShift). |
| 201 | InitContainers: []corev1.Container{ |
| 202 | { |
| 203 | Name: "init-permissions", |
| 204 | Image: busyboxImage, |
| 205 | Command: []string{ |
| 206 | "sh", "-c", |
| 207 | fmt.Sprintf("mkdir -p %[1]s %[2]s && chmod 0777 %[1]s %[2]s", dataDir, logDir), |
| 208 | }, |
| 209 | VolumeMounts: []corev1.VolumeMount{ |
| 210 | { |