search

influxdata / helm-charts

Official Helm Chart Repository for InfluxData Applications
MIT License
233 stars 330 forks source link

deploying telegraf-ds in openshift 4.14 fails #635

Open yellowpattern opened 7 months ago

yellowpattern commented 7 months ago

I tried to deploy telegraf-ds onto OpenShift 4.14 but ran into this: Error creating: pods "telegraf-ds-" is forbidden: unable to validate against any security context constraint: [provider "anyuid": Forbidden: not usable by user or serviceaccount, provider "pipelines-scc": Forbidden: not usable by user or serviceaccount, provider "dcp-hostnework-scc": Forbidden: not usable by user or serviceaccount, provider "dcp-scc": Forbidden: not usable by user or serviceaccount, spec.volumes[0]: Invalid value: "hostPath": hostPath volumes are not allowed to be used, spec.volumes[1]: Invalid value: "hostPath": hostPath volumes are not allowed to be used, spec.volumes[2]: Invalid value: "hostPath": hostPath volumes are not allowed to be used, provider "restricted": Forbidden: not usable by user or serviceaccount, provider "containerized-data-importer": Forbidden: not usable by user or serviceaccount, provider "nonroot-v2": Forbidden: not usable by user or serviceaccount, provider "nonroot": Forbidden: not usable by user or serviceaccount, provider "noobaa-db": Forbidden: not usable by user or serviceaccount, provider "noobaa-endpoint": Forbidden: not usable by user or serviceaccount, provider "hostmount-anyuid": Forbidden: not usable by user or serviceaccount, provider "kubevirt-controller": Forbidden: not usable by user or serviceaccount, provider "machine-api-termination-handler": Forbidden: not usable by user or serviceaccount, provider "bridge-marker": Forbidden: not usable by user or serviceaccount, provider "hostnetwork-v2": Forbidden: not usable by user or serviceaccount, provider "hostnetwork": Forbidden: not usable by user or serviceaccount, provider "hostaccess": Forbidden: not usable by user or serviceaccount, provider "linux-bridge": Forbidden: not usable by user or serviceaccount, provider "kubevirt-handler": Forbidden: not usable by user or serviceaccount, provider "rook-ceph": Forbidden: not usable by user or serviceaccount, provider "node-exporter": Forbidden: not usable by user or serviceaccount, provider "rook-ceph-csi": Forbidden: not usable by user or serviceaccount, provider "privileged": Forbidden: not usable by user or serviceaccount]

yellowpattern commented 7 months ago

I ran this to "workaround" the problem:

oc adm policy add-scc-to-user privileged system:serviceaccount:telegraf:telegraf-ds

And now I get these events from the telegraf-ds pods:

MountVolume.SetUp failed for volume "docker-socket" : hostPath type check failed: /var/run/docker.sock is not a socket file Unable to attach or mount volumes: unmounted volumes=[docker-socket], unattached volumes=[], failed to process volumes=[]: timed out waiting for the condition

Deleting that section from the configMap and template resolved that... but shouldn't be required.

fcolomas commented 1 month ago

This happens to me too, on OKD, I think is because they use CRI.O for the containers...

fcolomas commented 1 month ago

Also on the config map you have this:

{{- if .Values.config.docker_endpoint }} [[inputs.docker]] endpoint = {{ .Values.config.docker_endpoint | quote }} {{- end }}

Is supposed if there is the docket_endpoint on the values.yaml then it will be configured, I removed that but also get the problem