apache / apache/apisix-helm-chart
Running Apisix with securityContext does not work
- Dominant language
- Go Template
- Stars
- 289
- Forks
- 282
- Avg merge
- 15h 55m
- Merged PRs (30d)
- 3
Description
I am running [Apisix Helm Chart](https://github.com/apache/apisix-helm-chart/tree/master/charts/apisix) version `2.10.0`
I want to run Apisix with the [suggested security context](https://github.com/apache/apisix-helm-chart/blob/master/charts/apisix/values.yaml#L53) does not work
```
securityContext:
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 1000
```
It throws this error:
```
Defaulted container "apisix" out of: apisix, wait-etcd (init)
/usr/local/openresty//luajit/bin/luajit ./apisix/cli/apisix.lua init
failed to update nginx.conf: failed to open file: /usr/local/apisix/conf/nginx.conf, error info:/usr/local/apisix/conf/nginx.conf: Read-only file system
```
And if readOnlyRootFilesystem is set to false, it says:
```
Defaulted container "apisix" out of: apisix, wait-etcd (init)
/usr/local/openresty//luajit/bin/luajit ./apisix/cli/apisix.lua init
failed to update nginx.conf: failed to open file: /usr/local/apisix/conf/nginx.conf, error info:/usr/local/apisix/conf/nginx.conf: Permission denied
```
How should I run Apisix with a protective securityContext?
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with charts/apisix/values.yaml around the suggested securityContext and inspect how the Helm chart renders the APISIX container and its writable paths. Reproduce the issue with the securityContext from the report, then verify that the rendered deployment starts successfully with readOnlyRootFilesystem and runAsNonRoot enabled, without the nginx.conf permission errors.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- helm, kubernetes
- Domain
- devops, infrastructure, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100