Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Permissions on /var/log + /var/log/containers doesn't allow non-root Daemonset to gather logs #9630

Closed
zviratko opened this issue Nov 4, 2024 · 4 comments · Fixed by #9634
Assignees

Comments

@zviratko
Copy link

zviratko commented Nov 4, 2024

Bug Report

Permissions (700) on /var/log and /var/log/containers don't allow non-root Daemonset to tail logs

I believe relaxing permissions to rwx--x--x is better than running logging containers as root...
... unless there's a completely different and better way to do this?

Description

See open-telemetry/opentelemetry-collector-contrib#33083 (comment)

Environment

  • Talos version: 1.8.2
  • Kubernetes version: 1.31.2
  • Platform: amd64
@frezbo
Copy link
Member

frezbo commented Nov 4, 2024

I believe adding this fixes it:

    capabilities:
      add:
        - DAC_READ_SEARCH

@zviratko
Copy link
Author

zviratko commented Nov 4, 2024

That didn't work for me (nor for the original issue creator)

@smira
Copy link
Member

smira commented Nov 4, 2024

I think the whole concept of running a DaemonSet which mounts something from the host is a bad design decision (in Kubernetes/CRI), but there is no better way today.

So the API becomes the host filesystem, and permissions on the log files and directories become the API of the operating system towards log collection daemons.

I think given all of that, the only option is to make permissions match some sane defaults.

@frezbo
Copy link
Member

frezbo commented Nov 4, 2024

That didn't work for me (nor for the original issue creator)

ahh okay, at least it allowed to read files owned as nobody

@smira smira self-assigned this Nov 4, 2024
smira added a commit to smira/talos that referenced this issue Nov 13, 2024
Fixes siderolabs#9630

Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>
(cherry picked from commit 7f3aaa2)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants