runAsUser SecurityContext not working for windows

Signed-off-by: Dani Louca <[email protected]>
signalfx · May 26, 2023 · 63d29a6 · 63d29a6
1 parent fdb574c
commit 63d29a6
Show file tree

Hide file tree

Showing 33 changed files with 71 additions and 14 deletions.
diff --git a/examples/add-receiver-creator/rendered_manifests/deployment-cluster-receiver.yaml b/examples/add-receiver-creator/rendered_manifests/deployment-cluster-receiver.yaml
@@ -35,6 +35,8 @@ spec:
       serviceAccountName: default-splunk-otel-collector
       nodeSelector:
           kubernetes.io/os: linux
+      securityContext:
+        runAsUser: "0"
       containers:
       - name: otel-collector
         command:

diff --git a/examples/add-sampler/rendered_manifests/deployment-cluster-receiver.yaml b/examples/add-sampler/rendered_manifests/deployment-cluster-receiver.yaml
@@ -35,6 +35,8 @@ spec:
       serviceAccountName: default-splunk-otel-collector
       nodeSelector:
           kubernetes.io/os: linux
+      securityContext:
+        runAsUser: "0"
       containers:
       - name: otel-collector
         command:

diff --git a/examples/collector-all-modes/rendered_manifests/deployment-cluster-receiver.yaml b/examples/collector-all-modes/rendered_manifests/deployment-cluster-receiver.yaml
@@ -35,6 +35,8 @@ spec:
       serviceAccountName: default-splunk-otel-collector
       nodeSelector:
           kubernetes.io/os: linux
+      securityContext:
+        runAsUser: "0"
       containers:
       - name: otel-collector
         command:

diff --git a/examples/collector-all-modes/rendered_manifests/deployment-gateway.yaml b/examples/collector-all-modes/rendered_manifests/deployment-gateway.yaml
@@ -35,6 +35,8 @@ spec:
       serviceAccountName: default-splunk-otel-collector
       nodeSelector:
           kubernetes.io/os: linux
+      securityContext:
+        runAsUser: "0"
       containers:
       - name: otel-collector
         command:

diff --git a/examples/collector-cluster-receiver-only/rendered_manifests/deployment-cluster-receiver.yaml b/examples/collector-cluster-receiver-only/rendered_manifests/deployment-cluster-receiver.yaml
@@ -35,6 +35,8 @@ spec:
       serviceAccountName: default-splunk-otel-collector
       nodeSelector:
           kubernetes.io/os: linux
+      securityContext:
+        runAsUser: "0"
       containers:
       - name: otel-collector
         command:

diff --git a/examples/collector-gateway-only/rendered_manifests/deployment-gateway.yaml b/examples/collector-gateway-only/rendered_manifests/deployment-gateway.yaml
@@ -35,6 +35,8 @@ spec:
       serviceAccountName: default-splunk-otel-collector
       nodeSelector:
           kubernetes.io/os: linux
+      securityContext:
+        runAsUser: "0"
       containers:
       - name: otel-collector
         command:

diff --git a/examples/crio-logging/rendered_manifests/deployment-cluster-receiver.yaml b/examples/crio-logging/rendered_manifests/deployment-cluster-receiver.yaml
@@ -35,6 +35,8 @@ spec:
       serviceAccountName: default-splunk-otel-collector
       nodeSelector:
           kubernetes.io/os: linux
+      securityContext:
+        runAsUser: "0"
       containers:
       - name: otel-collector
         command:

diff --git a/examples/default/rendered_manifests/deployment-cluster-receiver.yaml b/examples/default/rendered_manifests/deployment-cluster-receiver.yaml
@@ -35,6 +35,8 @@ spec:
       serviceAccountName: default-splunk-otel-collector
       nodeSelector:
           kubernetes.io/os: linux
+      securityContext:
+        runAsUser: "0"
       containers:
       - name: otel-collector
         command:

diff --git a/examples/distribution-aks/rendered_manifests/deployment-cluster-receiver.yaml b/examples/distribution-aks/rendered_manifests/deployment-cluster-receiver.yaml
@@ -35,6 +35,8 @@ spec:
       serviceAccountName: default-splunk-otel-collector
       nodeSelector:
           kubernetes.io/os: linux
+      securityContext:
+        runAsUser: "0"
       containers:
       - name: otel-collector
         command:

