diff --git a/roles/rke2/templates/manifests/deploy-rancher-logging.j2 b/roles/rke2/templates/manifests/deploy-rancher-logging.j2 index 45b1d6420d00c8c5a32d08958bf9374707c618ce..03a6e61184700585ed8b25e5b5d0ece98e2f6330 100644 --- a/roles/rke2/templates/manifests/deploy-rancher-logging.j2 +++ b/roles/rke2/templates/manifests/deploy-rancher-logging.j2 @@ -3,7 +3,7 @@ kind: Namespace apiVersion: v1 metadata: - name: kube-system + name: cattle-logging-system --- @@ -16,11 +16,11 @@ spec: repo: {{ item.value.repo | default("https://charts.rancher.io") }} chart: rancher-logging-crd version: {{ item.value.version | default("3.15.0") }} - targetNamespace: kube-system + targetNamespace: cattle-logging-system --- - #CreateContainerConfigError (container has runAsNonRoot and image has non-numeric user (fluent), cannot verify user is non-root (pod: "rancher-logging-root-fluentd-0_cattle-logging-system(abba9ac8-72a3-469e-b4e3-f04d942ade09)", container: fluentd)) + apiVersion: helm.cattle.io/v1 kind: HelmChart metadata: @@ -30,7 +30,7 @@ spec: repo: {{ item.value.repo | default("https://charts.rancher.io") }} chart: rancher-logging version: {{ item.value.version | default("3.15.0") }} - targetNamespace: kube-system + targetNamespace: cattle-logging-system valuesContent: |- createCustomResource: true global: @@ -39,11 +39,14 @@ spec: additionalLoggingSources: rke2: enabled: true - debug: true + podSecurityContext: + runAsNonRoot: true + runAsUser: 1000 + SecurityContext: + runAsNonRoot: true + runAsUser: 1000 -# Moving it into kube-system as a last resort cause there it can run unrestricted, this might not work due to network, lets try # Need for fluentd statefulset the Security Context RunasUser -# when running it runAsUser it needs perms /usr/lib/ruby/2.7.0/logger/log_device.rb:103:in `initialize': Permission denied @ rb_sysopen - /fluentd/log/out (Errno::EACCES) --- apiVersion: helm.cattle.io/v1 @@ -55,7 +58,7 @@ spec: repo: {{ item.value.repo | default("https://grafana.github.io/helm-charts") }} chart: loki version: {{ item.value.lokiversion | default("2.11.1") }} - targetNamespace: kube-system + targetNamespace: cattle-logging-system