Ensure that otel-collector and otel-agent run as sourcegraph user #543
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Run the otel-collector and otel-agent containers as the
sourcegraphuser rather thanroot.One of our customers is asking us to ensure that containers don't run as root.
I haven't been able to identify the original reason why these containers were running as root, so it seems that this was simply an oversight when the containers were originally created. This PR drops the
runAsuser + group IDs tosourcegraph:sourcegraph.otel-collector seems to be broken currently, due to incorrect configuration with jaeger - see #542 + linked slack discussion for a fix.
Reviewer notes
Testing locally requires setting
jaeger.enabled: truein values.yaml, and applying the fix linked above to ensure telemetry is sent to jaeger.I've followed the checklist below as best as I can - would appreciate some input on whether this requires any more work on my part.
Checklist
helm unittest --helm3 ./charts/sourcegraph/.gives errorunknown flag: --helm3Test plan