aws / aws/eks-charts

aws-for-fluent-bit: provide realistic runAsNonRoot security context values

Open
#928 1 comment 1 reaction 0 assignees View on GitHub
Dominant language
Mustache
Stars
1.3k
Forks
1.1k
Avg merge
22m
Merged PRs (30d)
5

Description

Provide realistic values for running fluent-bit as a non-root user:

I am not sure what securityContext Fluent Bit needs to run correctly.
Once this is change is in a think a separate PR could be used to determine
what a default standard policy should look like.

_Originally posted by @razorsk8jz in https://github.com/aws/eks-charts/pull/923#discussion_r1142587589_

The security context comments in values.yaml are not usable:

```yaml
podSecurityContext: {}
# runAsUser: 1000
# runAsGroup: 1000
# runAsNonRoot: true
# seccompProfile:
# type: RuntimeDefault
containerSecurityContext: {}
# allowPrivilegeEscalation: false
# capabilities:
# drop:
# - ALL
```

Issues:
1. The user and group ids do not exist in the aws-for-fluent-bit image. AFAICT the image is based on amazonlinux/scratch and does not define any non-root users.
2. All the files in the image are owned by 0:0 (root) so runAsNonRoot probably won't suffice, at least not without some additional capabilities, such as FOWNER
3. Typical deployments will enable storage.path (e.b., /var/fluent-bit/state/flb-storage/), which appears to need a hostPath

Related:
* https://github.com/fluent/fluent-bit/issues/872
* https://docs-bigbang.dso.mil/1.56.0/docs/understanding-bigbang/package-architecture/fluentbit/#Storage
* https://repo1.dso.mil/big-bang/product/packages/fluentbit/-/blob/main/chart/values.yaml

https://github.com/aws/eks-charts/issues/719

Contributor guide

Open the contributing guide

Research direction

Start with the aws-for-fluent-bit chart's values.yaml and inspect the image's users, file ownership, and storage.path behavior. Review the related Fluent Bit issue and deployment examples to determine what non-root security context and hostPath requirements are supported. Done means the commented values are realistic and usable for common deployments.

Written by the indexing model from the issue text.

Assessment

Tech stack
helm, kubernetes
Domain
devops, infrastructure, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.