Improve compatibility with Openshift (#1424)

charts/fission-all/templates/deployment.yaml

@@ -534,10 +534,8 @@ spec:
         ]
         ports:
         - containerPort: 4222
-          hostPort: 4222
           protocol: TCP
         - containerPort: 4223
-          hostPort: 4223
           protocol: TCP
         readinessProbe:
           httpGet:

charts/fission-all/templates/fluentbit.yaml

@@ -45,6 +45,10 @@ spec:
             - name: container-log
               mountPath: /var/log/
               readOnly: false
+{{- if .Values.logger.enableSecurityContext }}
+          securityContext:
+            privileged: true
+{{- end }}
       containers:
         - name: logger
 {{ if .Values.repository }}
@@ -68,6 +72,10 @@ spec:
             - name: docker-log
               mountPath: /var/lib/docker/containers
               readOnly: true
+{{- if .Values.logger.enableSecurityContext }}
+          securityContext:
+            privileged: true
+{{- end }}
         - name: fluentbit
 {{- if .Values.repository }}
           image: "{{ .Values.logger.fluentdImageRepository }}/{{ .Values.logger.fluentdImage }}:{{ .Values.logger.fluentdImageTag }}"
@@ -96,6 +104,10 @@ spec:
                   key: password
             - name: LOG_PATH
               value: /var/log/fission/*.log
+{{- if .Values.logger.enableSecurityContext }}
+          securityContext:
+            privileged: true
+{{- end }}
           volumeMounts:
             - name: container-log
               mountPath: /var/log/

charts/fission-all/values.yaml

@@ -57,6 +57,13 @@ logger:
   fluentdImageRepository: index.docker.io
   fluentdImage: fluent/fluent-bit
   fluentdImageTag: 1.0.4
+  
+  ## Fluent-bit writes/reads it’s own sqlite database to record a history of tracked
+  ## files and a state of offsets, this is very useful to resume a state if the ser-
+  ## vice is restarted. For Kubernetes environment with constraints like OpenShift,
+  ## the containers are limited to write hostPath volume. Hence, we have to enable
+  ## security context and set privileged to true.
+  enableSecurityContext: false
 
 ## Router config
 router: