Difference between revisions of "PEC-REP/Current/GIMPEGuide/ConfigureGSP"
Line 5: | Line 5: | ||
|ComingSoon=No | |ComingSoon=No | ||
|Section={{Section | |Section={{Section | ||
− | |sectionHeading= | + | |sectionHeading=GSP Helm chart overrides |
− | |anchor= | + | |anchor=GSP_HelmCharts |
|alignment=Vertical | |alignment=Vertical | ||
− | |structuredtext= | + | |structuredtext=The GSP requires some configuration for deployment that must be made by modifying the GSP's default Helm chart. You do this by creating override entries in the GSP's '''values.yaml''' file. |
− | + | Download the GSP Helm charts from the JFrog registry, using the appropriate credentials. | |
− | + | For information about how to download the Helm charts, see {{SuiteLevelLink|helmchart}}. To find the correct Helm chart version for your release, see {{Link-AnywhereElse|product=ReleaseNotes|version=Current|manual=GenesysEngage-cloud|topic=GIMHelm}} for the Helm chart version you must download for your release. For general information about Helm chart overrides, see {{SuiteLevelLink|helmoverride}} in the ''{{Link-AnywhereElse|product=PrivateEdition|version=Current|manual=PEGuide|display text=Genesys Multicloud CX Private Edition Guide}}''. | |
− | + | At minimum, you must create entries in the '''values.yaml''' file to specify key system information, as described in the following sections. | |
− | |||
− | |||
− | |||
− | At | ||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
{{NoteFormat|Treat your modified '''values.yaml''' file as source code, which you are responsible to maintain so that your overrides are preserved and available for reuse when you upgrade.}} | {{NoteFormat|Treat your modified '''values.yaml''' file as source code, which you are responsible to maintain so that your overrides are preserved and available for reuse when you upgrade.}} | ||
|Status=No | |Status=No | ||
}}{{Section | }}{{Section | ||
− | |sectionHeading= | + | |sectionHeading=Image registry and pull secret |
+ | |anchor=GSP_Config_ImagePull | ||
|alignment=Vertical | |alignment=Vertical | ||
− | |structuredtext={{AnchorDiv| | + | |structuredtext={{AnchorDiv|GSP_ImageRegistry}} |
− | === | + | ===Image registry=== |
− | GSP | + | Create an entry in the GSP's '''values.yaml''' file to specify the location of the Genesys JFrog image registry. This is the repository from which Kubernetes will pull images. |
− | |||
− | |||
− | |||
− | |||
− | + | The location of the Genesys JFrog image registry is defined when you set up the environment for the GSP. It is represented in the system as the <code>docker-registry</code>. In the GSP Helm chart, the repository is represented as <code>image: registry</code>, as shown below. You can optionally set a container version for the image. | |
− | {{AnchorDiv| | + | *<code>image:</code> |
− | === | + | *:<code>registry</code> — ''the repository from which Kubernetes will pull images (''<code>pureengage-docker-staging.jfrog.io</code> ''by default)'' |
− | + | *:<code>tag</code> — ''the container image version'' | |
+ | {{AnchorDiv|GSP_Config_PullSecret}} | ||
+ | ===Pull secret=== | ||
+ | When you set up your environment, you define a pull secret for Genesys JFrog image registry (<code>docker-registry</code>). You must include the pull secret in the GSP's '''values.yaml''' file in order for Kubernetes to be able to pull from the repository. | ||
− | + | *<code>imagePullSecrets:</code> | |
− | + | *:<code>docker-registry</code> — ''the credentials Kubernetes will use to pull the image from the registry'' | |
− | |||
− | + | Note that other services use a different syntax than this to configure the repository pull secret, as follows: | |
− | *< | + | *<code>image:</code> |
