Breadcrumbs for ingester filesystem permissions

Signed-off-by: Zach Leslie <zach.leslie@grafana.com>
grafana · Mar 27, 2023 · f6547f1 · f6547f1
1 parent fd662eb
commit f6547f1
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/operations/jsonnet/microservices/ingester.libsonnet b/operations/jsonnet/microservices/ingester.libsonnet
@@ -66,8 +66,10 @@
     ]) +
     statefulset.mixin.spec.withPodManagementPolicy('Parallel') +
     statefulset.mixin.spec.template.spec.withTerminationGracePeriodSeconds(1200) +
+    statefulset.mixin.spec.template.spec.securityContext.withFsGroup(10001) +  // 10001 is the group ID assigned to Tempo in the Dockerfile
     $.util.podPriority('high') +
-    (if with_anti_affinity then $.util.antiAffinity else {}),
+    (if with_anti_affinity then $.util.antiAffinity else {})
+  ,
 
   tempo_ingester_statefulset: $.newIngesterStatefulSet(target_name, self.tempo_ingester_container) + statefulset.mixin.spec.withReplicas($._config.ingester.replicas),