Run Istio Ingressgateway pod as root

cloudfoundry / cf-for-k8s

The open source deployment manifest for Cloud Foundry on Kubernetes

Apache License 2.0

300 stars 115 forks source link

Run Istio Ingressgateway pod as root #521

Closed mike1808 closed 3 years ago

mike1808 commented 3 years ago

WHAT is this change about?

We need to run Ingressgateway as root to allow fluent-bit sidecar to access Docker container logs as only root user can view them.

It's required for cf logs command to show access logs of the app.

#175210582

Closes #520

Does this PR introduce a change to `config/values.yml`?

Acceptance Steps

cf logs <app_name> shows the access logs of the app

Tag your pair, your PM, and/or team

@cloudfoundry/cf-for-k8s-networking

cf-gitbot commented 3 years ago

We have created an issue in Pivotal Tracker to manage this:

https://www.pivotaltracker.com/story/show/175211287

The labels on this github issue will be updated when the story is started.

cf-rel-int-status-bot commented 3 years ago

Hello friend, it looks like your pull request has failed one or more of our checks. Please take a look! :eyes:

cf-rel-int-status-bot commented 3 years ago

Hello friend, it looks like your pull request has failed one or more of our checks. Please take a look! :eyes:

davewalter commented 3 years ago

@mike1808 We think that this commit is also causing downtime due to the istio-ingressgateway DaemonSet being updated. While the PR checks didn't fail, we are seeing evidence of downtime roughly 30 seconds after the DaemonSet has finished updating (according to kapp). Is this something you would expect? Do you think it would make sense for our upgrade testing to wait for a minute after the kapp deploy is complete to ensure that there is no downtime?

cc @XanderStrike @kauana @KauzClay

paulcwarren commented 3 years ago

In the A/C when you describe access logs will be available. Do you mean those labelled [RTR/0] OUT logs?