Updating Observability with Custom Non-Root User ID and Group ID

If observability is enabled, update the observability Helm release files with the selected runAsUser, runAsGroup, and fsGroup values. You can use non-root user ID and group ID that are different from the Siebel non-root user ID and group ID or the same values as the Siebel non-root user ID and group ID.

If Prometheus uses a local-storage persistent volume, ensure that the local storage directory is owned by <observability_run_as_user>:<observability_fs_group> before you reconcile the Helm release changes:

sudo chown -R <observability_run_as_user>:<observability_fs_group> <local_storage_directory_path>

To update Observability with custom non-root user ID and group ID:

Note: If you use SSH for Git, you must set the GIT_SSH_COMMAND environment variable in the current shell before you run your first remote Git command. For more information, see the "Configuring SSH for Manual Git Operations" section in Using Existing Git Repositories.

1. Update the Prometheus Helm release as follows:
   1. Open the Prometheus Helm release file:

      vi /home/opc/siebel/<ENV_ID>/<env_namespace>-cloud-manager/flux-crm/apps/base/siebel_observability/prometheus.yaml

   2. Under spec.values, add the securityContext section:

      apiVersion: helm.toolkit.fluxcd.io/v2
      kind: HelmRelease
      metadata:
         name: prometheus
         namespace: <env_namespace>
      spec:
         releaseName: prometheus
         chart:
            spec:
               chart: ./prometheus
                  sourceRef:
                  kind: GitRepository
                  name: <flux_helm_repo_name>
                  namespace: <flux_helm_repo_namespace>
         interval: 10m
         install:
            timeout: 120m
            remediation:
               retries: 3
            remediateLastFailure: true
         upgrade:
            timeout: 120m
            remediation:
            retries: 3
            remediateLastFailure: true
            strategy: rollback
         uninstall:
            timeout: 30m
         values:
            alerting: <true_or_false>
            clusterDns: svc.cluster.local
            dbMonitoring: <true_or_false>
            configmap_reload:
               image:
               imagePullPolicy: Always
               registry: <user_registry_url>
               repository: <registry_prefix>/<env_namespace>/cm/configmap-reload
               tag: <configmap_reload_tag>
               securityContext:
                  runAsGroup: <observability_run_as_group>
                  runAsUser: <observability_run_as_user>
                  fsGroup: <observability_fs_group>

2. Update the Prometheus Alertmanager Helm release as follows:
   1. Open the Prometheus Alertmanager Helm release file:

      vi /home/opc/siebel/<ENV_ID>/<env_namespace>-cloud-manager/flux-crm/apps/base/siebel_observability/prometheus_alertmanager.yaml

   2. Under spec.values, add the securityContext section:

      apiVersion: helm.toolkit.fluxcd.io/v2
      kind: HelmRelease
      metadata:
        name: prometheus-alertmanager
        namespace: <env_namespace>
      spec:
        releaseName: prometheus-alertmanager
        chart:
          spec:
            chart: ./prometheus-alert-manager
            sourceRef:
              kind: GitRepository
              name: <flux_helm_repo_name>
              namespace: <flux_helm_repo_namespace>
        interval: 5m
        install:
          timeout: 120m
        upgrade:
          timeout: 120m
          remediation:
            retries: 3
            remediateLastFailure: true
            strategy: rollback
        uninstall:
          timeout: 30m
        values:
          alertmanager:
            image:
              registry: <user_registry_url>
              repository: <registry_prefix>/<env_namespace>/cm/alertmanager
              tag: <alertmanager_tag>
              pullPolicy: Always
          securityContext:
            runAsGroup: <observability_run_as_group>
            runAsUser: <observability_run_as_user>
            fsGroup: <observability_fs_group>

3. Update the Prometheus Adapter Helm release as follows:
   1. Open the Prometheus Adapter Helm release file:

      vi /home/opc/siebel/<ENV_ID>/<env_namespace>-cloud-manager/flux-crm/apps/base/siebel_observability/prometheus_adapter.yaml

