Kubernetes-compatible PMM Server Docker image (rootless)

Description

We need a separate container  for this. 

 

We should make PMM Server Docker image Kubernetes-compatible.

  1. Use /readyz API for Docker HEALTHCHECK – moved to PMM-3019, DONE

  2. Do not use root user anywhere inside container – except for in-place updates:

    1. Remove logrotate; use logging to stdout/stderr and supervisord for managing log files - DONE

    2. Remove crond and all cron jobs

    3. Use pmm user for nginx; listen on ports > 1023 – moved to PMM-4996

    4. Run ClickHouse as non-root

    5. Start programs as pmm user

    6. Start supervisord as pmm user

  3. The UI upgrade feature for non-k8s environments should not be broken and disabled for k8s.

(Comments below refer to the work done for PMM 1.x. See also previous discussion on PMM-354)

 

QA:  run usual automation, check there is no  root inside

How to test

None

How to document

None

AFFECTED CS IDs

267919, CS0018491

Activity

Show:

Nurlan Moldomurov 
November 13, 2023 at 1:41 PM

this one should be done within https://jira.percona.com/browse/PMM-12523 

Abel Cabezas 
May 4, 2021 at 4:15 PM

I have tried to run  *perconalab/pmm-server-openshift:1.15.0* image in Openshift and I am getting the following error:

Which refers to the command:

cat /tmp/prometheus.yml > /etc/prometheus.yml

Commenting that line leads to more errors related with files that fall under folders belonging to root:root.
(i.e. files under /etc or under /var).

 

 

Denys Kondratenko 
May 4, 2021 at 2:24 PM

for Kubernetes we need to be able to mount /srv as a volume, thus either pmm-managed should prepare it or we need to run ansible stages.

For ansible stages we need to rewor them to have them separate from instalation and etc.

It could like this:
initContainers:
name: pmm-init
image: docker.io/percona/pmm-server:2

  1. init container runs full ansible container prepare jobs could take ~2min

command: ['sh', '-c', "[ \"$(ls -A /srv)\"] && echo 'Init is not needed, /srv is not empty' || ( echo 'Init: /srv is empty preparing...'; ansible-playbook -vvv -i 'localhost,' -c local /opt/ansible/pmm2-docker/main.yml; ansible-playbook -vvv -i 'localhost,' -c local /opt/ansible/pmm2/post-build-actions.yml; echo 'Init: complete, /srv prepared' )"]
volumeMounts:
name: pmm-volume
mountPath: "/srv"
currently it takes ~2min, shouldn't take that long.

Mykola Marzhan 
October 15, 2018 at 7:01 AM

Work is finished, I have created a separate image - https://github.com/Percona-Lab/percona-openshift/tree/master/images/pmm-server-image
tag - perconalab/pmm-server-openshift:1.15.0

Mykola Marzhan 
September 24, 2018 at 10:02 AM

alpha version of pmm-server - perconalab/pmm-server-fb:PMM-2891-add-rootless-pmm-server-c979722-rootless
work still in progress
PR - https://github.com/Percona-Lab/pmm-submodules/pull/91
update not expected to work

Done

Details

Assignee

Reporter

Priority

Components

Needs QA

Needs Doc

Fix versions

Created September 24, 2018 at 10:01 AM
Updated August 1, 2024 at 12:08 PM
Resolved July 22, 2024 at 1:39 PM