Add option to configure seLinux and runAs policies #538
Conversation
AlbertoPimpo
requested review from
edsiper,
naseemkullah and
stevehipwell
as code owners
AlbertoPimpo
force-pushed
the
patch-1
branch
7 times, most recently
from
6a5ef04
to
6f256e1
Compare
|
Sorry for all the pushes but I had to fix the verification of the commit 😅 |
|
@stevehipwell @naseemkullah @edsiper could you please take a look? |
|
@AlbertoPimpo I'm not familiar enough with OpenShift to make a call on this change. FYI you need to rebase and bump your chart version. |
|
Maybe we need to ask to take a look this change @patrick-stephens ? |
AlbertoPimpo
force-pushed
the
patch-1
branch
2 times, most recently
from
6c8f1ae
to
23ef5c4
Compare
@stevehipwell done 👍 |
|
If it can help, in the PodSecurityPolicy you indeed allow to change the selinux context https://github.com/fluent/helm-charts/blob/main/charts/fluent-bit/templates/psp.yaml#L28 |
|
I would not be a fan of changing it from one hardcoded value to another, let's make it configurable with a default. |
@patrick-stephens I like the idea, maybe we should do the same for psp? I can take care of that. |
Signed-off-by: Alberto Pimpo <[email protected]>
AlbertoPimpo
force-pushed
the
patch-1
branch
from
23ef5c4
to
2ac83e3
Compare
|
@patrick-stephens sorry for taking so long, it's done now. Feel free to merge it. |
AlbertoPimpo
changed the title
|
@stevehipwell @naseemkullah @edsiper this is ready to be merged. |
EDIT: after discussions, we decided to make seLinux and runAs policies configurable instead of changing the default.
When creating a securityContextContraint for Openshift, the helm chart currently set the selinux strategy to
MustRunAs, but this might lead to permission errors if you are using selinux in the node and you want to mount an host folder with an HostPath.I think there is no reason for disallowing selinux context to be changed for the fluentbit deployment. Also, this is the same behavior used by red hat for their cluster logging operator that deploys fluentd.
https://github.com/openshift/cluster-logging-operator/blob/master/internal/auth/securitycontextconstraint.go#L46