openshift_compatibility

[Baboulinet-33]

Hello,

I wanted to use victoria logs on openshift but openshift don't like fixed securityContext ("fsGroup" "runAsUser" "runAsGroup").
So I've make some modification on chart to be compatible with openshift.

The modification are clearly a copy/paste of bitnami solution (https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_compatibility.tpl) - you can keep the modification on _helpers.tpl or add the following dependency on all charts:

dependencies:
- name: common
  repository: oci://registry-1.docker.io/bitnamicharts
  version: 2.x.x

For all securityContext parameter, you have a property enabled to enable this parameter.
And you have the parameter global.compatibility.openshift.adaptSecurityContext with value auto, force, disabled:

• auto: apply if the detected running cluster is Openshift
• force: perform the adaptation always
• disabled: do not perform adaptation

An example with auto:

spec:
      containers:
        - name: victoria-logs-single-server
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
          image: "victoriametrics/victoria-logs:v0.5.2-victorialogs"
          [...]
      securityContext:
        fsGroup: 2000
        runAsNonRoot: true
        runAsUser: 1000
      terminationGracePeriodSeconds: 60
      volumes:
        - name: server-volume
          emptyDir: {}

With force:
openshift: force

spec:
      containers:
        - name: victoria-logs-single-server
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: true
          image: "victoriametrics/victoria-logs:v0.5.2-victorialogs"
          [...]
      securityContext:
        runAsNonRoot: true
      terminationGracePeriodSeconds: 60
      volumes:
        - name: server-volume
          emptyDir: {}

[Haleygo]

Error: INSTALLATION FAILED: template: victoria-metrics-alert/templates/alertmanager-deployment.yaml:43:24: executing "victoria-metrics-alert/templates/alertmanager-deployment.yaml" at <.Values.alertmanager.securityContext.enabled>: nil pointer evaluating interface {}.enabled

@Baboulinet-33 Could you please fix victoria-metrics-alert chart and solve the conflict?

[Baboulinet-33]

Hi, I forgot to respond but I addressed the points mentionned

[Haleygo]

LGTM

[Haleygo]

Thanks for contribution!

[TheMeier]

just a remark for some future similar changes. maybe it is a good idea to introduce new toggles with defaults set so they match the previous behaviour.
IMHO the default for server.podSecurityContext.enabled should have been true

[Haleygo]

just a remark for some future similar changes. maybe it is a good idea to introduce new toggles with defaults set so they match the previous behaviour. IMHO the default for server.podSecurityContext.enabled should have been true

@TheMeier Yes, thank you for notice and sorry for inconvenience!
It shouldn't break any previous customized securityContext, please see #1023.