grafana / loki

Like Prometheus, but for logs.
https://grafana.com/loki
GNU Affero General Public License v3.0
24.03k stars 3.46k forks source link

Loki Helm Chart SecurityContext is not being defined properly. #12539

Open fsvalim opened 7 months ago

fsvalim commented 7 months ago

The containerSecurityContext from Helm Chart Loki is not being defined according to the default values.yaml into the StatefulSet resource.

Steps to reproduce the behavior:

  1. Execute the helm install dry-run and check the output.

Expected behavior: allowPrivilegeEscalation: false in the containerSecurityContext, should be defined because is set as default. value

Part of the dry-run output:


  spec:
      serviceAccountName: cawe-monitoring-loki
      securityContext:
        fsGroup: 10001
        runAsGroup: 10001
        runAsNonRoot: true
        runAsUser: 10001
      initContainers:
        []
      containers:
        - name: loki
          image: "grafana/loki:2.4.2"
          imagePullPolicy: IfNotPresent
          args:
            - "-config.file=/etc/loki/loki.yaml"
          volumeMounts:
            - name: config
              mountPath: /etc/loki
            - name: storage
              mountPath: "/data"
              subPath: 
          ports:
            - name: http-metrics
              containerPort: 3100
              protocol: TCP
          livenessProbe:
            httpGet:
              path: /ready
              port: http-metrics
            initialDelaySeconds: 45
          readinessProbe:
            httpGet:
              path: /ready
              port: http-metrics
            initialDelaySeconds: 45
          resources:
            {}
          securityContext:
            readOnlyRootFilesystem: true
          env:
      nodeSelector:
slim-bean commented 7 months ago

Thanks @fsvalim sorry we didn't get to this sooner, will try to take a look asap!