diff --git a/examples/distribution-eks-fargate/rendered_manifests/deployment-cluster-receiver.yaml b/examples/distribution-eks-fargate/rendered_manifests/deployment-cluster-receiver.yaml
@@ -47,6 +47,8 @@ spec:
                 values:
                 - otel-k8s-cluster-receiver
             topologyKey: kubernetes.io/hostname
+      securityContext:
+        runAsUser: "0"
       initContainers:
         - name: cluster-receiver-node-discoverer
           image: public.ecr.aws/amazonlinux/amazonlinux:latest

diff --git a/examples/distribution-eks-fargate/rendered_manifests/deployment-gateway.yaml b/examples/distribution-eks-fargate/rendered_manifests/deployment-gateway.yaml
@@ -35,6 +35,8 @@ spec:
       serviceAccountName: default-splunk-otel-collector
       nodeSelector:
           kubernetes.io/os: linux
+      securityContext:
+        runAsUser: "0"
       containers:
       - name: otel-collector
         command:

diff --git a/examples/distribution-eks/rendered_manifests/deployment-cluster-receiver.yaml b/examples/distribution-eks/rendered_manifests/deployment-cluster-receiver.yaml
@@ -35,6 +35,8 @@ spec:
       serviceAccountName: default-splunk-otel-collector
       nodeSelector:
           kubernetes.io/os: linux
+      securityContext:
+        runAsUser: "0"
       containers:
       - name: otel-collector
         command:

diff --git a/examples/distribution-gke-autopilot/rendered_manifests/deployment-cluster-receiver.yaml b/examples/distribution-gke-autopilot/rendered_manifests/deployment-cluster-receiver.yaml
@@ -35,6 +35,8 @@ spec:
       serviceAccountName: default-splunk-otel-collector
       nodeSelector:
           kubernetes.io/os: linux
+      securityContext:
+        runAsUser: "0"
       containers:
       - name: otel-collector
         command:

diff --git a/examples/distribution-gke/rendered_manifests/deployment-cluster-receiver.yaml b/examples/distribution-gke/rendered_manifests/deployment-cluster-receiver.yaml
@@ -35,6 +35,8 @@ spec:
       serviceAccountName: default-splunk-otel-collector
       nodeSelector:
           kubernetes.io/os: linux
+      securityContext:
+        runAsUser: "0"
       containers:
       - name: otel-collector
         command:

diff --git a/examples/distribution-openshift/rendered_manifests/deployment-cluster-receiver.yaml b/examples/distribution-openshift/rendered_manifests/deployment-cluster-receiver.yaml
@@ -35,6 +35,8 @@ spec:
       serviceAccountName: default-splunk-otel-collector
       nodeSelector:
           kubernetes.io/os: linux
+      securityContext:
+        runAsUser: "0"
       containers:
       - name: otel-collector
         command:

diff --git a/examples/enable-network-explorer/rendered_manifests/deployment-cluster-receiver.yaml b/examples/enable-network-explorer/rendered_manifests/deployment-cluster-receiver.yaml
@@ -35,6 +35,8 @@ spec:
       serviceAccountName: default-splunk-otel-collector
       nodeSelector:
           kubernetes.io/os: linux
+      securityContext:
+        runAsUser: "0"
       containers:
       - name: otel-collector
         command:

diff --git a/examples/enable-network-explorer/rendered_manifests/deployment-gateway.yaml b/examples/enable-network-explorer/rendered_manifests/deployment-gateway.yaml
@@ -35,6 +35,8 @@ spec:
       serviceAccountName: default-splunk-otel-collector
       nodeSelector:
           kubernetes.io/os: linux
+      securityContext:
+        runAsUser: "0"
       containers:
       - name: otel-collector
         command:

diff --git a/...ble-operator-and-auto-instrumentation/rendered_manifests/deployment-cluster-receiver.yaml b/...ble-operator-and-auto-instrumentation/rendered_manifests/deployment-cluster-receiver.yaml
@@ -35,6 +35,8 @@ spec:
       serviceAccountName: default-splunk-otel-collector
       nodeSelector:
           kubernetes.io/os: linux
+      securityContext:
+        runAsUser: "0"
       containers:
       - name: otel-collector
         command:

diff --git a/examples/enabled-pprof-extension/rendered_manifests/deployment-cluster-receiver.yaml b/examples/enabled-pprof-extension/rendered_manifests/deployment-cluster-receiver.yaml
@@ -35,6 +35,8 @@ spec:
       serviceAccountName: default-splunk-otel-collector
       nodeSelector:
           kubernetes.io/os: linux
+      securityContext:
+        runAsUser: "0"
       containers:
       - name: otel-collector
         command:

