Closed syepes closed 1 year ago
Hello @syepes. Thank you for creating the issue!
I'd like to clarify a couple of things:
podSecurityContext.fsGroup
in your values.yaml
file? By default we set it to 101 (matches user ID in the official pyroscope images), which should make chown -R 101:101
unnecessary.SecurityContextConstraints
or PodSecurityPolicy
configured in your cluster?No problem, thanks for looking.
I am mainly using the default chart settings, so it should be reproducible
Thank you @syepes for the contribution! It's an interesting issue, because I can't reproduce this using AWS EKS. I suspect that this might be specific to RKE and the volume type/CSI provisioner you use: for example, I suppose fsGroup
may not work properly with hostPath
volumes or if the CSI driver does not support this.
I think it makes sense to add this init container to the helm chart as an option. However, I'd like to figure out the exact root cause in this particular case. May I ask you to post details of the storage class you use?
kubectl describe storageclass ssd
We are running K8s under openstack it could be related:
❯ k describe storageclass ssd
Name: ssd
IsDefaultClass: No
Annotations: <none>
Provisioner: cinder.csi.openstack.org
Parameters: type=ssd
AllowVolumeExpansion: True
MountOptions: <none>
ReclaimPolicy: Delete
VolumeBindingMode: Immediate
Events: <none>
Oh, this is interesting. Could it be related to https://github.com/kubernetes/cloud-provider-openstack/issues/1362?
Ya looks like that :-) The initContainers option could also be helpful for other stuff
We should add it definitely. If you want to help, contributions are always greatly appreciated :)
Submitted PR: https://github.com/pyroscope-io/helm-chart/pull/93
I have been trying to deploy pyroscope with persistence but as the container is running as non-root (101), its not able to create folder in the mounted volume. This even with the securityContext settings.
I have managed to resolved the issue by adding the below initContainer to the deployment
Hope this can be added in the official chart or at least the option of customizing the initContainers section.