RO file system #545
Comments
|
Hey @jimmi4u it looks like you're trying to make the pod more secure through a custom If you just want to make the root filesystem read only you might be able to make use of the extra volumes & mounts to add If you want to make further security improvements I'd suggest that you have 2 paths to follow for this; path 1 would be to look at the image details and speak to Atlassian to see which security settings are compatible with their image, path 2 would be to use a security monitoring tool such as Falco to see what the container is doing which would conflict with your desired security settings. If you choose to look further into this and have some findings which can be added to the Helm chart, such as adding an |
|
Hi @stevehipwell, thanks for your reply! Btw. the security settings used are the defaults. I played a bit with them because of that error. So with or without them the error still occurs. What is also interesting is that the helmrelease reconcilation is still in progress so this happens right at the beginning and the pod is going CrashLoopBackOff.... Edit: with default settings I get: |
|
@jimmi4u are you sure you've not changed any of the security context settings? The chart is tested before releasing so it definitely runs, although your cluster may be configured differently to Kind (it should be) but I would expect the chart to work in most cases. |
|
@stevehipwell there is nothing else, except my PostgresCluster. |
|
@jimmi4u could you confirm that you're not setting anything for |
|
@stevehipwell yep, there is no secrutiyContext! |
|
@jimmi4u what do you get as an output from FYI if this is a new deployment I'd suggest setting |
|
@stevehipwell I'm using flux with helm so I don't have helm installed. |
|
@jimmi4u that's not enough to go on, surely you can run |
|
yeah, you're right: thanks! |
|
and here again the error: |
|
@jimmi4u last questions; what Kubernetes version, distro and addons for CRI, CNI & CSI? |
|
k version --output=yaml uname -a: kube system with coredns, local-path-provisioner, metrics-server, traefik, Flannel, MetalLB 0.13, FluxCD2 and |
|
@jimmi4u I think it sounds like you've got the issue described in kubernetes-sigs/nfs-subdir-external-provisioner#173. |
|
@stevehipwell thanks for your help and for pointing me in the right direction. I realized, that I forgot to apply the pvc for confluence. Now I have it like this: and the helmrelease like this: but am getting the same error like in the beginning: when I unset the securityContext I'm getting the error as before... |
|
I looked into the values.yaml of the official atlassian datacenter and they have a: nfsPermissionFixer: I tried also other confluence repos on artifacthub with the same conclusion. |
|
@jimmi4u what does that flag do? If it's just a |
|
I also think it's a chown. How can I add it to the values. how can I also add an umask? |
|
This repo has nothing to do with the official Atlassian repo and predates it by a number of years (I did try to donate contribute my charts to them a number of times). The issue you mentioned above (kubernetes/examples#260) has an example of the init container you'd need, this is a limitation of the CSI driver you're using so you'll need to figure out exactly what implementation you need. To configure it with this chart you'd add a container spec to extraInitContainers:
- name: nfs-fix
image: alpine:3.16.2
securityContext:
runAsUser: 0
command: ["/bin/sh"]
args: ["-c", "chgrp 2002 /var/atlassian/application-data/confluence; chmod g+w /var/atlassian/application-data/confluence"]
volumeMounts:
- mountPath: /var/atlassian/application-data/confluence
name: confluence-server-data |
|
@stevehipwell you're awesome! thanks so much! |
|
@jimmi4u it depends on the name you're using for the Helm deployment, looking above I think you'd need to use FYI I assume you're setting the PVC you created externally in the chart values via |
|
Hi @stevehipwell, |
|
@jimmi4u just look at the deployment |
|
hi, ok I got it! I really checked everything, the nfs server setting, rights, mods, recreated pvcs, added new StorageClass... no luck... and here is my helmrelease: |
|
It looks like you're hitting this issue (there are other threads on Google which you might also want to explore). |
|
Try setting env:
- name: SET_PERMISSIONS
value: "true" |
|
@stevehipwell that did the trick! You're amazing! Thanks a lot! |
|
This is the community edition but I don't think you can get new licences anymore, paid or trial. |
|
hmm, very sad... |
|
You're welcome @jimmi4u, would you mind closing this issue? |
Hi,
I'm trying to run your chart via helm and am getting an error, no matter which chart version I choose:
here are my values:
need some help please!
Thanks,
jim
The text was updated successfully, but these errors were encountered: