Add Startup Volume Permission Enforcement

[theeternalrat]

Resolves #449 . This ads the ability run the parent pod as a select uid/gid, and run an init container that will set file permissions appropriately on the mounted directories.

[CLAassistant]

All committers have signed the CLA.

[witalisoft]

Thanks for the PR

Could you tell us what kind of use case it solves ?

btw there are some files inside the containers that are bound to that builtin user netdata (uid: 201)
how will this work after overriding the runAsUser or/and runAsGroup ?

[theeternalrat]

@witalisoft I can't speak for the original author of #449, but my use-case is that I am running Netdata on an AWS EFS backed volume. If the U/ID of the container (201) does not match the ID of the filesystem, the Netdata process quits when it tries to chown the data directories. EFS squashes the file permissions for all operations, but it doesn't allow any chown operation on the files. Should any process attempt to chown, it is not allowed. Using this feature, I was able to set the container ID to match the EFS volume, allowing the Netdata startup checks to pass.

I cannot definitively say what effect might be for those specified files, but I have been running these changes in my cluster for the last day with seemingly normal operation.

[witalisoft]

@theeternalrat
Sounds reasonable, but having another use case introduces another piece of code to maintain, especially if it's a divergence from what we expect to have.

So what I would prefer is to put the placeholder for the initContainers in templates/parent/deployment.yaml like this:

...
{{ toYaml .Values.parent.extraInitContainers | indent 8 }}
      containers:
...

Now you get the flexibility, and we're not stuck with another use case for testing the helm chart.

The rest of what you presented like securityContext is ok.

[theeternalrat]

@witalisoft I've made the requested change. It'll now be up to the user to defined their own volume-permissions container if they so choose.

[M4itee]

looks good. Thanks @theeternalrat