diff --git a/dictionary-octopus.txt b/dictionary-octopus.txt index 429cb93730..c7cfe2a579 100644 --- a/dictionary-octopus.txt +++ b/dictionary-octopus.txt @@ -52,6 +52,7 @@ Blkio bootstrap bootstrapped bootstrapper +Bottlerocket bubblewrap bufio buildevent @@ -229,6 +230,7 @@ internalcustomer ioutil IPAM ipify +IRSA ISAPIExtensions ISAPIFilter isdir @@ -498,6 +500,7 @@ secpol secureclientcertificate securestring SEIM +SELinux servedby servername serverstatus @@ -512,6 +515,7 @@ SIEM signingkeys Signup skiplinks +skuname snapshotted snapshotting SNMP diff --git a/src/pages/docs/kubernetes/targets/kubernetes-agent/storage.md b/src/pages/docs/kubernetes/targets/kubernetes-agent/storage.md index 45145cb706..21f1f26a4e 100644 --- a/src/pages/docs/kubernetes/targets/kubernetes-agent/storage.md +++ b/src/pages/docs/kubernetes/targets/kubernetes-agent/storage.md @@ -1,7 +1,7 @@ --- layout: src/layouts/Default.astro pubDate: 2024-04-29 -modDate: 2026-05-01 +modDate: 2026-07-16 title: Storage description: How to configure storage for a Kubernetes agent navOrder: 30 @@ -39,6 +39,10 @@ This change was made from v2 due to reliability and security concerns with the p If distribution of script pods across multiple nodes is desired, then you can specify your own `StorageClass`. This `StorageClass` must be capable of `ReadWriteMany` (also known as `RWX`) access mode. +:::div{.hint} +You can also specify a custom `StorageClass` that only supports `ReadWriteOnce` — for example a block-storage class such as AWS EBS (`gp3`) or Azure Disk. This is useful when your cluster has no default storage class, or when you want higher-performance single-node storage rather than the cluster default. As with the default `RWO` behavior, all script pods are then scheduled onto the same node as the Tentacle pod. Leave the `ReadWriteMany` checkbox unchecked in the installation wizard when using an `RWO` class. +::: + Many managed Kubernetes offerings will provide storage that require little effort to set up. These will be a “provisioner” (named as such as they “provision” storage for a `StorageClass`), which you can then tie to a `StorageClass`. Some examples are listed below: | **Offering** | **Provisioner** | **Default StorageClass name** | @@ -51,12 +55,46 @@ Many managed Kubernetes offerings will provide storage that require little effor See this [blog post](https://octopus.com/blog/efs-eks) for a tutorial on connecting EFS to and EKS cluster. ::: +:::div{.info} +Cloud provider CSI drivers (such as the [AWS EBS CSI driver](https://docs.aws.amazon.com/eks/latest/userguide/ebs-csi.html) or the EFS CSI driver) often need to be installed as an add-on and given an IAM role with a trust relationship (for example [IRSA](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html) on EKS, or [Workload Identity](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity) on GKE) before they can provision volumes. Follow the linked provider documentation to install the driver and configure these permissions, then reference the resulting `StorageClass` name when installing the agent. + +Separately, if your **deployment workloads** need to assume an IAM role, you can annotate the script pod service account — see [setting scriptPod service account annotations](/docs/kubernetes/targets/kubernetes-agent/troubleshooting#setting-scriptpod-service-account-annotations). +::: + If you manage your own cluster and don’t have offerings from cloud providers available, there are some in-cluster options you could explore: - [Longhorn](https://longhorn.io/) - [Rook (CephFS)](https://rook.io/) - [GlusterFS](https://www.gluster.org/) +## SELinux-enforced clusters \{#selinux} + +On clusters where SELinux is enforced — such as [OpenShift](https://www.redhat.com/en/topics/containers/what-is-openshift), or EKS nodes running Bottlerocket or Amazon Linux 2023 — SELinux volume labeling can prevent the agent and script pods from reading and writing the shared storage volume, even when the `StorageClass` and access mode are configured correctly. This typically surfaces as permission-denied errors when a pod tries to mount or access the volume. + +To allow the pods to access the volume on these nodes, set the SELinux type to `spc_t` (super-privileged container) in the pod security context of both the agent and the script pods: + +```yaml +agent: + securityContext: + seLinuxOptions: + type: spc_t +scriptPods: + securityContext: + seLinuxOptions: + type: spc_t +``` + +This can be provided during installation, or in a `helm upgrade`, via `--set` flags: + +```bash +--set agent.securityContext.seLinuxOptions.type="spc_t" \ +--set scriptPods.securityContext.seLinuxOptions.type="spc_t" +``` + +:::div{.hint} +On OpenShift you can alternatively grant the agent's service account access to an appropriate [SecurityContextConstraint (SCC)](https://docs.openshift.com/container-platform/latest/authentication/managing-security-context-constraints.html). Using `spc_t` is the simplest option that works consistently across SELinux-enforced clusters. +::: + ## Azure Files CSI driver It is highly recommended that when specifying a custom storage class that leverages [Azure Files CSI driver](https://learn.microsoft.com/en-us/azure/aks/create-volume-azure-files), that the backing storage account be provision with the `PremiumV2_LRS` or `PremiumV2_ZRS` SKU (`skuname`). This will improve deployment performance due to the high performance profile and low-latency SSD's.