diff --git a/examples/filter-container-metrics/rendered_manifests/deployment-cluster-receiver.yaml b/examples/filter-container-metrics/rendered_manifests/deployment-cluster-receiver.yaml
@@ -35,6 +35,8 @@ spec:
       serviceAccountName: default-splunk-otel-collector
       nodeSelector:
           kubernetes.io/os: linux
+      securityContext:
+        runAsUser: "0"
       containers:
       - name: otel-collector
         command:

diff --git a/...entd-multiline-logs-java-stack-traces/rendered_manifests/deployment-cluster-receiver.yaml b/...entd-multiline-logs-java-stack-traces/rendered_manifests/deployment-cluster-receiver.yaml
@@ -35,6 +35,8 @@ spec:
       serviceAccountName: default-splunk-otel-collector
       nodeSelector:
           kubernetes.io/os: linux
+      securityContext:
+        runAsUser: "0"
       containers:
       - name: otel-collector
         command:

diff --git a/examples/kubernetes-windows-nodes/rendered_manifests/deployment-cluster-receiver.yaml b/examples/kubernetes-windows-nodes/rendered_manifests/deployment-cluster-receiver.yaml
@@ -35,6 +35,8 @@ spec:
       serviceAccountName: default-splunk-otel-collector
       nodeSelector:
           kubernetes.io/os: windows
+      securityContext:
+        {}
       containers:
       - name: otel-collector
         command:

diff --git a/examples/only-logs-otel/rendered_manifests/daemonset.yaml b/examples/only-logs-otel/rendered_manifests/daemonset.yaml
@@ -99,7 +99,7 @@ spec:
         image: quay.io/signalfx/splunk-otel-collector:0.76.0
         imagePullPolicy: IfNotPresent
         securityContext:
-          runAsUser: 0
+          runAsUser: "0"
         env:
           - name: SPLUNK_MEMORY_TOTAL_MIB
             value: "500"

diff --git a/examples/only-logs-with-extra-file-logs/rendered_manifests/daemonset.yaml b/examples/only-logs-with-extra-file-logs/rendered_manifests/daemonset.yaml
@@ -99,7 +99,7 @@ spec:
         image: quay.io/signalfx/splunk-otel-collector:0.76.0
         imagePullPolicy: IfNotPresent
         securityContext:
-          runAsUser: 0
+          runAsUser: "0"
         env:
           - name: SPLUNK_MEMORY_TOTAL_MIB
             value: "500"

diff --git a/examples/only-metrics-platform/rendered_manifests/deployment-cluster-receiver.yaml b/examples/only-metrics-platform/rendered_manifests/deployment-cluster-receiver.yaml
@@ -35,6 +35,8 @@ spec:
       serviceAccountName: default-splunk-otel-collector
       nodeSelector:
           kubernetes.io/os: linux
+      securityContext:
+        runAsUser: "0"
       containers:
       - name: otel-collector
         command:

diff --git a/examples/only-metrics/rendered_manifests/deployment-cluster-receiver.yaml b/examples/only-metrics/rendered_manifests/deployment-cluster-receiver.yaml
@@ -35,6 +35,8 @@ spec:
       serviceAccountName: default-splunk-otel-collector
       nodeSelector:
           kubernetes.io/os: linux
+      securityContext:
+        runAsUser: "0"
       containers:
       - name: otel-collector
         command:

diff --git a/...a-through-gateway-deployed-separately/rendered_manifests/deployment-cluster-receiver.yaml b/...a-through-gateway-deployed-separately/rendered_manifests/deployment-cluster-receiver.yaml
@@ -35,6 +35,8 @@ spec:
       serviceAccountName: default-splunk-otel-collector
       nodeSelector:
           kubernetes.io/os: linux
+      securityContext:
+        runAsUser: "0"
       containers:
       - name: otel-collector
         command:

diff --git a/examples/use-proxy/rendered_manifests/deployment-cluster-receiver.yaml b/examples/use-proxy/rendered_manifests/deployment-cluster-receiver.yaml
@@ -35,6 +35,8 @@ spec:
       serviceAccountName: default-splunk-otel-collector
       nodeSelector:
           kubernetes.io/os: linux
+      securityContext:
+        runAsUser: "0"
       containers:
       - name: otel-collector
         command:

