search

kubernetes-sigs / cluster-api-addon-provider-helm

CAAPH uses Helm charts to manage the installation and lifecycle of Cluster API add-ons.
Apache License 2.0
96 stars 25 forks source link

Support for OpenShift as Management Cluster #236

Open senthilredhat opened 1 month ago

senthilredhat commented 1 month ago

User Story

I am using OpenShift as my management cluster and encountered an issue when attempting to install the Helm chart on the managed cluster. The current version fails with an error related to writing to /.config and /etc/xdg folders. This is because, by default, pods on OpenShift run as non-privileged containers, which restricts write access to these directories.

Current Workaround While changing the deployment to run as a privileged container is a potential workaround, it introduces security concerns and goes against best practices for running containers.

Request Please modify the deployment configuration or provide an option to enable the Helm chart to function without requiring escalated privileges. This would involve ensuring that the necessary directories have appropriate permissions or altering the paths used by the application to directories writable by non-privileged containers.

Additional Context The issue specifically arises because of the default security context in OpenShift, which does not permit write access to /.config and /etc/xdg. Adjusting the deployment to be compatible with OpenShift’s security policies will make the Helm chart more versatile and secure.

Jont828 commented 1 month ago

/triage accepted

Jont828 commented 1 week ago

@senthilredhat Thanks for your patience, I haven't worked with OpenShift before but will try to look into this. Just to clarify, you need the cluster-api-helm-controller pod to have write permissions to only the folders /.config and /etc/xdg, is that right?