config-reloader prevents running containers as non-root due to walking /etc instead of /etc/vm

[brokenjacobs]

I've defined a securityContext for my vmagent pod:

    securityContext:
      fsGroup: 2003
      runAsGroup: 2003
      runAsNonRoot: true
      runAsUser: 2003

But when I do this, I see issues in the pod log:

2022-07-27T17:11:54.168Z error operator/internal/config-reloader/file_watch.go:159 cannot read file content: open /etc/crontabs/root: permission denied
2022-07-27T17:11:54.168Z error operator/internal/config-reloader/file_watch.go:179 cannot walk: cannot read file content: open /etc/crontabs/root: permission denied
2022-07-27T17:11:54.168Z error operator/internal/config-reloader/file_watch.go:210 cannot update dir watch cache: cannot walk path: /etc/vm, err: cannot read file content: open /etc/crontabs/root: permission denied
Any way to fix this so we can run as non-root? This seems non-ideal.

Originally:
VictoriaMetrics/helm-charts#353

[f41gh7]

Thanks for reporting, will be fixed soon.

[f41gh7]

Can you try to change image for config-reloader?

It could be done via modifying VMAgent spec:

kind: VMAgent
spec:
  containers:
   - name: config-reloader
     image: victoriametrics/operator:config-reloader-v0.27.0

Or globally via operator env vars:

- name: VM_CUSTOMCONFIGRELOADERIMAGE
  value: victoriametrics/operator:config-reloader-v0.27.0

[brokenjacobs]

Happy to give it a shot but I’m on vacation for the next two weeks… I can report back after!

[brokenjacobs]

This looks like it did the trick. LGTM!