diff --git a/helm-charts/splunk-otel-collector/templates/_helpers.tpl b/helm-charts/splunk-otel-collector/templates/_helpers.tpl
@@ -428,3 +428,16 @@ Whether clusterReceiver should be enabled
 {{- $clusterReceiver := fromYaml (include "splunk-otel-collector.clusterReceiver" .) }}
 {{- and $clusterReceiver.enabled (or (eq (include "splunk-otel-collector.metricsEnabled" .) "true") (eq (include "splunk-otel-collector.objectsOrEventsEnabled" .) "true")) -}}
 {{- end -}}
+
+
+{{/*
+Build the securityContext for Linux and Windows
+*/}}
+{{- define "splunk-otel-collector.securityContext" -}}
+{{- if .isWindows }}
+{{- $_ := unset .securityContext "runAsUser" }}
+{{- else if (eq (toString .securityContext.runAsUser) "<nil>") }}
+{{- $_ := set .securityContext "runAsUser" 0 }}
+{{- end }}
+{{- toYaml .securityContext }}
+{{- end -}}
diff --git a/helm-charts/splunk-otel-collector/templates/daemonset.yaml b/helm-charts/splunk-otel-collector/templates/daemonset.yaml
@@ -251,11 +251,7 @@ spec:
         imagePullPolicy: {{ .Values.image.otelcol.pullPolicy }}
         {{- if or $agent.securityContext (and (eq (include "splunk-otel-collector.logsEnabled" $) "true") (eq .Values.logsEngine "otel")) }}
         securityContext:
-          {{- if $agent.securityContext }}
-          {{- toYaml $agent.securityContext | nindent 10 }}
-          {{- else }}
-          runAsUser: 0
-          {{- end }}
+          {{- include "splunk-otel-collector.securityContext" (dict "isWindows" .Values.isWindows "securityContext" $agent.securityContext) | nindent 10 }}
         {{- end }}
         env:
           - name: SPLUNK_MEMORY_TOTAL_MIB

diff --git a/helm-charts/splunk-otel-collector/templates/deployment-cluster-receiver.yaml b/helm-charts/splunk-otel-collector/templates/deployment-cluster-receiver.yaml
@@ -77,10 +77,8 @@ spec:
         ` }}
         {{- $clusterReceiver.affinity | mustMergeOverwrite (fromYaml $clusterReceiverPodAntiAffinity) | toYaml | nindent 8 }}
       {{- end }}
-      {{- if $clusterReceiver.securityContext }}
       securityContext:
-        {{ toYaml $clusterReceiver.securityContext | nindent 8 }}
-      {{- end }}
+        {{- include "splunk-otel-collector.securityContext" (dict "isWindows" .Values.isWindows "securityContext" $clusterReceiver.securityContext) | nindent 8 }}
       {{- if eq (include "splunk-otel-collector.distribution" .) "eks/fargate" }}
       initContainers:
         - name: cluster-receiver-node-discoverer

diff --git a/helm-charts/splunk-otel-collector/templates/deployment-gateway.yaml b/helm-charts/splunk-otel-collector/templates/deployment-gateway.yaml
@@ -57,10 +57,8 @@ spec:
       affinity:
         {{- toYaml $gateway.affinity | nindent 8 }}
       {{- end }}
-      {{- if $gateway.securityContext }}
       securityContext:
-        {{ toYaml $gateway.securityContext | nindent 8 }}
-      {{- end }}
+        {{- include "splunk-otel-collector.securityContext" (dict "isWindows" .Values.isWindows "securityContext" $gateway.securityContext) | nindent 8 }}
       containers:
       - name: otel-collector
         command:

diff --git a/helm-charts/splunk-otel-collector/templates/revert-patch-log-dirs-hook.yaml b/helm-charts/splunk-otel-collector/templates/revert-patch-log-dirs-hook.yaml
@@ -1,4 +1,4 @@
-{{- if or (and (.Values.fluentd.securityContext.runAsUser) (.Values.fluentd.securityContext.runAsGroup)) (and (.Values.agent.securityContext.runAsUser) (.Values.agent.securityContext.runAsGroup)) }}
+{{- if or (and (.Values.fluentd.securityContext.runAsUser) (.Values.fluentd.securityContext.runAsGroup) (not .Values.isWindows) ) (and (.Values.agent.securityContext.runAsUser) (.Values.agent.securityContext.runAsGroup) (not .Values.isWindows) ) }}
 apiVersion: v1
 kind: Pod
 metadata: