Lack of fsGroup in ClusterLogging CRD.

[DTadrzak]

Hey,
It looks like CRD of ClusterLogging does not allow us to define fsGroup (https://docs.openshift.com/enterprise/3.1/install_config/persistent_storage/pod_security_context.html#fsgroup).

It huge gap due to the fact that by default CSI creates volume with root as owner whereas the user used inside elasticsearch container is created with uid: 1000. It means that all clusters, deployed with storageClass provided by CSI will raise the following error:

main ERROR Unable to create file
/elasticsearch/persistent/elasticsearch/logs/elasticsearch.log java.io.IOException: Could not create directory /elasticsearch/persistent/elasticsearch/logs

due to the insufficient privileges on PV.

[ewolinetz]

This was done by design to remove any volume specific configurations. The recommended fix for this is to create a different storageClass for Elasticsearch to use and specify that on your CR. The out of the box gp2 storageClass should work also.

[meshistern]

Hey,
I am having the same problem when i am trying to deploy ClusterLogging on azure using the azure-rwo and managed-premium storageClasses. What can i do?

[openshift-bot]

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

[openshift-bot]

Stale issues rot after 30d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle rotten
/remove-lifecycle stale

[openshift-bot]

Rotten issues close after 30d of inactivity.

Reopen the issue by commenting /reopen.
Mark the issue as fresh by commenting /remove-lifecycle rotten.
Exclude this issue from closing again by commenting /lifecycle frozen.

/close

[openshift-ci-robot]

@openshift-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.

Reopen the issue by commenting /reopen.
Mark the issue as fresh by commenting /remove-lifecycle rotten.
Exclude this issue from closing again by commenting /lifecycle frozen.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.