Documentation for restricted securityContext

[jawnsy]

Hello there,

Thanks so much for this great operator! The otel-collector sidecar and deployment seem to work fine with some more restrictive securityContext settings, and I'd like to propose adding documentation to describe how to implement this, as these changes would be especially relevant for people running in a restricted environment, such as OpenShift.

Since changing the defaults would be a breaking change, the safest option would be a doc-only change describing how this can be done. However, I think using more restrictive defaults would be a nice future change.

I'm happy to open a PR to add these docs, if you would be amenable. Please point me to the appropriate place to document this and any tests that I should update.

Thanks for considering this!

These are the settings I'm using for sidecars:

apiVersion: opentelemetry.io/v1alpha1
kind: OpenTelemetryCollector
spec:
  mode: sidecar
  securityContext:
    runAsUser: 10001 # we use this in our environment, but should omit this for better compatibility with OpenShift, in which case clusters will inherit from the image USER
    runAsNonRoot: true
    allowPrivilegeEscalation: false
    readOnlyRootFilesystem: true
    seccompProfile:
      type: RuntimeDefault
    capabilities:
      drop:
      - ALL

And these are the settings I'm using for the deployment:

apiVersion: opentelemetry.io/v1alpha1
kind: OpenTelemetryCollector
spec:
  mode: deployment
  securityContext:
    runAsUser: 10001
    runAsNonRoot: true
    allowPrivilegeEscalation: false
    readOnlyRootFilesystem: true
    seccompProfile:
      type: RuntimeDefault
    capabilities:
      drop:
      - ALL
  podSecurityContext:
    runAsUser: 10001
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault

See also:

• Warning about PodSecurity when applying some manifests from the E2E tests in OpenShift 4.11 #1262
• InitContainer lacks allowPrivilegeEscalation setting which triggers Azure Gatekeeper OPA #1084
• https://github.com/open-telemetry/opentelemetry-operator/blob/main/docs/api.md#opentelemetrycollector

[pavolloffay]

@jawnsy thanks for getting back to us and contributing.

The only docs we have right now is the root readme or https://github.com/open-telemetry/opentelemetry-operator/blob/main/apis/v1alpha1/opentelemetrycollector_types.go#L74.

PR is highly appreciated ❤️