   2. Under spec.values, add the podSecurityContext section:

      apiVersion: helm.toolkit.fluxcd.io/v2
      kind: HelmRelease
      metadata:
         name: prometheus-adapter
         namespace: <env_namespace>
      spec:
         releaseName: prometheus-adapter
         chart:
         spec:
            chart: ./prometheus-adapter
            sourceRef:
               kind: GitRepository
               name: <flux_helm_repo_name>
               namespace: <flux_helm_repo_namespace>
         interval: 5m
         dependsOn:
               - name: prometheus
         install:
            timeout: 120m
         upgrade:
            timeout: 120m
            remediation:
            retries: 3
            remediateLastFailure: true
            strategy: rollback
         uninstall:
            timeout: 30m
         values:
            prometheus_adapter:
            image:
         imagePullPolicy: Always
            registry: <user_registry_url>
            repository: <registry_prefix>/<env_namespace>/cm/prometheus-adapter
            tag: <prometheus_adapter_tag>
         podSecurityContext:
            runAsUser: <observability_run_as_user>
            runAsGroup: <observability_run_as_group>
            fsGroup: <observability_fs_group>

4. Update the Kube State Metrics Helm release as follows:
   1. Open the Kube State Metrics Helm release file:

      vi /home/opc/siebel/<ENV_ID>/<env_namespace>-cloud-manager/flux-crm/apps/base/siebel_observability/prometheus_kube_state_metrics.yaml

   2. Under spec.values, add the securityContext section:

      apiVersion: helm.toolkit.fluxcd.io/v2
      kind: HelmRelease
      metadata:
         name: kube-state-metrics
         namespace: <env_namespace>
      spec:
         releaseName: kube-state-metrics
         chart:
            spec:
         chart: ./kube-state-metrics
         sourceRef:
            kind: GitRepository
            name: <flux_helm_repo_name>
            namespace: <flux_helm_repo_namespace>
         interval: 5m
         install:
            timeout: 120m
         upgrade:
            timeout: 120m
            remediation:
            retries: 3
            remediateLastFailure: true
            strategy: rollback
         uninstall:
         timeout: 30m
         values:
            kube_state_metrics:
            image:
               registry: <user_registry_url>
               repository: <registry_prefix>/<env_namespace>/cm/kube-state-metrics
               tag: <kube_state_metrics_tag>
               pullPolicy: Always
            securityContext:
               runAsGroup: <observability_run_as_group>
               runAsUser: <observability_run_as_user>
               fsGroup: <observability_fs_group>

5. Update the Node Exporter Helm release as follows:
   1. Open the Node Exporter Helm release file:

      vi /home/opc/siebel/<ENV_ID>/<env_namespace>-cloud-manager/flux-crm/apps/base/siebel_observability/prometheus_node_exporter.yaml

   2. Under spec.values, add the securityContext section:

      apiVersion: helm.toolkit.fluxcd.io/v2
      kind: HelmRelease
      metadata:
         name: node-exporter
         namespace: <env_namespace>
      spec:
         releaseName: node-exporter
         chart:
            spec:
               chart: ./node-exporter
               sourceRef:
               kind: GitRepository
               name: <flux_helm_repo_name>
               namespace: <flux_helm_repo_namespace>
         interval: 5m
         install:
            timeout: 120m
         upgrade:
            timeout: 120m
            remediation:
               retries: 3
               remediateLastFailure: true
               strategy: rollback
         uninstall:
            timeout: 30m
         values:
            node_exporter:
               image:
               registry: <user_registry_url>
               repository: <registry_prefix>/<env_namespace>/cm/node-exporter
               tag: <node_exporter_tag>
               pullPolicy: Always
            securityContext:
               runAsGroup: <observability_run_as_group>
               runAsUser: <observability_run_as_user>
               fsGroup: <observability_fs_group>

In the above examples:

• <observability_run_as_user> specifies the user ID under which the observability component container processes run.
• <observability_run_as_group> specifies the group ID under which the observability container processes run.
• <observability_fs_group> specifies the file system group ID used for access to shared volumes.