− | + | *:<code>imagePullSecrets:</code> | |
− | + | *::<code>- name: docker-registry</code> | |
− | + | *::Genesys Info Mart, GIM Stream Processor, and GIM Configuration Adaptor helm charts all support advanced templating that allow the helm to create the pull secret automatically; hence the variation in syntax. | |
|Status=No | |Status=No | ||
}}{{Section | }}{{Section | ||
− | |sectionHeading= | + | |sectionHeading=Kafka |
− | |anchor= | + | |anchor=GSP_Kafka_Configuration |
|alignment=Vertical | |alignment=Vertical | ||
− | |structuredtext=The | + | |structuredtext={{AnchorDiv|GSP_KafkaSecret}} |
+ | ===Kafka secret=== | ||
+ | If Kafka is configured with authentication, you must configure the Kafka secret so GSP can access Kafka. The Kafka secret is provisioned in the system as <code>kafka-secrets</code> when you set up the environment for GSP. Configure the Kafka secret by creating a Helm chart override in the '''values.yaml''' file. | ||
− | + | *<code>kafka:</code> | |
− | + | *:<code>password</code> - ''Credentials for accessing Kafka. This secret is created during deployment'' | |
− | + | {{AnchorDiv|GSP_KafkaBootstrap}} | |
− | |||
− | |||
− | |||
− | |||
− | + | ===Kafka bootstrap=== | |
− | + | To allow the Kafka service on GSP to align with the infrastructure Kafka service, make a Helm override entry with the location of the Kafka bootstrap. | |
− | === | ||
− | |||
− | < | + | *<code>kafka:</code> |
− | + | *:<code>bootstrap</code> — ''the Kafka address to align with the infrastructure Kafka'' | |
− | + | {{AnchorDiv|GSP_Config_KafkaTopics}} | |
− | + | ===Custom Kafka topic names=== | |
− | + | Some of the Kafka topics used by the GSP support customizing the topic name. If any topic name has been customized, ensure it is represented as a Helm chart override entry, using the <code>kafka:topic</code> parameter. | |
− | |||
− | + | For a list of the Kafka topics that GSP produces and consumes, including which of those support customized naming, see {{Link-AnywhereElse|product=PEC-REP|version=Current|manual=GIMPEGuide|topic=PlanningGSP|anchor=GSP_KafkaTopics}}. | |
− | |||
|Status=No | |Status=No | ||
}}{{Section | }}{{Section | ||
− | |sectionHeading= | + | |sectionHeading=S3-compatible storage |
− | |anchor= | + | |anchor=GSP_S3Storage |
|alignment=Vertical | |alignment=Vertical | ||
− | |structuredtext=By default, GSP is configured to use Azure Blob Storage as the persistent data store | + | |structuredtext={{AnchorDiv|GSP_Config_KafkaBootstrap}} |
+ | ===S3 storage credentials=== | ||
+ | When you set up the environment for GSP, you provision S3-compatible object storage for GSP to use as a persistent data store. In the '''values.yaml''' file, record the credentials needed by GSP to access this storage. | ||
+ | |||
+ | *<code>gsp-s3</code> — Credentials for accessing S3-compatible storage | ||
+ | {{AnchorDiv|GSP_Config_KafkaBootstrap}} | ||
+ | ===Enable S3-compatible storage=== | ||
+ | When you set up your environment for the GSP, you provision S3-compatible object storage for the GSP's persistent data store. You must enable this storage with override entries in the '''values.yaml''' file. | ||
+ | |||
+ | By default, GSP is configured to use Azure Blob Storage as the persistent data store. If you have provisioned Azure Blob Storage in your deployment, modify the following entries in the '''values.yaml''' file: | ||
− | *< | + | *<code>job:</code> |
− | *: < | + | *: <code>storage:</code> |
− | *: < | + | *: <code>gspPrefix</code> — ''the URI path prefix under which GSP savepoints, checkpoints, and high-availability data will be stored'' |
− | *: < | + | *: <code>gcaSnapshots</code> — ''the URI path under which GCA snapshot(s) will be stored'' |
