From 38e04741e2343505175ed7ddb483128c5a841cfe Mon Sep 17 00:00:00 2001 From: rockb1017 Date: Thu, 18 Nov 2021 21:33:13 -0800 Subject: [PATCH] applying suggestions --- .../splunk-otel-collector/templates/daemonset.yaml | 12 ++++++------ helm-charts/splunk-otel-collector/values.yaml | 3 ++- 2 files changed, 8 insertions(+), 7 deletions(-) diff --git a/helm-charts/splunk-otel-collector/templates/daemonset.yaml b/helm-charts/splunk-otel-collector/templates/daemonset.yaml index 4da52d2b69..c4dee51640 100644 --- a/helm-charts/splunk-otel-collector/templates/daemonset.yaml +++ b/helm-charts/splunk-otel-collector/templates/daemonset.yaml @@ -138,7 +138,8 @@ spec: mountPath: /var/log - name: varlibdockercontainers mountPath: /var/lib/docker/containers - {{- if $agent.runInitForNonRoot }} + {{- if $agent.securityContext }} + {{- if not (eq (toString $agent.securityContext.runAsUser) "0" ) }} - name: chown image: registry.access.redhat.com/ubi8/ubi command: ['sh', '-c', ' @@ -178,6 +179,7 @@ spec: {{- end }} {{- end }} {{- end }} + {{- end }} {{- end }} containers: {{- if and (eq (include "splunk-otel-collector.logsEnabled" .) "true") (eq .Values.logsEngine "fluentd") }} @@ -247,12 +249,10 @@ spec: imagePullPolicy: {{ .Values.image.otelcol.pullPolicy }} {{- if or $agent.securityContext (and (eq (include "splunk-otel-collector.logsEnabled" $) "true") (eq .Values.logsEngine "otel")) }} securityContext: - {{- if not $agent.runInitForNonRoot }} - runAsUser: 0 - {{- else }} {{- if $agent.securityContext }} - {{ toYaml $agent.securityContext | nindent 10 }} - {{- end }} + {{- toYaml $agent.securityContext | nindent 10 }} + {{- else }} + runAsUser: 0 {{- end }} {{- end }} env: diff --git a/helm-charts/splunk-otel-collector/values.yaml b/helm-charts/splunk-otel-collector/values.yaml index be34ed6db6..2c0f4721a3 100644 --- a/helm-charts/splunk-otel-collector/values.yaml +++ b/helm-charts/splunk-otel-collector/values.yaml @@ -260,7 +260,8 @@ agent: # To collect container logs and journald logs, it will run the agent as a root user. # To run it as non root user, uncomment below `securityContext` options. - securityContext: {} + + # securityContext: # runAsUser: 20000 # runAsGroup: 20000