influxdata / influxdata/helm-charts

Deploying in Openshift shows permission issues

Open
#517 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Mustache
Stars
257
Forks
347
Avg merge
4d 20h
Merged PRs (30d)
9

Description

Installing with Helm charts shows the following permission issues:
```
chmod: /var/lib/influxdb2: Operation not permitted
chmod: /var/lib/influxdb2: Operation not permitted
chmod: /etc/influxdb2: Operation not permitted
....
Error: **setup succeeded, but failed to write new config to local path**: open /etc/influxdb2/influx-configs: permission denied
2022-10-14T14:21:33. warn cleaning bolt and engine files to prevent conflicts on retry {"system": "docker", "bolt_path": "/var/lib/influxdb2/influxd.bolt", "engine_path": "/var/lib/influxdb2"}
```

Here https://docs.openshift.com/container-platform/4.2/openshift_images/create-images.html#images-create-guide-openshift_create-images:

> ### Support arbitrary user ids
> By default, OpenShift Container Platform runs containers using an arbitrarily assigned user ID. This provides additional security against processes escaping the container due to a container engine vulnerability and thereby achieving escalated permissions on the host node.
>
> For an image to support running as an arbitrary user, directories and files that may be written to by processes in the image should be owned by the root group and be read/writable by that group. Files to be executed should also have group execute permissions.
>
> Adding the following to your Dockerfile sets the directory and file permissions to allow users in the root group to access them in the built image:
>
>
> ```
> RUN chgrp -R 0 /some/directory && \
> chmod -R g=u /some/directory
> ```

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the Helm chart's deployment and the container paths named in the error, then reproduce the installation in OpenShift. Done means the container can initialize, write its configuration, and use /var/lib/influxdb2 without permission errors.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, helm, kubernetes
Domain
devops, infrastructure
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.