Improve compatibility with Openshift (#1424)

charts/fission-all/templates/deployment.yaml

@@ -534,10 +534,8 @@ spec:
         ]
         ports:
         - containerPort: 4222
-          hostPort: 4222
           protocol: TCP
         - containerPort: 4223
-          hostPort: 4223
           protocol: TCP
         readinessProbe:
           httpGet:

charts/fission-all/templates/fluentbit.yaml

@@ -45,6 +45,10 @@ spec:
             - name: container-log
               mountPath: /var/log/
               readOnly: false
+{{- if .Values.logger.enableSecurityContext }}
+          securityContext:
+            privileged: true
+{{- end }}
       containers:
         - name: logger
 {{ if .Values.repository }}
@@ -68,6 +72,10 @@ spec:
             - name: docker-log
               mountPath: /var/lib/docker/containers
               readOnly: true
+{{- if .Values.logger.enableSecurityContext }}
+          securityContext:
+            privileged: true
+{{- end }}
         - name: fluentbit
 {{- if .Values.repository }}
           image: "{{ .Values.logger.fluentdImageRepository }}/{{ .Values.logger.fluentdImage }}:{{ .Values.logger.fluentdImageTag }}"
@@ -96,6 +104,10 @@ spec:
                   key: password
             - name: LOG_PATH
               value: /var/log/fission/*.log
+{{- if .Values.logger.enableSecurityContext }}
+          securityContext:
+            privileged: true
+{{- end }}
           volumeMounts:
             - name: container-log
               mountPath: /var/log/

charts/fission-all/values.yaml

@@ -57,6 +57,13 @@ logger:
   fluentdImageRepository: index.docker.io
   fluentdImage: fluent/fluent-bit
   fluentdImageTag: 1.0.4
+  
+  ## Fluent-bit writes/reads it’s own sqlite database to record a history of tracked
+  ## files and a state of offsets, this is very useful to resume a state if the ser-
+  ## vice is restarted. For Kubernetes environment with constraints like OpenShift,
+  ## the containers are limited to write hostPath volume. Hence, we have to enable
+  ## security context and set privileged to true.
+  enableSecurityContext: false
 
 ## Router config
 router:

hack/release-build.sh

@@ -198,8 +198,8 @@ build_charts() {
     do
     # https://github.com/kubernetes/helm/issues/1732
     helm init --client-only
-	helm package -u $c/
+	  helm package -u $c/
-	mv *.tgz $BUILDDIR/charts/
+	  mv *.tgz $BUILDDIR/charts/
     done
     popd
 }
@@ -226,6 +226,8 @@ build_yamls() {
         helm template ${c} -n ${releaseName} --namespace fission --set analytics=false,analyticsNonHelmInstall=true,serviceType=NodePort,routerServiceType=NodePort > ${c}-${version}-minikube.yaml
         # for environments that support LoadBalancer
         helm template ${c} -n ${releaseName} --namespace fission --set analytics=false,analyticsNonHelmInstall=true > ${c}-${version}.yaml
+        # for OpenShift
+        helm template ${c} -n ${releaseName} --namespace fission --set analytics=false,analyticsNonHelmInstall=true,logger.enableSecurityContext=true,prometheus.enabled=false > ${c}-${version}-openshift.yaml
 
         # copy yaml files to build directory
         mv *.yaml ${BUILDDIR}/yamls/