To enable other types of S3-compatible storage, modify the following entries in the '''values.yaml''' file: | To enable other types of S3-compatible storage, modify the following entries in the '''values.yaml''' file: | ||
− | *< | + | *<code>azure:</code> |
− | *: < | + | *: <code>enabled:</code> false |
− | *< | + | *<code>job:</code> |
− | *: < | + | *: <code>storage:</code> |
− | *: < | + | *: <code>gspPrefix</code> — ''the bucket name where GSP savepoints, checkpoints, and high-availability data will be stored'' |
− | *: < | + | *: <code>gcaSnapshots</code> — ''the bucket name where the GCA snapshot(s) will be stored'' |
− | *: < | + | *: <code>s3</code> — ''the applicable details defined with the OBC or GCP bucket'' |
− | *:'''Note:''' The < | + | *:'''Note:''' The <code>host</code> parameter is ignored. |
====OpenShift example==== | ====OpenShift example==== | ||
Line 131: | Line 118: | ||
secretKey: "<secret key>" | secretKey: "<secret key>" | ||
pathStyleAccess: "true"</source> | pathStyleAccess: "true"</source> | ||
− | |||
====GKE example==== | ====GKE example==== | ||
<source lang="bash">azure: | <source lang="bash">azure: | ||
Line 151: | Line 137: | ||
secretKey: "<secret key>" | secretKey: "<secret key>" | ||
pathStyleAccess: "true"</source> | pathStyleAccess: "true"</source> | ||
+ | |Status=No | ||
+ | }}{{Section | ||
+ | |sectionHeading=Arbitrary UIDs (OpenShift) | ||
+ | |anchor=GSP_ArbitraryUIDs | ||
+ | |alignment=Vertical | ||
+ | |structuredtext=If you have an OpenShift deployment and you want to use arbitrary UIDs, you must modify the security context settings in the '''values.yaml''' file. The security context settings define the privilege and access control settings for pods and containers. | ||
+ | |||
+ | In the '''values.yaml''' file, the default user and group IDs in the <code>securityContext</code> object are set to <code>500:500:500</code> (the '''genesys''' user), as shown below. | ||
+ | securityContext: | ||
+ | runAsNonRoot: true | ||
+ | runAsUser: 500 | ||
+ | runAsGroup: 500 | ||
+ | fsGroup: 500 | ||
+ | |||
+ | containerSecurityContext: {} | ||
+ | To use arbitrary UIDs in your OpenShift deployment, you replace these values with null values, as in the following example. | ||
+ | securityContext: | ||
+ | runAsNonRoot: true | ||
+ | runAsUser: null | ||
+ | runAsGroup: 0 | ||
+ | fsGroup: null | ||
+ | |||
+ | containerSecurityContext: {} | ||
+ | |Status=No | ||
+ | }}{{Section | ||
+ | |sectionHeading=Kubernetes API | ||
+ | |anchor=GSP_KubernetesPermissions | ||
+ | |alignment=Vertical | ||
+ | |structuredtext=GSP uses Apache Flink for stateful stream processing, with communications handled via the Kubernetes API. To use the Kubernetes API, GSP must have the permissions shown below. | ||
+ | |||
+ | {{{!}} class="wikitable" | ||
+ | {{!}}+ | ||
+ | !Verbs | ||
+ | !On Resource | ||
+ | !API Group | ||
+ | !Comment | ||
+ | {{!}}- | ||
+ | {{!}}get | ||
+ | list | ||
+ | |||
+ | watch | ||
+ | |||
+ | delete | ||
+ | {{!}}jobs | ||
+ | {{!}}batch | ||
+ | {{!}}GSP uses these commands during upgrade and for a pre-upgrade hook to ensure that the previous version of GSP is stopped before upgrading to the new version. | ||
+ | {{!}}- | ||
+ | {{!}}create | ||
+ | update | ||
+ | |||
+ | patch | ||
+ | |||
+ | get | ||
+ | |||
+ | list | ||
+ | |||
+ | watch | ||
+ | |||
+ | delete | ||
+ | {{!}}configmap | ||
+ | {{!}}general ("") | ||
+ | {{!}}GSP uses these commands to: | ||
+ | |||
+ | *Support Flink's Kubernetes high availability (HA) services | ||
+ | *Record the path to the savepoint (periodically taken by the '''take-savepoint''' cron job and by the upgrade hook) | ||
+ | {{!}}} | ||
+ | |||
+ | {{AnchorDiv|GSP_Config_ArbitraryUIDs}} | ||
