Open naemono opened 1 year ago
May be same issue as #6280 . I thought this was keystore related. I'll verify.
this is a serious security issue, most of good security practices prevent to run container as root.
A quick (and dirty) fix is to use an init container to chown:
initContainers:
- command:
- sh
- -c
- chown -R 1000:1000 /usr/share/metricbeat/data
image: docker.elastic.co/beats/metricbeat:{{ $values.version }}
imagePullPolicy: IfNotPresent
name: permissions
securityContext:
runAsUser: 0
volumeMounts:
- mountPath: /usr/share/metricbeat/data
name: beat-data
or to setup the file-system via provisionning tools like Ansible, is it possible to configure this path when deploying the metricbeat instance ?
ho cant change the host path https://github.com/elastic/cloud-on-k8s/blob/main/pkg/controller/agent/pod.go#L429 or even use an emptyDir volume :-/
BTW we should not generate the keystore file (sensitive data) on host volume! The keystore file should be stored on an emptyDir volume.
related #6156 and potentially related #6599 (If we want to try and automatically handle this scenario)
When using
secureSettings
withhostPath
fails onelastic-internal-init-keystore
initContainer
without settingrunAsUser: 0
.logs
Manifest