apm-server: Run as non-root user

[caiconkhicon]

Describe the feature:
I want to run apm-server as a non-root user, same as described here: helm/charts#18366

Currently, if I set podSecurityContext, the Pod fails with the error:

Exiting: error loading config file: open apm-server.yml: permission denied

[jmlrt]

Hi @caiconkhicon, thanks for submitting this issue.

Can you provide more details about your environment by answering to all the questions asked in the bug report template?

[caiconkhicon]

Hi @jmlrt , thank you for your reply. I am happy to provide necessary information. However, IMO, my request here is a feature request.
What I expect is a change to make it possible to run as apm-server with a non-root user. My assumption is that the change should look like helm/charts#18366 in the official Helm chart repository.

[botelastic]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[jmlrt]

This is still valid, however we won't be able to handle it in the short run.
Would you be interested by creating a PR?

[caiconkhicon]

@jmlrt : I think I can. Give a one week, I will try to find a time when I can do it.

[caiconkhicon]

@jmlrt : There is another problem to let apm-server run as root: the binary is owned by root and cannot be ran by others:

-rwxr-x--- 1 root root 102M Nov 28 07:07 /usr/share/apm-server/apm-server

Thus, when running it as non-root, this error appears:

/usr/local/bin/docker-entrypoint: line 8: /usr/share/apm-server/apm-server: Permission denied

I think the fix should be in the apm-server image. Can you do it? or where to do it? I don't see it looks quite like https://github.com/elastic/apm-server/blob/master/Dockerfile

[jmlrt]

@caiconkhicon,
Can you open an issue to apm-server repo for that?

[caiconkhicon]

@jmlrt : I created an issue in https://github.com/elastic/apm-server and discussed with ppl there. It seems that this is not a bug/issue there but a security limitation. Thus, the apm-server pod must run with runAsGroup: 0. Should we fix it in the Helm chart or let users do it freely (like currently https://github.com/elastic/helm-charts/blob/master/apm-server/values.yaml#L78)