+ | ===Arbitrary UIDs (Openshift)=== | ||
+ | If you have an OpenShift deployment and you want to use arbitrary UIDs, you must modify the <code>securityContext</code> settings in the GSP's '''values.yaml''' file with an override entry. These settings define the privilege and access control settings for pods and containers. | ||
+ | |||
+ | In the default GSP '''values.yaml''' file, the user and group IDs are set to <code>500:500:500</code>, (the '''genesys''' user), as shown below. | ||
+ | <source lang="bash"> | ||
+ | securityContext: | ||
+ | runAsNonRoot: true | ||
+ | runAsUser: 500 | ||
+ | runAsGroup: 500 | ||
+ | fsGroup: 500 | ||
+ | |||
+ | containerSecurityContext: {} | ||
+ | </source> | ||
+ | To use arbitrary UIDs in an OpenShift deployment, replace the default values with null values, as in the example below.<source lang="bash"> | ||
+ | securityContext: | ||
+ | runAsNonRoot: true | ||
+ | runAsUser: null | ||
+ | runAsGroup: 0 | ||
+ | fsGroup: null | ||
+ | |||
+ | containerSecurityContext: {} | ||
+ | </source> | ||
|Status=No | |Status=No | ||
}}{{Section | }}{{Section | ||
Line 156: | Line 232: | ||
|anchor=Options | |anchor=Options | ||
|alignment=Vertical | |alignment=Vertical | ||
− | |structuredtext={{Editgrn_open}}<font color=red> | + | |structuredtext=You can specify values in the '''values.yaml''' file to override the default values of configuration options that control GSP behavior and to customize user data and Outbound field mappings.<!--{{Editgrn_open}}<font color=red>'''Writer's note:''' Uncomment the link after the referenced section is published.</font> For more information, see [[{{FULLPAGENAME}}#Options|Configure GSP behavior]].{{Editgrn_close}}--> |
You can override aspects of the default configuration to modify GSP behavior and customize the way data is stored in the Info Mart database. | You can override aspects of the default configuration to modify GSP behavior and customize the way data is stored in the Info Mart database. | ||
Line 172: | Line 248: | ||
{{Editgrn_open}}<font color=red>'''Alexey/Kostya,''' I've combined and extrapolated from info in e-mails and Jira tickets. Please esp. confirm the syntax in this subsection and in the extended example [[{{FULLPAGENAME}}#Example|at the bottom of the page]].</font>{{Editgrn_close}} | {{Editgrn_open}}<font color=red>'''Alexey/Kostya,''' I've combined and extrapolated from info in e-mails and Jira tickets. Please esp. confirm the syntax in this subsection and in the extended example [[{{FULLPAGENAME}}#Example|at the bottom of the page]].</font>{{Editgrn_close}} | ||
− | + | To configure options, edit the GSP '''values.yaml''' file. Under the '''cfgOptions''' object, specify the option and value in JSON format, noting the following: | |
− | |||
*Options are separately configurable by tenant and, where applicable, by media type or even at the level of individual queues (DNs or scripts). | *Options are separately configurable by tenant and, where applicable, by media type or even at the level of individual queues (DNs or scripts). | ||
*Where an option can be configured at various levels, you can override a value set at a higher level (for example, for a particular media type in general) to set a different value for a particular lower-level object (for example, for that media type for an individual DN). | *Where an option can be configured at various levels, you can override a value set at a higher level (for example, for a particular media type in general) to set a different value for a particular lower-level object (for example, for that media type for an individual DN). | ||
