Latest commit to helm template server-statefulsets.yaml breaks installation on docker for desktop installs about vault-helm

[rodfrancisco]

@jasonodonnell

[jasonodonnell]

Hi @rodfrancisco, thanks for bringing this to my attention.

I can make this configurable to support your use case. Would this help?

[rodfrancisco]

@jasonodonnell That works. Thanks for the quick turnaround.

[jemc]

Why was this made to be configurable instead of removed altogether?

This is flat-out invalid Kubernetes config, so even if you want to turn it on, it won't work. As indicated in the error message, PodSecurityContext does not have this readOnlyRootFilesystem field at all. You can confirm this by checking the Kubernetes API docs for it

@jasonodonnell - did you ever do a successful deployment with the field present?

[jasonodonnell]

Hi @jemc ,

I've just deployed it successfully to multiple Kubernetes clusters without error. I'm wondering if Kube isn't validating the object and just disregarding it.

I'll look into removing this and trying to understand why it's not showing up on my end or in the test clusters. Thanks

[malnick]

@jemc @jasonodonnell Looking at the docs link it looks like this setting belongs in the container security context this line

vault-helm/templates/server-statefulset.yaml

Line 53 in 36ab801

securityContext:

, not the global line we already removed it from.

PodSecurityPolicySpec v1beta1 policy (so unfortunate that we can't link to settings on this docs page) defines it under the container spec. So if we add it there, it should be picked up. I do think we should make it configurable.