Permission denied error in cloudcost integration

[amith-k-r]

Seeing the error ingestor: build failed for window [2024-03-08T00:00:00+0000, 2024-03-12T00:00:00+0000): CloudCost: Azure: DownloadBlobToFile: failed to create directory mkdir /var/configs/db: permission denied. In Cloudcost integration.

Opencost version: 1.109.0 (fa84614)

[AndrisJrs]

Encountered same issue.

Dirty workaround is to run opencost exporter as root user.

opencost:
    securityContext: 
      readOnlyRootFilesystem: false
      runAsNonRoot: false
      runAsUser: 0

Or configure sidecar container which will set correct permissions.

[mattray]

We can add that to the Azure docs
https://www.opencost.io/docs/configuration/azure#azure-cloud-costs

I'm wondering what the fix for this should be? @AndrisJrs were all 3 changes needed? We can add this to the Helm chart if it needs to be default for Azure
https://github.com/opencost/opencost-helm-chart/blob/main/charts/opencost/values.yaml#L182

[cmergenthaler]

Another way to solve this without root permissions is granting access to mounted volumes with fsGroup. With Helm Chart:

podSecurityContexts:
  runAsUser: 1001
  runAsGroup: 1001
  fsGroup: 1001

extraVolumes:
  - name: configs
    emptyDir: {}

opencost:
  exporter:
    extraVolumeMounts:
      - mountPath: /var/configs
        name: configs
        readOnly: false

Note that we need to explicitly mount a volume to /var/configs

[mattray]

#2748 is related, probably the same error but we'll track separately for now.