*See the {{Link-SomewhereInThisVersion|manual=GIMPEGuide|topic=GSPConfigOptions|anchor=ConfigLevel|display text=note about configuration levels}} for information about the available configuration levels for certain options. | *See the {{Link-SomewhereInThisVersion|manual=GIMPEGuide|topic=GSPConfigOptions|anchor=ConfigLevel|display text=note about configuration levels}} for information about the available configuration levels for certain options. | ||
− | The | + | The entries in the '''values.yaml''' file are structured as follows: |
<source lang="bash"> | <source lang="bash"> | ||
cfgOptions: | cfgOptions: | ||
Line 214: | Line 289: | ||
As described on [link TBD], you can extend storage of user data in the Info Mart database to include additional user-data KVPs you want to capture as custom user-data facts or dimensions. | As described on [link TBD], you can extend storage of user data in the Info Mart database to include additional user-data KVPs you want to capture as custom user-data facts or dimensions. | ||
− | + | To configure user-data mapping, edit the GSP '''values.yaml''' file. Under the '''udeMapping''' object , specify the mapping between your custom KVPs and the custom user-data database table(s) and column(s), noting the following: | |
− | |||
*The mapping, which is specified in JSON format, is configured separately by tenant. | *The mapping, which is specified in JSON format, is configured separately by tenant. | ||
*In addition to specifying the database table and column in which the KVP value will be stored, you also specify the ''propagation rule'' that Genesys Info Mart will use to determine what value to store if more than one value is extracted for the same key in the same interaction. See {{Link-SomewhereInThisVersion|manual=GIMPEGuide|topic=UserData|anchor=PropagationRules|display text=Propagation rules}} for more information. | *In addition to specifying the database table and column in which the KVP value will be stored, you also specify the ''propagation rule'' that Genesys Info Mart will use to determine what value to store if more than one value is extracted for the same key in the same interaction. See {{Link-SomewhereInThisVersion|manual=GIMPEGuide|topic=UserData|anchor=PropagationRules|display text=Propagation rules}} for more information. | ||
Line 265: | Line 339: | ||
Genesys Info Mart stores data about every outbound contact attempt, based on Record Field data it receives from the CX Contact (CXC) service. As described on {{Link-SomewhereInThisVersion|manual=GIMPEGuide|topic=Outbound}}, some of the mapping between Field data and the Info Mart database tables and columns is predefined, and some is custom. | Genesys Info Mart stores data about every outbound contact attempt, based on Record Field data it receives from the CX Contact (CXC) service. As described on {{Link-SomewhereInThisVersion|manual=GIMPEGuide|topic=Outbound}}, some of the mapping between Field data and the Info Mart database tables and columns is predefined, and some is custom. | ||
− | Under the '''ocsMapping''' object | + | To customize outbound mapping, edit the GSP values.yaml file. Under the '''ocsMapping''' object, specify the mapping between your custom record fields and the tables and columns provided in the Info Mart database for custom record field data, namely: |
− | |||
*In the CONTACT_ATTEMPT_FACT table: | *In the CONTACT_ATTEMPT_FACT table: | ||
**10 floating-point numbers: <tt>numeric(14,4)</tt> | **10 floating-point numbers: <tt>numeric(14,4)</tt> |
Revision as of 16:16, September 2, 2022
Contents
Learn how to configure GIM Stream Processor (GSP).
GSP Helm chart overrides
The GSP requires some configuration for deployment that must be made by modifying the GSP's default Helm chart. You do this by creating override entries in the GSP's values.yaml file.
