helm icon indicating copy to clipboard operation
helm copied to clipboard

Hack to handle GKE COS Containerd

Open gremsam opened this issue 3 years ago • 0 comments

Background We've run into some problems with GKE's COS with the containerd runtime. This manifests as a permissions issue when attempting to use runc to initiate a side car container which mounts the state and logs paths (which are themselves hostmounted paths) from the daemonset

Change Don't mount these paths as hostmounts

Gremlin agent will create these inside the daemonset's pod's chroot and then mount those inside of the sidecar which does work properly. The only downside is we lose debuggability when the ds pod restarts as the folders aren't hostmounted. While this is undesirable it is acceptable to work around the GKE limitations

In order to support this the Helm chart will identify if it's installing on to a GKE COS containerd environment before removing these hostmounts

NOTE: Helm doesn't run the lookup command when running a template command or a --dry-run and you will not get the hostmounts removed when debugging that way. Instead you have to do the full installation to test

gremsam avatar Dec 28 '21 18:12 gremsam