Comments (3)
There is no requirement for the Cribl Worker Group chart to have a ClusterRole/ClusterRoleBinding at all. Cribl Stream does not need to have access to the Kubernetes API. This is maintained as to not break older versions of the chart. We will be removing it in a future release/new chart.
I would recommend setting the following in your values file:
rbac:
create: false
serviceAccount:
create: false
from helm-charts.
Check me @bdalpe but I think the product wants to be able to get the pod it's in using the CRIBL_K8S_POD
envvar we set in the chart. It uses that to let the leader know the name of the namespace, pod, and node the instance is in for Mappings.
from helm-charts.
Yeah, looks like setting rbac.create=false
is good enough to deploy without needing cluster-admin permissions.
Even if the leader uses the API to get information about the pods then the default local namespaced scoped permissions should work I would believe, at least from what I've been able to see as the workload does come up.
Unless it's intended to be getting resources from other namespaces or the cluster scope and just hasn't failed for me yet...I'm not too familiar with the Cribl architecture and operations so I'll let y'all correct me on that one.
from helm-charts.
Related Issues (20)
- Sign Releases
- Add emphemeral-storage limits
- Edge RBAC extraRules has incorrect yaml syntax
- Strategy implemented in wrong spec HOT 1
- podSecurityContext non-existent in logstream-leader chart
- securityContext not set on logstream-leader Pod
- resources config on logstream-leader chart too deep
- Custom .gitignore file
- Support `extraVolumes` for Cribl workergroups helm charts HOT 6
- Remove `:` in role & rolebinding names HOT 5
- Allow `get namespace` in Edge chart
- 404 link to Docs
- Make EKS Add-on ready HOT 2
- Separate logstream-leader service and service-internal annotations HOT 1
- Support for OpenShift Routes HOT 3
- Run as non-root, OpenShift support HOT 5
- Hardcoded transport `tcp` comms to the leader node HOT 5
- Cribl leader TLS value should be a list not a dictionary HOT 1
- Static PVC name leader-config-claim - can't deploy multiple Leaders in the same namespace HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from helm-charts.