Download the GSP Helm charts from the JFrog registry, using the appropriate credentials.
For information about how to download the Helm charts, see Downloading your Genesys Multicloud CX containers. To find the correct Helm chart version for your release, see Helm charts and containers for Genesys Info Mart for the Helm chart version you must download for your release. For general information about Helm chart overrides, see Overriding Helm chart values in the Genesys Multicloud CX Private Edition Guide.
At minimum, you must create entries in the values.yaml file to specify key system information, as described in the following sections.
Image registry and pull secret
Image registry
Create an entry in the GSP's values.yaml file to specify the location of the Genesys JFrog image registry. This is the repository from which Kubernetes will pull images.
The location of the Genesys JFrog image registry is defined when you set up the environment for the GSP. It is represented in the system as the docker-registry
. In the GSP Helm chart, the repository is represented as image: registry
, as shown below. You can optionally set a container version for the image.
image:
registry
— the repository from which Kubernetes will pull images (pureengage-docker-staging.jfrog.io
by default)tag
— the container image version
Pull secret
When you set up your environment, you define a pull secret for Genesys JFrog image registry (docker-registry
). You must include the pull secret in the GSP's values.yaml file in order for Kubernetes to be able to pull from the repository.
imagePullSecrets:
docker-registry
— the credentials Kubernetes will use to pull the image from the registry
Note that other services use a different syntax than this to configure the repository pull secret, as follows:
image:
imagePullSecrets:
- name: docker-registry
- Genesys Info Mart, GIM Stream Processor, and GIM Configuration Adaptor helm charts all support advanced templating that allow the helm to create the pull secret automatically; hence the variation in syntax.
Kafka
Kafka secret
If Kafka is configured with authentication, you must configure the Kafka secret so GSP can access Kafka. The Kafka secret is provisioned in the system as kafka-secrets
when you set up the environment for GSP. Configure the Kafka secret by creating a Helm chart override in the values.yaml file.
kafka:
password
- Credentials for accessing Kafka. This secret is created during deployment
Kafka bootstrap
To allow the Kafka service on GSP to align with the infrastructure Kafka service, make a Helm override entry with the location of the Kafka bootstrap.
kafka:
bootstrap
— the Kafka address to align with the infrastructure Kafka
Custom Kafka topic names
Some of the Kafka topics used by the GSP support customizing the topic name. If any topic name has been customized, ensure it is represented as a Helm chart override entry, using the kafka:topic
parameter.
For a list of the Kafka topics that GSP produces and consumes, including which of those support customized naming, see Before you begin GSP deployment.
S3-compatible storage
S3 storage credentials
When you set up the environment for GSP, you provision S3-compatible object storage for GSP to use as a persistent data store. In the values.yaml file, record the credentials needed by GSP to access this storage.
gsp-s3
— Credentials for accessing S3-compatible storage
Enable S3-compatible storage
When you set up your environment for the GSP, you provision S3-compatible object storage for the GSP's persistent data store. You must enable this storage with override entries in the values.yaml file.
By default, GSP is configured to use Azure Blob Storage as the persistent data store. If you have provisioned Azure Blob Storage in your deployment, modify the following entries in the values.yaml file:
job:
-
storage:
-
gspPrefix
— the URI path prefix under which GSP savepoints, checkpoints, and high-availability data will be stored -
gcaSnapshots
— the URI path under which GCA snapshot(s) will be stored
-
To enable other types of S3-compatible storage, modify the following entries in the values.yaml file:
azure:
-
enabled:
false
-
job:
-
storage:
-
gspPrefix
— the bucket name where GSP savepoints, checkpoints, and high-availability data will be stored -
gcaSnapshots
— the bucket name where the GCA snapshot(s) will be stored -
s3
— the applicable details defined with the OBC or GCP bucket - Note: The
host
parameter is ignored.
