fleet icon indicating copy to clipboard operation
fleet copied to clipboard

Debug flag should not disable security context

Open manno opened this issue 1 year ago • 0 comments

Follow up on https://github.com/rancher/fleet/issues/2826

Installing the fleet helm chart with --set debug also disables the security contexts on pods to allow for a debugger to be attached. Might also be related to profiling, etc.

This might be surprising and is not well documented. Furthermore, our e2e tests should test with a security context, they should however output debug messages, so we can download the logs and analyze them.

  • [ ] pod and container security contexts can be toggled on/off via helm chart, just like debug logging
  • [ ] agent inherits debug logging and security context toggle if propagateDebugSettingsToAgents is set
  • [ ] could the security context, at least for the controller, be a helm chart value? It's currently an if-switch in the template.
  • [ ] e2e tests have debug logging re-enabled

manno avatar Sep 18 '24 09:09 manno