search

DependencyTrack / helm-charts

Helm Charts for Dependency-Track
https://dependencytrack.org
Apache License 2.0
13 stars 14 forks source link

Permission issue when volume persistence is true on EKS #79

Open Michenux opened 1 month ago

Michenux commented 1 month ago

Hi,

I have enabled the volume persistence in values.yml like this : 

  persistentVolume:
    enabled: true
    size: 8Gi
    className: ebs-sc-gp3

My storage class has the following parameters : 

parameters:
  csi.storage.k8s.io/fstype: ext4
  encrypted: 'true'
  kmsKeyId: ********
  type: gp3
reclaimPolicy: Delete
allowVolumeExpansion: true
volumeBindingMode: WaitForFirstConsumer

And i get the following error : 

12:55:27,523 |-ERROR in ch.qos.logback.core.rolling.RollingFileAppender[EMBEDDED_SERVER] - openFile(/data//.dependency-track/server.log,true) call failed. java.io.FileNotFoundException: /data/.dependency-track/server.log (No such file or directory)
    at java.io.FileNotFoundException: /data/.dependency-track/server.log (No such file or directory)
    at  at java.base/java.io.FileOutputStream.open0(Native Method)
    at  at java.base/java.io.FileOutputStream.open(Unknown Source)
    at  at java.base/java.io.FileOutputStream.<init>(Unknown Source)
    at  at ch.qos.logback.core.recovery.ResilientFileOutputStream.<init>(ResilientFileOutputStream.java:26)
    at  at ch.qos.logback.core.FileAppender.openFile(FileAppender.java:204)
    at  at ch.qos.logback.core.FileAppender.start(FileAppender.java:127)
    at  at ch.qos.logback.core.rolling.RollingFileAppender.start(RollingFileAppender.java:100)
    at  at ch.qos.logback.core.joran.action.AppenderAction.end(AppenderAction.java:90)
    at  at ch.qos.logback.core.joran.spi.Interpreter.callEndAction(Interpreter.java:309)
    at  at ch.qos.logback.core.joran.spi.Interpreter.endElement(Interpreter.java:193)
    at  at ch.qos.logback.core.joran.spi.Interpreter.endElement(Interpreter.java:179)
    at  at ch.qos.logback.core.joran.spi.EventPlayer.play(EventPlayer.java:62)

The issue is that the process can not write inside the /data directory.

I fixed the problem by manually adding in the security context of the statefulset: 

securityContext:
    runAsUser: 1000
    runAsGroup: 1000
    fsGroup: 1000

Now, the pod starts correctly.