help request: FluentBit Daemonset getting mkdir Operation not permitted in Openshift env

[zeagur]

Describe the issue

In Openshift Env when I deploy Fluentbit using either plain yaml file or helm, the Daemonset of Fluentbit will spawn a pods with ContainerCreation error

Error: failed to mkdir /containers: mkdir /containers: operation not permitted

below is the snippet of value.yaml I'm using.

operator:
  initcontainer:
    repository: "docker"
    tag: "20.10"
    resources:
      limits:
        cpu: 100m
        memory: 64Mi
      requests:
        cpu: 50m
        memory: 64Mi
  container:
    repository: "kubesphere/fluent-operator"
    tag: "v2.4.0"
  nodeSelector: {}
  tolerations: []
  priorityClassName: ""
  podSecurityContext: {}
  securityContext: {}
  resources:
    limits:
      cpu: 100m
      memory: 256Mi
    requests:
      cpu: 100m
      memory: 64Mi
fluentbit:
  crdsEnable: true
  enable: true
  image:
    repository: "kubesphere/fluent-bit"
    tag: "v2.1.8"
  resources:
    limits:
      cpu: 500m
      memory: 200Mi
    requests:
      cpu: 10m
      memory: 50Mi
  labels: {}

  imagePullSecrets: []
  secrets: []
  podSecurityContext:
    privileged: true
  securityContext: {}
  additionalVolumes: []
  additionalVolumesMounts: []
  affinity:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
          - matchExpressions:
              - key: node-role.kubernetes.io/edge
                operator: DoesNotExist

How did you install fluent operator?

Helm, and Plain yaml from walkthrough

Additional context

No response

[tapasmishra]

Do we have any workaround for the above issue?

[TomStary]

Try moving the configuration from podSecurityContext to securityContext in the fluentbit section.

[beefke]

It works when I change the following line in the init container of the fluent operator:

        - set -ex;
          echo CONTAINER_ROOT_DIR=$(docker info -f '{{.DockerRootDir}}' 2> /dev/null) > /fluent-operator/fluent-bit.env

to

        - set -ex;
          echo CONTAINER_ROOT_DIR=/var/lib > /fluent-operator/fluent-bit.env

Can we have a helm variable to change this (for example containerPathPrefix: /var/lib)?

[beefke]

No need for a helm variable, as it is already there. You need to set the containerRuntime to crio and set the path accordingly:

containerRuntime: crio

operator:
  resources:
    limits:
      memory: 500Mi
  disableComponentControllers: "fluentd"
  logPath:
    crio: /var/lib

[joshuabaird]

This issue is being closed due to inactivity. Please re-open if it is still relevant.