Document K8s agent storage: SELinux spc_t, custom RWO class, CSI IAM#3246
Open
NickJosevski wants to merge 2 commits into
Open
Document K8s agent storage: SELinux spc_t, custom RWO class, CSI IAM#3246NickJosevski wants to merge 2 commits into
NickJosevski wants to merge 2 commits into
Conversation
Addresses DEV-299 (Kubernetes agent storage class setup). Adds guidance for scenarios customers hit but that were undocumented: - SELinux-enforced clusters (OpenShift, EKS Bottlerocket/AL2023): document agent + scriptPods securityContext seLinuxOptions type spc_t, with YAML and --set forms, plus the OpenShift SCC alternative. - Custom ReadWriteOnce StorageClass (e.g. EBS gp3, Azure Disk), clarifying it is valid alongside the RWX multi-node case and still co-locates script pods on the Tentacle node. - Cloud CSI driver IAM/trust prerequisites (IRSA on EKS, Workload Identity on GKE) and a cross-link to the scriptPod service account annotation. Verified end-to-end against kubernetes-agent Helm chart v3.8.1: helm template confirms the value paths render onto the agent pod, PVC, and the tentacle PODSECURITYCONTEXTJSON env; a live install on a local cluster confirmed a custom RWO PVC binds and mounts and the API server accepts the spc_t securityContext. Adds Bottlerocket, IRSA, SELinux to the spellcheck dictionary. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Editing storage.md brought the whole file into the spellcheck diff, surfacing the pre-existing `skuname` word in the Azure Files section. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
Pull request environment is available at https://stoctodocspr3246.z22.web.core.windows.net. You can view the ephemeral environment status in Octopus Deploy. This environment will be automatically deprovisioned when the pull request is closed, or after 7 days of inactivity. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What & why
Improves Kubernetes agent Storage guidance for scenarios customers hit but that were undocumented — surfaced by DEV-299 (Credit One Bank, via Dustin), where setting up the agent with EBS/gp3 on EKS required several steps with no docs coverage.
All edits are in
src/pages/docs/kubernetes/targets/kubernetes-agent/storage.md:agent+scriptPodssecurityContext.seLinuxOptions.type: spc_t, with both YAML and--setforms, plus the OpenShift SCC alternative. This exact workaround ({"seLinuxOptions":{"type":"spc_t"}}) was previously undocumented anywhere.gp3, Azure Disk): clarifies it's valid alongside the RWX multi-node case, and that it still co-locates script pods on the Tentacle node.Verification
Tested end-to-end against the
octopusdeploy/kubernetes-agentHelm chart v3.8.1:helm templateconfirms every value path renders correctly onto the agent podsecurityContext, the PVC (ReadWriteOnce+ customstorageClassName), and the tentacleOCTOPUS__K8STENTACLE__PODSECURITYCONTEXTJSONenv that carries the script-pod security context.StorageClassproduced a Bound RWO PVC that the tentacle pod mounted at/octopus, and the API server accepted thespc_tsecurityContexton the live pod.Not reproducible on the local cluster: actual SELinux enforcement (OrbStack nodes aren't SELinux-enforcing) — the config is verified valid and accepted end-to-end; the enforcement effect is OS/cloud-specific, which the wording is scoped to.
Notes
Bottlerocket,IRSA,SELinuxtodictionary-octopus.txtfor spellcheck.🤖 Generated with Claude Code