Loki and promtail unable to start when using Istio and PodSecurityPolicies

[StevenReitsma]

Describe the bug
We have a cluster where we use PodSecurityPolicies and Istio. The Loki and promtail helm charts (and maybe fluentbit as well, but we don't use it) support the creation of a PodSecurityPolicy. This PodSecurityPolicy does not include volume mounting of the projected and downwardAPI type, which are necessary for the Istio sidecar to function.

To Reproduce
Steps to reproduce the behavior:

1. Enable PodSecurityPolicy plugin
2. Deploy Istio (1.5.5)
3. Deploy the Loki helm chart (1.5.0)
4. Loki cannot start because it's missing downwardAPI and projected volume permissions for the Istio sidecar

Same goes for promtail.

Note that this is AFTER I added NET_BIND_SERVICE capability to the PSP which is necessary to make it work according to #2115. I think this should already be fixed in a new release right?

Expected behavior
Loki and promtail can start.

Environment:

• Kubernetes 1.17.8 on Openstack
• Helm

How to fix:
Add downwardAPI and projected to the list of volumes in the PSPs for Loki, promtail and maybe fluentbit.

I can make a PR if the maintainers agree that this change should be made.

[invidian]

Maybe adding a variable for extra allowed volumes to PSP would be a solution here?

[StevenReitsma]

That's also a possibility, although I don't immediately see any security implications for adding the projected and downwardAPI types as a default. The Prometheus operator (as an example) also does this.

[owen-d]

Thanks for the detailed writeup. Two things:

• Yes, we removed the NET_BIND_SERVICE capability requirement as it was causing unnecessary difficulties.
• This seems completely reasonable and we'd love a PR.

[StevenReitsma]

Good to hear! I'll send a PR later today.