Permissions on /var/log + /var/log/containers doesn't allow non-root Daemonset to gather logs

[zviratko]

Bug Report

Permissions (700) on /var/log and /var/log/containers don't allow non-root Daemonset to tail logs

I believe relaxing permissions to rwx--x--x is better than running logging containers as root...
... unless there's a completely different and better way to do this?

Description

See open-telemetry/opentelemetry-collector-contrib#33083 (comment)

Environment

• Talos version: 1.8.2
• Kubernetes version: 1.31.2
• Platform: amd64

[frezbo]

I believe adding this fixes it:

    capabilities:
      add:
        - DAC_READ_SEARCH

[zviratko]

That didn't work for me (nor for the original issue creator)

[smira]

I think the whole concept of running a DaemonSet which mounts something from the host is a bad design decision (in Kubernetes/CRI), but there is no better way today.

So the API becomes the host filesystem, and permissions on the log files and directories become the API of the operating system towards log collection daemons.

I think given all of that, the only option is to make permissions match some sane defaults.

[frezbo]

That didn't work for me (nor for the original issue creator)

ahh okay, at least it allowed to read files owned as nobody