-
Notifications
You must be signed in to change notification settings - Fork 454
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Change Openshift scc seLinuxContext to RunAsAny #538
base: main
Are you sure you want to change the base?
Conversation
6a5ef04
to
6f256e1
Compare
Sorry for all the pushes but I had to fix the verification of the commit 😅 |
@stevehipwell @naseemkullah @edsiper could you please take a look? |
@AlbertoPimpo I'm not familiar enough with OpenShift to make a call on this change. FYI you need to rebase and bump your chart version. |
Maybe we need to ask to take a look this change @patrick-stephens ? |
Signed-off-by: Alberto Pimpo <[email protected]>
@stevehipwell done 👍 |
If it can help, in the PodSecurityPolicy you indeed allow to change the selinux context https://github.com/fluent/helm-charts/blob/main/charts/fluent-bit/templates/psp.yaml#L28 |
I would not be a fan of changing it from one hardcoded value to another, let's make it configurable with a default. |
@patrick-stephens I like the idea, maybe we should do the same for psp? I can take care of that. |
When creating a securityContextContraint for Openshift, the helm chart currently set the selinux strategy to
MustRunAs
, but this might lead to permission errors if you are using selinux in the node and you want to mount an host folder with an HostPath.I think there is no reason for disallowing selinux context to be changed for the fluentbit deployment. Also, this is the same behavior used by red hat for their cluster logging operator that deploys fluentd.
https://github.com/openshift/cluster-logging-operator/blob/master/internal/auth/securitycontextconstraint.go#L46