Run as non-root, OpenShift support about helm-charts HOT 5 OPEN

@kenmoini this PR might be of interest to you: #166 In fact, it was created specifically for dealing with a customer deploying the Leader on OpenShift.

The second item is that setting the CRIBL_VOLUME_DIR environment variable to a PVC that is writable by the UID, this removes any need for writing to /opt/cribl

NB: There's no reason for running any Cribl container as privileged.

from helm-charts.

@bdalpe Ok that is excellent and good to know - I've figured out a way to deploy to OpenShift with a namespaced user who is only admin of the cribl-stream namespace, without any additional RBAC. Namely just need to disable creating the RBAC and set the CRIBL_VOLUME_DIR env var:

helm install ls-leader cribl/logstream-leader \
  --set "config.groups={pcilogs,system-metrics}" \
  --set config.token="ABCDEF01-1234-5678-ABCD-ABCDEF012345" \
  --set config.adminPassword="adminPasswordHere" \
  --set config.license="<license key>" \ # or delete for demo
  -n cribl-stream

helm install ls-wg-pci cribl/logstream-workergroup \
  --set config.host="ls-leader-internal" \
  --set config.tag="pcilogs" \
  --set config.token="ABCDEF01-1234-5678-ABCD-ABCDEF012345" \
  --set rbac.create="false" \
  --set env.CRIBL_VOLUME_DIR=/tmp/cribl \
  --set service.annotations."metallb\.universe\.tf/address-pool=lab-pool" \
  -n cribl-stream

helm install ls-wg-system-metrics cribl/logstream-workergroup \
  --set config.host="ls-leader-internal" \
  --set config.tag="system-metrics" \
  --set config.token="ABCDEF01-1234-5678-ABCD-ABCDEF012345" \
  --set rbac.create="false" \
  --set env.CRIBL_VOLUME_DIR=/tmp/cribl \
  --set service.annotations."metallb\.universe\.tf/address-pool=lab-pool" \
  -n cribl-stream

So since it works with a random UID/GID like how OpenShift deploys by default, I think the best solution would just to be that we add some additional documentation around the value modifications needed to deploy to OpenShift - whatcha think?

from helm-charts.

As of OpenShift 4.14 it seems pod security admission is in an enforced mode. This causes all pods to define their scc. Which permissions should the SCC have to run cribl as non-root? We also allowed the namespace to run from the GUID range defined in the pod, and allowed access to our storage class, however the pods still fail to start.

from helm-charts.

@wa77z do you have any logs or events from OpenShift showing the reason for the pod failing to start?

from helm-charts.

@wa77z do you have any logs or events from OpenShift showing the reason for the pod failing to start?

Error creating: pods "cribl-edge-" is forbidden: unable to validate against any security context constraint

from helm-charts.