I was attempting the deploy the "helm charts hardened" with the recommendations set to true and noticed this warning/errors in the logs:
{
"error": "failed to write data file: open /run/spire/agent-data.json.tmp: permission denied",
"level": "warning",
"msg": "Could not store SVID",
"subsystem_name": "manager",
"time": "2024-08-06T07:41:00Z"
}
{
"error": "failed to write data file: open /run/spire/agent-data.json.tmp: permission denied",
"level": "error",
"msg": "Could not store bundle",
"subsystem_name": "manager",
"time": "2024-08-06T07:41:00Z"
}
Upon inspecting the process in the node I noticed it is running under the user 1000:
I performed a diff between the agent DaemonSet with the recommendations disabled (left side) and enabled (right side), and I could see the chart set the user 1000, as confirmed in my previous output:
I was attempting the deploy the "helm charts hardened" with the recommendations set to true and noticed this warning/errors in the logs:
Upon inspecting the process in the node I noticed it is running under the user 1000:
I performed a diff between the agent DaemonSet with the recommendations disabled (left side) and enabled (right side), and I could see the chart set the user 1000, as confirmed in my previous output:
I noticed an initContainer is added to address the permissions for the user 1000:
However that does not address the directory
/run/spire/
which the agent is trying to store the bundle and SVID information.Chart version used
spire-0.21.0
App Version:1.9.6
Custom values used: