[chart] use security context under container level to allow setting a…

…dditional permissions
signalfx · Feb 3, 2025 · 4453e8b · 4453e8b
1 parent 56f18c7
commit 4453e8b
Show file tree

Hide file tree

Showing 37 changed files with 336 additions and 10 deletions.
diff --git a/.chloggen/movesecuritycontexttocontainers.yaml b/.chloggen/movesecuritycontexttocontainers.yaml
@@ -0,0 +1,12 @@
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: enhancement
+# The name of the component, or a single word describing the area of concern, (e.g. agent, clusterReceiver, gateway, operator, chart, other)
+component: chart
+# A brief description of the change. Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: use security context under container level to allow setting additional permissions
+# One or more tracking issues related to the change
+issues: []
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext:
diff --git a/examples/add-filter-processor/rendered_manifests/deployment-cluster-receiver.yaml b/examples/add-filter-processor/rendered_manifests/deployment-cluster-receiver.yaml
@@ -43,6 +43,15 @@ spec:
         - --config=/conf/relay.yaml
         image: quay.io/signalfx/splunk-otel-collector:0.117.0
         imagePullPolicy: IfNotPresent
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 20000
+          runAsNonRoot: true
+          runAsUser: 20000
         env:
           - name: SPLUNK_MEMORY_TOTAL_MIB
             value: "500"

diff --git a/examples/add-kafkametrics-receiver/rendered_manifests/deployment-cluster-receiver.yaml b/examples/add-kafkametrics-receiver/rendered_manifests/deployment-cluster-receiver.yaml
@@ -43,6 +43,15 @@ spec:
         - --config=/conf/relay.yaml
         image: quay.io/signalfx/splunk-otel-collector:0.117.0
         imagePullPolicy: IfNotPresent
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 20000
+          runAsNonRoot: true
+          runAsUser: 20000
         env:
           - name: SPLUNK_MEMORY_TOTAL_MIB
             value: "500"

diff --git a/examples/add-receiver-creator/rendered_manifests/deployment-cluster-receiver.yaml b/examples/add-receiver-creator/rendered_manifests/deployment-cluster-receiver.yaml
@@ -43,6 +43,15 @@ spec:
         - --config=/conf/relay.yaml
         image: quay.io/signalfx/splunk-otel-collector:0.117.0
         imagePullPolicy: IfNotPresent
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 20000
+          runAsNonRoot: true
+          runAsUser: 20000
         env:
           - name: SPLUNK_MEMORY_TOTAL_MIB
             value: "500"

diff --git a/examples/add-sampler/rendered_manifests/deployment-cluster-receiver.yaml b/examples/add-sampler/rendered_manifests/deployment-cluster-receiver.yaml
@@ -43,6 +43,15 @@ spec:
         - --config=/conf/relay.yaml
         image: quay.io/signalfx/splunk-otel-collector:0.117.0
         imagePullPolicy: IfNotPresent
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 20000
+          runAsNonRoot: true
+          runAsUser: 20000
         env:
           - name: SPLUNK_MEMORY_TOTAL_MIB
             value: "500"

diff --git a/examples/autodetect-istio/rendered_manifests/deployment-cluster-receiver.yaml b/examples/autodetect-istio/rendered_manifests/deployment-cluster-receiver.yaml
@@ -44,6 +44,15 @@ spec:
         - --config=/conf/relay.yaml
         image: quay.io/signalfx/splunk-otel-collector:0.117.0
         imagePullPolicy: IfNotPresent
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 20000
+          runAsNonRoot: true
+          runAsUser: 20000
         env:
           - name: SPLUNK_MEMORY_TOTAL_MIB
             value: "500"

diff --git a/examples/collector-all-modes/rendered_manifests/deployment-cluster-receiver.yaml b/examples/collector-all-modes/rendered_manifests/deployment-cluster-receiver.yaml
@@ -43,6 +43,15 @@ spec:
         - --config=/conf/relay.yaml
         image: quay.io/signalfx/splunk-otel-collector:0.117.0
         imagePullPolicy: IfNotPresent
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 20000
+          runAsNonRoot: true
+          runAsUser: 20000
         env:
           - name: SPLUNK_MEMORY_TOTAL_MIB
             value: "500"

diff --git a/examples/collector-all-modes/rendered_manifests/deployment-gateway.yaml b/examples/collector-all-modes/rendered_manifests/deployment-gateway.yaml
@@ -43,6 +43,15 @@ spec:
         - --config=/conf/relay.yaml
         image: quay.io/signalfx/splunk-otel-collector:0.117.0
         imagePullPolicy: IfNotPresent
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 20000
+          runAsNonRoot: true
+          runAsUser: 20000
         env:
           - name: SPLUNK_MEMORY_TOTAL_MIB
             value: "8192"

diff --git a/examples/collector-cluster-receiver-only/rendered_manifests/deployment-cluster-receiver.yaml b/examples/collector-cluster-receiver-only/rendered_manifests/deployment-cluster-receiver.yaml
@@ -43,6 +43,15 @@ spec:
         - --config=/conf/relay.yaml
         image: quay.io/signalfx/splunk-otel-collector:0.117.0
         imagePullPolicy: IfNotPresent
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 20000
+          runAsNonRoot: true
+          runAsUser: 20000
         env:
           - name: SPLUNK_MEMORY_TOTAL_MIB
             value: "500"

diff --git a/examples/collector-gateway-only/rendered_manifests/deployment-gateway.yaml b/examples/collector-gateway-only/rendered_manifests/deployment-gateway.yaml
@@ -43,6 +43,15 @@ spec:
         - --config=/conf/relay.yaml
         image: quay.io/signalfx/splunk-otel-collector:0.117.0
         imagePullPolicy: IfNotPresent
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 20000
+          runAsNonRoot: true
+          runAsUser: 20000
         env:
           - name: SPLUNK_MEMORY_TOTAL_MIB
             value: "4096"

diff --git a/examples/controlplane-histogram-metrics/rendered_manifests/deployment-cluster-receiver.yaml b/examples/controlplane-histogram-metrics/rendered_manifests/deployment-cluster-receiver.yaml
@@ -43,6 +43,15 @@ spec:
         - --config=/conf/relay.yaml
         image: quay.io/signalfx/splunk-otel-collector:0.117.0
         imagePullPolicy: IfNotPresent
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 20000
+          runAsNonRoot: true
+          runAsUser: 20000
         env:
           - name: SPLUNK_MEMORY_TOTAL_MIB
             value: "500"

diff --git a/examples/crio-logging/rendered_manifests/deployment-cluster-receiver.yaml b/examples/crio-logging/rendered_manifests/deployment-cluster-receiver.yaml
@@ -43,6 +43,15 @@ spec:
         - --config=/conf/relay.yaml
         image: quay.io/signalfx/splunk-otel-collector:0.117.0
         imagePullPolicy: IfNotPresent
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 20000
+          runAsNonRoot: true
+          runAsUser: 20000
         env:
           - name: SPLUNK_MEMORY_TOTAL_MIB
             value: "500"

diff --git a/examples/default/rendered_manifests/deployment-cluster-receiver.yaml b/examples/default/rendered_manifests/deployment-cluster-receiver.yaml
@@ -43,6 +43,15 @@ spec:
         - --config=/conf/relay.yaml
         image: quay.io/signalfx/splunk-otel-collector:0.117.0
         imagePullPolicy: IfNotPresent
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 20000
+          runAsNonRoot: true
+          runAsUser: 20000
         env:
           - name: SPLUNK_MEMORY_TOTAL_MIB
             value: "500"

diff --git a/...ples/disable-persistence-queue-traces/rendered_manifests/deployment-cluster-receiver.yaml b/...ples/disable-persistence-queue-traces/rendered_manifests/deployment-cluster-receiver.yaml
@@ -43,6 +43,15 @@ spec:
         - --config=/conf/relay.yaml
         image: quay.io/signalfx/splunk-otel-collector:0.117.0
         imagePullPolicy: IfNotPresent
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 20000
+          runAsNonRoot: true
+          runAsUser: 20000
         env:
           - name: SPLUNK_MEMORY_TOTAL_MIB
             value: "500"

diff --git a/examples/distribution-aks/rendered_manifests/deployment-cluster-receiver.yaml b/examples/distribution-aks/rendered_manifests/deployment-cluster-receiver.yaml
@@ -43,6 +43,15 @@ spec:
         - --config=/conf/relay.yaml
         image: quay.io/signalfx/splunk-otel-collector:0.117.0
         imagePullPolicy: IfNotPresent
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 20000
+          runAsNonRoot: true
+          runAsUser: 20000
         env:
           - name: SPLUNK_MEMORY_TOTAL_MIB
             value: "500"

diff --git a/examples/distribution-eks-fargate/rendered_manifests/deployment-cluster-receiver.yaml b/examples/distribution-eks-fargate/rendered_manifests/deployment-cluster-receiver.yaml
@@ -76,6 +76,15 @@ spec:
         - --config=/splunk-messages/config.yaml
         image: quay.io/signalfx/splunk-otel-collector:0.117.0
         imagePullPolicy: IfNotPresent
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 20000
+          runAsNonRoot: true
+          runAsUser: 20000
         env:
           - name: SPLUNK_MEMORY_TOTAL_MIB
             value: "500"

diff --git a/examples/distribution-eks-fargate/rendered_manifests/deployment-gateway.yaml b/examples/distribution-eks-fargate/rendered_manifests/deployment-gateway.yaml
@@ -43,6 +43,15 @@ spec:
         - --config=/conf/relay.yaml
         image: quay.io/signalfx/splunk-otel-collector:0.117.0
         imagePullPolicy: IfNotPresent
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 20000
+          runAsNonRoot: true
+          runAsUser: 20000
         env:
           - name: SPLUNK_MEMORY_TOTAL_MIB
             value: "8192"

diff --git a/examples/distribution-eks/rendered_manifests/deployment-cluster-receiver.yaml b/examples/distribution-eks/rendered_manifests/deployment-cluster-receiver.yaml
@@ -43,6 +43,15 @@ spec:
         - --config=/conf/relay.yaml
         image: quay.io/signalfx/splunk-otel-collector:0.117.0
         imagePullPolicy: IfNotPresent
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 20000
+          runAsNonRoot: true
+          runAsUser: 20000
         env:
           - name: SPLUNK_MEMORY_TOTAL_MIB
             value: "500"

diff --git a/examples/distribution-gke-autopilot/rendered_manifests/deployment-cluster-receiver.yaml b/examples/distribution-gke-autopilot/rendered_manifests/deployment-cluster-receiver.yaml
@@ -43,6 +43,15 @@ spec:
         - --config=/conf/relay.yaml
         image: quay.io/signalfx/splunk-otel-collector:0.117.0
         imagePullPolicy: IfNotPresent
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 20000
+          runAsNonRoot: true
+          runAsUser: 20000
         env:
           - name: SPLUNK_MEMORY_TOTAL_MIB
             value: "500"

diff --git a/examples/distribution-gke/rendered_manifests/deployment-cluster-receiver.yaml b/examples/distribution-gke/rendered_manifests/deployment-cluster-receiver.yaml
@@ -43,6 +43,15 @@ spec:
         - --config=/conf/relay.yaml
         image: quay.io/signalfx/splunk-otel-collector:0.117.0
         imagePullPolicy: IfNotPresent
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 20000
+          runAsNonRoot: true
+          runAsUser: 20000
         env:
           - name: SPLUNK_MEMORY_TOTAL_MIB
             value: "500"

diff --git a/examples/distribution-openshift/rendered_manifests/deployment-cluster-receiver.yaml b/examples/distribution-openshift/rendered_manifests/deployment-cluster-receiver.yaml
@@ -43,6 +43,15 @@ spec:
         - --config=/conf/relay.yaml
         image: quay.io/signalfx/splunk-otel-collector:0.117.0
         imagePullPolicy: IfNotPresent
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 20000
+          runAsNonRoot: true
+          runAsUser: 20000
         env:
           - name: SPLUNK_MEMORY_TOTAL_MIB
             value: "500"

diff --git a/...ble-operator-and-auto-instrumentation/rendered_manifests/deployment-cluster-receiver.yaml b/...ble-operator-and-auto-instrumentation/rendered_manifests/deployment-cluster-receiver.yaml
@@ -43,6 +43,15 @@ spec:
         - --config=/conf/relay.yaml
         image: quay.io/signalfx/splunk-otel-collector:0.117.0
         imagePullPolicy: IfNotPresent
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 20000
+          runAsNonRoot: true
+          runAsUser: 20000
         env:
           - name: SPLUNK_MEMORY_TOTAL_MIB
             value: "500"

diff --git a/examples/enable-persistence-queue/rendered_manifests/deployment-cluster-receiver.yaml b/examples/enable-persistence-queue/rendered_manifests/deployment-cluster-receiver.yaml
@@ -43,6 +43,15 @@ spec:
         - --config=/conf/relay.yaml
         image: quay.io/signalfx/splunk-otel-collector:0.117.0
         imagePullPolicy: IfNotPresent
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 20000
+          runAsNonRoot: true
+          runAsUser: 20000
         env:
           - name: SPLUNK_MEMORY_TOTAL_MIB
             value: "500"

diff --git a/examples/enabled-pprof-extension/rendered_manifests/deployment-cluster-receiver.yaml b/examples/enabled-pprof-extension/rendered_manifests/deployment-cluster-receiver.yaml
@@ -43,6 +43,15 @@ spec:
         - --config=/conf/relay.yaml
         image: quay.io/signalfx/splunk-otel-collector:0.117.0
         imagePullPolicy: IfNotPresent
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 20000
+          runAsNonRoot: true
+          runAsUser: 20000
         env:
           - name: SPLUNK_MEMORY_TOTAL_MIB
             value: "500"

diff --git a/...entd-multiline-logs-java-stack-traces/rendered_manifests/deployment-cluster-receiver.yaml b/...entd-multiline-logs-java-stack-traces/rendered_manifests/deployment-cluster-receiver.yaml
@@ -43,6 +43,15 @@ spec:
         - --config=/conf/relay.yaml
         image: quay.io/signalfx/splunk-otel-collector:0.117.0
         imagePullPolicy: IfNotPresent
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 20000
+          runAsNonRoot: true
+          runAsUser: 20000
         env:
           - name: SPLUNK_MEMORY_TOTAL_MIB
             value: "500"