Skip to content

Fix Neo4j backup/restore runAsUser and Neo4j RestoreSession shape - #1137

Merged
ArnobKumarSaha merged 2 commits into
masterfrom
arnob-neo4j-uid
Aug 13, 2026
Merged

Fix Neo4j backup/restore runAsUser and Neo4j RestoreSession shape#1137
ArnobKumarSaha merged 2 commits into
masterfrom
arnob-neo4j-uid

Conversation

@ArnobKumarSaha

@ArnobKumarSaha ArnobKumarSaha commented Aug 13, 2026

Copy link
Copy Markdown
Member

Neo4j BackupConfiguration

runAsUser was 999 in both security contexts built by the neo4j editor; Neo4j runs as 7474.

RestoreSession runAsUser

The uid lived in a 9-entry map in corekubestashcom-restoresession-editor-options/ui/functions.js,
which was out of sync with the real per-DB defaults in each kubedbcom-<db>-editor-options
container.securityContext helper. For any kind missing from that map — Neo4j, Cassandra, Kafka,
Solr, ClickHouse, DB2, … — spec.addon.jobTemplate.securityContext stayed empty and the whole
jobTemplate + containerRuntimeSettings block was dropped from the rendered RestoreSession.

The default now comes from a chart helper mirroring those 29 charts; the JS only supplies the
OpenShift sa.scc.uid-range override. RabbitMQ is intentionally absent — its options chart has no
container.securityContext helper, so it keeps today's behaviour.

One correction this brings along: ZooKeeper 999 → 1000, matching its options chart. Postgres stays
at 70 as before, even though kubedbcom-postgres-editor-options/templates/_helpers.tpl defaults to
999 outside timescaledb-* and old N.M versions.

Neo4j RestoreSession shape

For kind: Neo4j the restore job now also gets the target's data PVC and the seed pod parameter,
both derived from spec.target.name:

  addon:
    name: neo4j-addon
    tasks:
      - name: logical-backup-restore
        params: {seedServerName: "restored-neo4j-0"}
    jobTemplate:
      spec:
        volumes:
          - name: data
            persistentVolumeClaim:
              claimName: data-restored-neo4j-0
        volumeMounts:
          - mountPath: /data
            name: data
            subPath: data
        nodeSelector:
          kubernetes.io/os: linux
        securityContext:
          runAsUser: 7474
          runAsGroup: 0

setNeo4jParams() fills the parameter in on initMetadata and on target-name change; it stays
editable in the "Additional Parameters" textarea.

Verified

helm template of corekubestashcom-restoresession-editor-options:

  • kind=Neo4j → volume/mount, runAsUser: 7474, params as a YAML flow map
  • kind=MongoDB → 999, no volumes
  • explicit spec.addon.jobTemplate.securityContext still wins
  • kind=RabbitMQ and empty target → no jobTemplate block, as before

go build ./... and helm lint clean.

Neo4j runs as uid 7474, not 999, so the BackupConfiguration built by the
neo4j editor used the wrong security context.

For restore, move the per-kind runAsUser out of the wizard JS into a chart
helper carrying the same defaults as container.securityContext of each
kubedbcom-<db>-editor-options chart. The JS map covered only 9 kinds, so
every other kind (Neo4j included) rendered no securityContext at all. The
OpenShift uid-range annotation still overrides it.

A Neo4j restore also needs the target's data PVC mounted at /data and the
seedServerName task parameter, both derived from the target name.

Signed-off-by: Arnob Kumar Saha <arnob@appscode.com>
Matches what the restore wizard used before this branch.

Signed-off-by: Arnob Kumar Saha <arnob@appscode.com>
@ArnobKumarSaha
ArnobKumarSaha merged commit e8ef3af into master Aug 13, 2026
4 checks passed
@ArnobKumarSaha
ArnobKumarSaha deleted the arnob-neo4j-uid branch August 13, 2026 03:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant