Update Fleet Server quickstart documentation to use emptyDir for agent-data volumes #6563
Conversation
the default value is to use an host path Volume, that can be restricted by a podSecurityPolicy
| @@ -64,6 +67,9 @@ spec: | |||
| automountServiceAccountToken: true | |||
| securityContext: | |||
| runAsUser: 0 | |||
| volumes: | |||
| - name: agent-data | |||
| emptyDir: {} # may not be suited for production, the default value is to use host path volume | |||
There was a problem hiding this comment.
I would only do this for Fleet server. Which afaik does not actually need to persist state. While regular Agents running integrations do need this.
There was a problem hiding this comment.
ok, will remove the comment too as it is not that useful in the fleet server case
There was a problem hiding this comment.
I would only do this for Fleet server.
IIUC last commit removed the emptyDir on the Fleet server.
Also:
- The use of
emptyDiris documented in theStoring local state in host path volumesection, at the end of this document. Should we update it to mention security restrictions, and the fact that it is not required for Fleet Server (which is a TIL for me btw)? - Should we just not try to use an
hostpathif Fleet Server is enabled? (to be done in a separate issue/pr ofc)
There was a problem hiding this comment.
and the fact that it is not required for Fleet Server (which is a TIL for me btw)?
Your question makes me doubt my conviction. Let's verify this before we merge.
There was a problem hiding this comment.
I have not been able to get an answer from the Fleet team on this. However given that we are running Fleet server as a deployment and the chance is high that the on eviction or deletion of the Pod we end up on a different k8s node, I think we are good to merge this as is.
rhr323
changed the title
thbkrkr
changed the title
The default value is to use a host path Volume, that can be restricted by a podSecurityPolicy.
When there is such a podSecurityPolicy, the pod is not created and the cause of the error is lost in the event of the ECK created ReplicaSet. But in the
fleet-server-quickstartevents you can see a reconciliation error:Reconciliation error: failed to request https://kibana-quickstart-kb-http.default.svc:5601/api/fleet/setup, status is 401which is not the real problem.This proposed change would avoid this situation by following the workaround that we have when host path is not possible. This is not optimal for production but this is a QuickStart ;-)