fix(helm): allow loki to use hostPath volumes

docs/sources/setup/install/helm/reference.md

@@ -9684,6 +9684,15 @@ false
 			<td><pre lang="json">
 false
 </pre>
+</td>
+		</tr>
+		<tr>
+			<td>rbac.sccAllowHostDirVolumePlugin</td>
+			<td>bool</td>
+			<td>Toggle this to true to allow the use of hostPath volumes on OpenShift</td>
+			<td><pre lang="json">
+false
+</pre>
 </td>
 		</tr>
 		<tr>

production/helm/loki/CHANGELOG.md

@@ -13,6 +13,7 @@ Entries should include a reference to the pull request that introduced the chang
 
 [//]: # (<AUTOMATED_UPDATES_LOCATOR> : do not remove this line. This locator is used by the CI pipeline to automatically create a changelog entry for each new Loki release. Add other chart versions and respective changelog entries bellow this line.)
 
+- [BUGFIX] Ensure the scc is actually allowing to use hostPath volumes when the rbac.sccAllowHostDirVolumePlugin is set to true
 - [BUGFIX] Ensure ui.enabled=true is set in loki ConfigMap when loki.ui.enabled=true is set in values.yaml to actually enable the UI [#17562](https://github.com/grafana/loki/pull/17562)
 
 ## 6.30.1

production/helm/loki/templates/securitycontextconstraints.yaml

@@ -5,7 +5,7 @@ metadata:
   name: {{ include "loki.name" . }}
   labels:
     {{- include "loki.labels" . | nindent 4 }}
-allowHostDirVolumePlugin: false
+allowHostDirVolumePlugin: {{ .Values.rbac.sccAllowHostDirVolumePlugin }}
 allowHostIPC: false
 allowHostNetwork: false
 allowHostPID: false
@@ -33,7 +33,9 @@ volumes:
   - configMap
   - downwardAPI
   - emptyDir
+  {{- if .Values.rbac.sccAllowHostDirVolumePlugin }}
   - hostPath
+  {{- end }}
   - persistentVolumeClaim
   - projected
   - secret

production/helm/loki/values.yaml

@@ -834,6 +834,8 @@ rbac:
   pspEnabled: false
   # -- For OpenShift set pspEnabled to 'false' and sccEnabled to 'true' to use the SecurityContextConstraints.
   sccEnabled: false
+  # -- Toggle this to true to allow the use of hostPath volumes on OpenShift
+  sccAllowHostDirVolumePlugin: false
   # -- Specify PSP annotations
   # Ref: https://kubernetes.io/docs/reference/access-authn-authz/psp-to-pod-security-standards/#podsecuritypolicy-annotations
   pspAnnotations: {}