-
OpenShift example
azure:
enabled: false
..
job:
storage:
host: gspstate{{.Values.short_location}}{{.Values.environment}}.blob.core.windows.net
#gspPrefix: wasbs://gsp-state@{{ tpl .Values.job.storage.host . }}/{{ .Release.Name }}/
gspPrefix: "s3p://gim-3f7ac1ab-03b9-445b-ba12-137d4bbc3c38/{{ .Release.Name }}/"
#gcaSnapshots: wasbs://gca@{{ tpl .Values.job.storage.host . }}/
gcaSnapshots: "s3p://gim-3f7ac1ab-03b9-445b-ba12-137d4bbc3c38/gca/"
checkpoints: '{{ tpl .Values.job.storage.gspPrefix . }}checkpoints'
savepoints: '{{ tpl .Values.job.storage.gspPrefix . }}savepoints'
highAvailability: '{{ tpl .Values.job.storage.gspPrefix . }}ha'
s3:
endpoint: "https://s3.openshift-storage.svc:443"
accessKey: "<access key>"
secretKey: "<secret key>"
pathStyleAccess: "true"
GKE example
azure:
enabled: false
...
job:
storage:
host: gspstate{{.Values.short_location}}{{.Values.environment}}.blob.core.windows.net
#gspPrefix: wasbs://gsp-state@{{ tpl .Values.job.storage.host . }}/{{ .Release.Name }}/
gspPrefix: "s3p://test-example-bucket-one/{{ .Release.Name }}/"
#gcaSnapshots: wasbs://gca@{{ tpl .Values.job.storage.host . }}/
gcaSnapshots: "s3p://test-example-bucket-one/gca/"
checkpoints: '{{ tpl .Values.job.storage.gspPrefix . }}checkpoints'
savepoints: '{{ tpl .Values.job.storage.gspPrefix . }}savepoints'
highAvailability: '{{ tpl .Values.job.storage.gspPrefix . }}ha'
s3:
endpoint: "https://storage.googleapis.com:443"
accessKey: "<access Key>"
secretKey: "<secret key>"
pathStyleAccess: "true"
Arbitrary UIDs (OpenShift)
If you have an OpenShift deployment and you want to use arbitrary UIDs, you must modify the security context settings in the values.yaml file. The security context settings define the privilege and access control settings for pods and containers.
In the values.yaml file, the default user and group IDs in the securityContext
object are set to 500:500:500
(the genesys user), as shown below.
securityContext: runAsNonRoot: true runAsUser: 500 runAsGroup: 500 fsGroup: 500 containerSecurityContext: {}
To use arbitrary UIDs in your OpenShift deployment, you replace these values with null values, as in the following example.
securityContext: runAsNonRoot: true runAsUser: null runAsGroup: 0 fsGroup: null containerSecurityContext: {}
Kubernetes API
GSP uses Apache Flink for stateful stream processing, with communications handled via the Kubernetes API. To use the Kubernetes API, GSP must have the permissions shown below.
Verbs | On Resource | API Group | Comment |
---|---|---|---|
get
list watch delete |
jobs | batch | GSP uses these commands during upgrade and for a pre-upgrade hook to ensure that the previous version of GSP is stopped before upgrading to the new version. |
create
update patch get list watch delete |
configmap | general ("") | GSP uses these commands to:
|
Arbitrary UIDs (Openshift)
If you have an OpenShift deployment and you want to use arbitrary UIDs, you must modify the securityContext
settings in the GSP's values.yaml file with an override entry. These settings define the privilege and access control settings for pods and containers.
In the default GSP values.yaml file, the user and group IDs are set to 500:500:500
, (the genesys user), as shown below.
securityContext:
runAsNonRoot: true
runAsUser: 500
runAsGroup: 500
fsGroup: 500
containerSecurityContext: {}
securityContext:
runAsNonRoot: true
runAsUser: null
runAsGroup: 0
fsGroup: null
containerSecurityContext: {}