Added instructions for daemonsets on OpenShift #346
Conversation
|
This change is |
Codecov Report
@@ Coverage Diff @@
## master #346 +/- ##
=======================================
Coverage 91.67% 91.67%
=======================================
Files 64 64
Lines 3170 3170
=======================================
Hits 2906 2906
Misses 184 184
Partials 80 80Continue to review full report at Codecov.
|
README.adoc
Outdated
| @@ -96,6 +92,36 @@ oc create \ | |||
|
|
|||
| After the role is granted, switch back to a non-privileged user. | |||
|
|
|||
| Jaeger Agent can be configured to be deployed as a `DaemonSet` using a `HostPort` to allow Jaeger clients in the same node to discover the agent. In OpenShift, a `HostPort` can only be set when a special security context is set. A security context constraint allowing `DaemonSet` components to bind to a `HostPort` can be specified as follows: | |||
There was a problem hiding this comment.
Shouldn't this text all be before the previous statement, switching back to the non-privileged user?
Security concern - isn't this potentially enabling non-privileged users to deploy daemonsets on host ports? Isn't there a way to just grant the permission to the Jaeger operator, and the non-privileged user is then only able to deploy a Jaeger instance, which indirectly deploys daemonset with hostport?
There was a problem hiding this comment.
Shouldn't this text all be before the previous statement, switching back to the non-privileged user?
Possibly. The reasoning is that users will only need to read on if they plan to allow agents as daemonsets.
Security concern - isn't this potentially enabling non-privileged users to deploy daemonsets on host ports?
Yes, and good question. Would you know who might be able to help us here?
jpkrohling
force-pushed
the
Instructions-for-DaemonSet
branch
2 times, most recently
from
54f1be4 to
fcfd560
Compare
Closes jaegertracing#459 Signed-off-by: Juraci Paixão Kröhling <[email protected]>
jpkrohling
force-pushed
the
Instructions-for-DaemonSet
branch
from
fcfd560 to
c80511c
Compare
|
@objectiser, @kevinearls I changed this PR with the results of my latest tests on OpenShift 4. Could you please take a look and give it a try as well? @rcernich, do you think the instructions from this PR are sufficient to fix #459? |
Signed-off-by: Juraci Paixão Kröhling <[email protected]>
README.adoc
Outdated
|
|
||
| [source,bash] | ||
| ---- | ||
| oc create -f https://raw.githubusercontent.com/jaegertracing/jaeger-operator/master/deploy/hostport-scc-daemonset.yaml # <1> |
There was a problem hiding this comment.
Need to update the URL as moved to examples/openshift
README.adoc
Outdated
| oc create -f https://raw.githubusercontent.com/jaegertracing/jaeger-operator/master/deploy/hostport-scc-daemonset.yaml # <1> | ||
|
|
||
| oc new-project myappnamespace | ||
| oc create -f https://raw.githubusercontent.com/jaegertracing/jaeger-operator/master/deploy/service_account_jaeger-agent-daemonset.yaml # <2> |
Signed-off-by: Juraci Paixão Kröhling <[email protected]>
Signed-off-by: Juraci Paixão Kröhling [email protected]