diff --git a/charts/fission-all/templates/fluentbit/fluentbit.yaml b/charts/fission-all/templates/fluentbit/fluentbit.yaml index f54a400f..9718fe97 100644 --- a/charts/fission-all/templates/fluentbit/fluentbit.yaml +++ b/charts/fission-all/templates/fluentbit/fluentbit.yaml @@ -128,10 +128,8 @@ spec: - name: docker-log mountPath: /var/lib/docker/containers readOnly: true -{{- if .Values.logger.enableSecurityContext }} securityContext: - privileged: true -{{- end }} + {{- toYaml .Values.logger.securityContext | nindent 12 }} - name: fluentbit {{- if .Values.repository }} image: "{{ .Values.logger.fluentdImageRepository }}/{{ .Values.logger.fluentdImage }}:{{ .Values.logger.fluentdImageTag }}" diff --git a/charts/fission-all/values.yaml b/charts/fission-all/values.yaml index f0b668f8..8225725f 100644 --- a/charts/fission-all/values.yaml +++ b/charts/fission-all/values.yaml @@ -620,11 +620,22 @@ logger: ## Fluent-bit writes/reads it’s own sqlite database to record a history of tracked ## files and a state of offsets, this is very useful to resume a state if the ser- - ## vice is restarted. For Kubernetes environment with constraints like OpenShift, + ## vice is restarted. + ## + ## For Kubernetes environment with constraints like OpenShift, ## the containers are limited to write hostPath volume. Hence, we have to enable ## security context and set privileged to true. ## - enableSecurityContext: false + ## The user ID in runAsUser should have access to the `/var/log` and + ## `/var/lib/docker/containers` directories on your host. + ## On many hosts, this user might be root ,i.e., `runAsUser: 0`. + ## Although it is recommended not to use root user for security reasons. + ## + ## The `/var/log` and `/var/lib/docker/containers` directories on host are mounted + ## to logger container with volumeType `HostPath`. + securityContext: {} + # privileged: true + # runAsUser: 0 ## Enable PodSecurityPolicies to allow privileged container ## Only required in some clusters and when enableSecurityContext is true