1

I am setting up OpenDistro for Elastic in Kubernetes. The cluster has pod security in place that will not allow privileged pods. When I start the cluster the logs indicated a permission issue with /usr/share/supervisor/supervisord.log

I have a securityContext set on the deployment

securityContext:
  runAsUser: 1000
  fsGroup: 1000
``

The error message from kubectl logs es-master-0 is
```/usr/share/elasticsearch/config/elasticsearch.yml seems to be already configured for Security. Quit.
Traceback (most recent call last):
  File "/usr/bin/supervisord", line 9, in <module>
    load_entry_point('supervisor==4.0.2', 'console_scripts', 'supervisord')()
  File "/usr/lib/python2.7/site-packages/supervisor-4.0.2-py2.7.egg/supervisor/supervisord.py", line 358, in main
    go(options)
  File "/usr/lib/python2.7/site-packages/supervisor-4.0.2-py2.7.egg/supervisor/supervisord.py", line 368, in go
    d.main()
  File "/usr/lib/python2.7/site-packages/supervisor-4.0.2-py2.7.egg/supervisor/supervisord.py", line 70, in main
    self.options.make_logger()
  File "/usr/lib/python2.7/site-packages/supervisor-4.0.2-py2.7.egg/supervisor/options.py", line 1472, in make_logger
    backups=self.logfile_backups,
  File "/usr/lib/python2.7/site-packages/supervisor-4.0.2-py2.7.egg/supervisor/loggers.py", line 417, in handle_file
    handler = RotatingFileHandler(filename, 'a', maxbytes, backups)
  File "/usr/lib/python2.7/site-packages/supervisor-4.0.2-py2.7.egg/supervisor/loggers.py", line 212, in __init__
    FileHandler.__init__(self, filename, mode)
  File "/usr/lib/python2.7/site-packages/supervisor-4.0.2-py2.7.egg/supervisor/loggers.py", line 159, in __init__
    self.stream = open(filename, mode)
IOError: [Errno 13] Permission denied: '/usr/share/supervisor/supervisord.log'
isaacnc
  • 11
  • 1
  • Hi isaacnc, welcome to SO. Without seeing your entire `Deployment` descriptor and/or any customized `Dockerfile` it's impossible to know what setting might be wrong. Please [edit your question](https://stackoverflow.com/posts/56178106/edit) to include more details, not just the error message – mdaniel May 17 '19 at 14:31
  • Separately, you will want to use a [`StatefulSet`](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/), not a `Deployment` for services in the cluster that have "identity," such as Elasticsearch or Postgres etc – mdaniel May 17 '19 at 14:32
  • Thank you both. I've found a solution using an initcontainer and will create a PR to the OpenDistro community github repo. I think this boils down to kubernetes security practice rather than any good or bad configuration. I didn't have this problem on minikube, only on the company cluster. Cheers – isaacnc May 19 '19 at 20:10

0 Answers0