aws-for-fluent-bit: provide realistic runAsNonRoot security context values
- Dominant language
- Mustache
- Stars
- 1.3k
- Forks
- 1.1k
- Avg merge
- 22m
- Merged PRs (30d)
- 5
Description
Provide realistic values for running fluent-bit as a non-root user:
I am not sure what securityContext Fluent Bit needs to run correctly.
Once this is change is in a think a separate PR could be used to determine
what a default standard policy should look like.
_Originally posted by @razorsk8jz in https://github.com/aws/eks-charts/pull/923#discussion_r1142587589_
The security context comments in values.yaml are not usable:
```yaml
podSecurityContext: {}
# runAsUser: 1000
# runAsGroup: 1000
# runAsNonRoot: true
# seccompProfile:
# type: RuntimeDefault
containerSecurityContext: {}
# allowPrivilegeEscalation: false
# capabilities:
# drop:
# - ALL
```
Issues:
1. The user and group ids do not exist in the aws-for-fluent-bit image. AFAICT the image is based on amazonlinux/scratch and does not define any non-root users.
2. All the files in the image are owned by 0:0 (root) so runAsNonRoot probably won't suffice, at least not without some additional capabilities, such as FOWNER
3. Typical deployments will enable storage.path (e.b., /var/fluent-bit/state/flb-storage/), which appears to need a hostPath
Related:
* https://github.com/fluent/fluent-bit/issues/872
* https://docs-bigbang.dso.mil/1.56.0/docs/understanding-bigbang/package-architecture/fluentbit/#Storage
* https://repo1.dso.mil/big-bang/product/packages/fluentbit/-/blob/main/chart/values.yaml
https://github.com/aws/eks-charts/issues/719
Contributor guide
Research direction
Start with the aws-for-fluent-bit chart's values.yaml and inspect the image's users, file ownership, and storage.path behavior. Review the related Fluent Bit issue and deployment examples to determine what non-root security context and hostPath requirements are supported. Done means the commented values are realistic and usable for common deployments.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- helm, kubernetes
- Domain
- devops, infrastructure, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100