Merge branch 'add-many-files-pvc' into 'main'

implement the useManyFiles-PVC option

See merge request !37

{{cookiecutter.project_slug}}/templates/{{cookiecutter.template_base_name}}/helpers/cronjobs/_spec.tpl

@@ -44,6 +44,16 @@ jobTemplate:
                 topologyKey: kubernetes.io/hostname
               {% raw %}{{- end }}{% endraw %}
         {%- endif %}
+        {%- raw %}
+        {{- if .Values.useManyFilesPVC }}
+        securityContext:
+          fsGroupChangePolicy: OnRootMismatch
+          seLinuxOptions:
+            type: spc_t
+        serviceAccountName: manyfilespvc
+        serviceAccount: manyfilespvc
+        {{- end }}
+        {%- endraw %}
         containers:
           - name: {%raw %}{{ .name | quote }}{% endraw %}
             {%- raw %}

{{cookiecutter.project_slug}}/templates/{{cookiecutter.template_base_name}}/helpers/deployment/_pod_template.tpl

@@ -34,6 +34,16 @@ metadata:
 
 spec:
   affinity: {{ "{{-" }} include "{{ cookiecutter.template_base_name }}.affinity" . | nindent 4 {{ "}}" }}
+  {%- raw %}
+  {{- if .Values.useManyFilesPVC }}
+  securityContext:
+    fsGroupChangePolicy: OnRootMismatch
+    seLinuxOptions:
+      type: spc_t
+  serviceAccountName: manyfilespvc
+  serviceAccount: manyfilespvc
+  {{- end }}
+  {%- endraw %}
   containers:
     - name: {% raw %}{{ .Values.baseName }}{% endraw %}
       {%- raw %}

{{cookiecutter.project_slug}}/values.yaml

@@ -208,6 +208,18 @@ cronJobs: {}
   #     failedJobsHistoryLimit: 1
 {%- endif %}
 
+{%- if cookiecutter.__include_deployment != "no" or cookiecutter.__include_cronjobs == "yes" or cookiecutter.__include_workers == "yes" %}
+
+# useManyFilesPVC is a boolean. If true, we expect that the cluster-admin added
+# a `manyfilespvc` serviceaccount. You should use this option when you expect
+# that a PVC mounted on the container contains houndreds of thousands of files,
+# it uses `seLinuxOptions: {type: spc_t}` in the `securityContext`.
+# 
+# See https://access.redhat.com/solutions/6221251 for information on how this
+# is implemented
+useManyFilesPVC: false
+{%- endif %}
+
 {%- if cookiecutter.__include_workers == "yes" %}
 
 # workers is a mapping from worker name to container options