Extend options for setting security context #1647

dmitryax · 2025-02-05T01:43:07Z

Add option to set security contexts on:

container in the clusterRecever deployment
container in the gateway deployment
agent pod

dmitryax · 2025-02-05T01:46:10Z

helm-charts/splunk-otel-collector/values.schema.json

@@ -577,9 +577,36 @@
            }
          }
        },
+        "podSecurityContext": {
+          "type": "object"
+        },
        "securityContext": {


This can also be deprecated in favor of containerSecurityContext but I think we can defer that until fluentd is removed

helm-charts/splunk-otel-collector/templates/daemonset.yaml

jvoravong · 2025-02-05T14:45:54Z

helm-charts/splunk-otel-collector/templates/NOTES.txt

+{{ end }}
+{{- if not (eq (toString .Values.clusterReceiver.securityContext) "<nil>") }}
+[WARNING] "clusterReceiver.securityContext" parameter is deprecated. Please use "clusterReceiver.podSecurityContext" instead.
+{{ end }}


Nit: Can we throw a failure or print a warning if one of the following cases happens? I just want to avoid confusion about which of the two available values (securityContext vs podSecurityContext) will be used. Maybe just update the message to say podSecurityContext takes priority.

Both clusterReceiver.securityContext and clusterReceiver.podSecurityContext are both used

Both gateway.securityContext and gateway.podSecurityContext are both used

I'm not sure I understand your suggestion. Please submit a suggesting diff

Working on this. Need to state this PR relates to #1342

jinja2

We are missing updates in few places in this block. I think it should be updated to podSecurityContext instead. Actually, we might have to do some checking to see which of the 2 (pod or container) securityContext has runAsUser set. Both can have this field.

jinja2 · 2025-02-05T16:59:09Z

Another thing - do we know if the original ask also wants a way to set the context on initContainer? I know these only come into play when logs are enabled, but best to check if we need to include those.

jvoravong · 2025-02-05T17:10:19Z

Another thing - do we know if the original ask also wants a way to set the context on initContainer? I know these only come into play when logs are enabled, but best to check if we need to include those.

From my current understanding initContainers are used by the agent daemonset to update permissions for enabling collecting logs and all 3 agent modes to enable using persistent data exporter queues normally only used by Splunk Enterprise/Platform customers.

Maybe we enable setting security context for initContainers and containers in a future PR for iterative growth.

dmitryax · 2025-02-05T17:33:36Z

We are missing updates in few places in this block. I think it should be updated to podSecurityContext instead. Actually, we might have to do some checking to see which of the 2 (pod or container) securityContext has runAsUser set. Both can have this field.

I've actually started with adding this to the init containers as well, but I'm afraid of unnecessarily bloating up the config interface, see the first version in 74e35dd. I think we can start without it at this point, see if it's needed for users, then add it. WDYT?

Another thing - do we know if the original ask also wants a way to set the context on initContainer? I know these only come into play when logs are enabled, but best to check if we need to include those.

No, as far as I know. That's why I removed it eventually

Add options to set container security contexts in clusterRecever and gateway deployments.

jvoravong · 2025-02-05T18:56:05Z

helm-charts/splunk-otel-collector/templates/deployment-gateway.yaml

      securityContext:
-        {{- include "splunk-otel-collector.securityContext" (dict "isWindows" .Values.isWindows "securityContext" $gateway.securityContext) | nindent 8 }}
+        {{- include "splunk-otel-collector.securityContext" (dict "isWindows" .Values.isWindows "securityContext" $podSecurityContext) | nindent 8 }}


Suggested change

{{- include "splunk-otel-collector.securityContext" (dict "isWindows" .Values.isWindows "securityContext" $podSecurityContext) | nindent 8 }}

{{- include "splunk-otel-collector.securityContext" (dict "isWindows" .Values.isWindows "securityContext" $gateway.podSecurityContext) | nindent 8 }}

jvoravong · 2025-02-05T18:56:34Z

helm-charts/splunk-otel-collector/templates/deployment-cluster-receiver.yaml

      securityContext:
-        {{- include "splunk-otel-collector.securityContext" (dict "isWindows" .Values.isWindows "securityContext" $clusterReceiver.securityContext) | nindent 8 }}
+        {{- include "splunk-otel-collector.securityContext" (dict "isWindows" .Values.isWindows "securityContext" $podSecurityContext) | nindent 8 }}


Suggested change

{{- include "splunk-otel-collector.securityContext" (dict "isWindows" .Values.isWindows "securityContext" $podSecurityContext) | nindent 8 }}

{{- include "splunk-otel-collector.securityContext" (dict "isWindows" .Values.isWindows "clusterReceiver.securityContext" $podSecurityContext) | nindent 8 }}

jinja2 · 2025-02-05T19:14:57Z

helm-charts/splunk-otel-collector/templates/NOTES.txt

+{{- if not (eq (toString .Values.clusterReceiver.securityContext) "<nil>") }}
+[WARNING] "clusterReceiver.securityContext" parameter is deprecated. Please use "clusterReceiver.podSecurityContext" instead.
+{{ end }}


Suggested change

{{- if not (eq (toString .Values.clusterReceiver.securityContext) "<nil>") }}

[WARNING] "clusterReceiver.securityContext" parameter is deprecated. Please use "clusterReceiver.podSecurityContext" instead.

{{ end }}

{{- if not (eq (toString .Values. clusterReceiver.securityContext) "<nil>") }}

{{- if .Values. clusterReceiver.podSecurityContext }}

[WARNING] "clusterReceiver.securityContext" parameter is deprecated. Helm release will use values set in "clusterReceiver.podSecurityContext" instead.

{{- else }}

[WARNING] "clusterReceiver.securityContext" parameter is deprecated. Please use "clusterReceiver.podSecurityContext" instead.

{{- end }}

{{ end }}

@jvoravong is this what you are suggesting? How does the PR you referenced relate to this one? Tmk this is a different ask

dmitryax requested review from a team as code owners February 5, 2025 01:43

dmitryax force-pushed the add-container-security-context branch from de73aef to c7a1e20 Compare February 5, 2025 01:43

dmitryax commented Feb 5, 2025

View reviewed changes

dmitryax force-pushed the add-container-security-context branch 2 times, most recently from 5e3db36 to 74e35dd Compare February 5, 2025 01:50

atoulme reviewed Feb 5, 2025

View reviewed changes

helm-charts/splunk-otel-collector/templates/daemonset.yaml Outdated Show resolved Hide resolved

dmitryax force-pushed the add-container-security-context branch from 74e35dd to dfadbbe Compare February 5, 2025 07:09

dmitryax changed the title ~~Allow setting security context on containers~~ Extend options for setting security context Feb 5, 2025

jvoravong reviewed Feb 5, 2025

View reviewed changes

jvoravong approved these changes Feb 5, 2025

View reviewed changes

jinja2 reviewed Feb 5, 2025

View reviewed changes

Extend options for setting security context

12dcb22

Add options to set container security contexts in clusterRecever and gateway deployments.

dmitryax force-pushed the add-container-security-context branch from dfadbbe to 12dcb22 Compare February 5, 2025 18:50

jvoravong reviewed Feb 5, 2025

View reviewed changes

jinja2 approved these changes Feb 5, 2025

View reviewed changes

jinja2 reviewed Feb 5, 2025

View reviewed changes

dmitryax merged commit 12d08d6 into main Feb 5, 2025
64 of 65 checks passed

dmitryax deleted the add-container-security-context branch February 5, 2025 19:20

github-actions bot locked and limited conversation to collaborators Feb 5, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Extend options for setting security context #1647

Extend options for setting security context #1647

dmitryax commented Feb 5, 2025 •

edited

Loading

dmitryax Feb 5, 2025

jvoravong Feb 5, 2025 •

edited

Loading

dmitryax Feb 5, 2025

jvoravong Feb 5, 2025

jinja2 left a comment •

edited

Loading

jinja2 commented Feb 5, 2025

jvoravong commented Feb 5, 2025 •

edited

Loading

dmitryax commented Feb 5, 2025

jvoravong Feb 5, 2025

dmitryax Feb 5, 2025

jvoravong Feb 5, 2025

dmitryax Feb 5, 2025

jinja2 Feb 5, 2025

	{{- include "splunk-otel-collector.securityContext" (dict "isWindows" .Values.isWindows "securityContext" $podSecurityContext) \| nindent 8 }}
	{{- include "splunk-otel-collector.securityContext" (dict "isWindows" .Values.isWindows "securityContext" $gateway.podSecurityContext) \| nindent 8 }}

Extend options for setting security context #1647

Extend options for setting security context #1647

Conversation

dmitryax commented Feb 5, 2025 • edited Loading

Choose a reason for hiding this comment

jvoravong Feb 5, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jinja2 left a comment • edited Loading

Choose a reason for hiding this comment

jinja2 commented Feb 5, 2025

jvoravong commented Feb 5, 2025 • edited Loading

dmitryax commented Feb 5, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

dmitryax commented Feb 5, 2025 •

edited

Loading

jvoravong Feb 5, 2025 •

edited

Loading

jinja2 left a comment •

edited

Loading

jvoravong commented Feb 5, 2025 •

edited

Loading