fix(helm): allow loki to use hostPath volumes

[rurod]

What this PR does / why we need it:
This PR updates the SecurityContextConstraints helm template. It allows Loki to use HostPath volumes in an OpenShift Environment.

Which issue(s) this PR fixes:
Fixes #17679

Special notes for your reviewer:
Feel free to suggest any change!

Checklist

• Reviewed the CONTRIBUTING.md guide (required)
• Title matches the required conventional commits format, see here
  • Note that Promtail is considered to be feature complete, and future development for logs collection will be in Grafana Alloy. As such, feat PRs are unlikely to be accepted unless a case can be made for the feature actually being a bug fix to existing behavior.
• Changes that require user attention or interaction to upgrade are documented in docs/sources/setup/upgrade/_index.md
• If the change is deprecating or removing a configuration option, update the deprecated-config.yaml and deleted-config.yaml files respectively in the tools/deprecated-config-checker directory. Example PR

[jkroepke]

@rurod What did you think about leave the default to false and make the values configurable through the values.yaml?

[rurod]

Hi, thanks for having a look.

The issue here is the fact that hostPath is listed in the volumes while the allowHostDirVolumePlugin parameter defaults to false.

Thus OpenShift loops on the SCC and removes hostPath from the volumes list.

Then ArgoCD patches the SCC again to add hostPath to the volumes list.

Finally, the two controllers end up being in concurrence and they loop on it forever.

I see two solutions :

1. Having a boolean that sets the value of allowHostDirVolumePlugin to true and append hostPath value to the list.
2. Having the allowHostDirVolumePlugin set to true and the hostPath value in the volumes list by default.

What do you think @jkroepke ?

[jkroepke]

Thanks for clarify that. I have not much OpenShift knowledge. But I understand the config drift leads to unstable ArgoCD syncs.

I also not understand the point of the SecurityContextConstraints. Normally, the service accounts of the deployment should be linked under users.

First, I had the feeling that ˋhostPath` should not be allowed by default, but I'm fine that administrators can enable hostPath if they wish.

I also found grafana/k8s-monitoring-helm#487 that introduces a toggle, like the mentioned option 2.

[jkroepke]

Hey @rurod

just to double check that. is that expected that your commits flagged as unverified?

[rurod]

Hi @jkroepke,

In a nutshell, SecurityContextConstraints is an interface for configuring multiple security tools/options like seccomp, SElinux and many others. If you have any interest in this topic, here is a quick overview : About Security Context Constraints.

I updated the PR to add the rbac.sccAllowHostDirVolumePlugin parameter so admins can decide whether or not they want to allow the use of hostPath volumes.

Let me know what you think.

[rurod]

Hey @rurod

just to double check that. is that expected that your commits flagged as unverified?

The signed commits are from the GitHub web ui, the unsigned ones are from my laptop as I am only using an Authentication Key and no Signing Key at the moment. Let me correct this.

[rurod]

Tried to sign the very first commit, result was not what I expected.
Yet, last ones are signed and verified and the mess should be hidden by squashing the commits while merging.

If you need me to update something, feel free to ping me @jkroepke, I'll go over the failed checks in the meantime.

[jkroepke]

LGTM