apache / apache/apisix-helm-chart

Running Apisix with securityContext does not work

Open
#805 3 comments 16 reactions 0 assignees View on GitHub
bug
Dominant language
Go Template
Stars
289
Forks
282
Avg merge
15h 55m
Merged PRs (30d)
3

Description

I am running [Apisix Helm Chart](https://github.com/apache/apisix-helm-chart/tree/master/charts/apisix) version `2.10.0`
I want to run Apisix with the [suggested security context](https://github.com/apache/apisix-helm-chart/blob/master/charts/apisix/values.yaml#L53) does not work
```
securityContext:
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 1000
```

It throws this error:
```
Defaulted container "apisix" out of: apisix, wait-etcd (init)
/usr/local/openresty//luajit/bin/luajit ./apisix/cli/apisix.lua init
failed to update nginx.conf: failed to open file: /usr/local/apisix/conf/nginx.conf, error info:/usr/local/apisix/conf/nginx.conf: Read-only file system
```

And if readOnlyRootFilesystem is set to false, it says:
```
Defaulted container "apisix" out of: apisix, wait-etcd (init)
/usr/local/openresty//luajit/bin/luajit ./apisix/cli/apisix.lua init
failed to update nginx.conf: failed to open file: /usr/local/apisix/conf/nginx.conf, error info:/usr/local/apisix/conf/nginx.conf: Permission denied
```

How should I run Apisix with a protective securityContext?

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with charts/apisix/values.yaml around the suggested securityContext and inspect how the Helm chart renders the APISIX container and its writable paths. Reproduce the issue with the securityContext from the report, then verify that the rendered deployment starts successfully with readOnlyRootFilesystem and runAsNonRoot enabled, without the nginx.conf permission errors.

Written by the indexing model from the issue text.

Assessment

Tech stack
helm, kubernetes
Domain
devops, infrastructure, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.