Configure permissions for Lumi Enterprise on OpenShift

info

This information applies to Imply Lumi Enterprise deployments on OpenShift.
Lumi Enterprise on OpenShift is an early access feature.

Imply Lumi Enterprise needs permissions on the service accounts where the Lumi pods run, and on the namespace and cluster resources that the Lumi Helm chart manages.

Lumi runs its pods under the following service accounts:

• cluster-TENANT_ID: Runs the Apache® Druid pods for your Lumi cluster, including data nodes. The Lumi Helm chart creates this service account. Replace TENANT_ID with your Lumi tenant ID.
• iow-otel-collector-agent-opentelemetry-collector: Runs the OpenTelemetry collector agent, which runs on each node and collects pod logs and telemetry data.
• lumi: Runs the update-client service, which installs Lumi and handles future updates.

Before you install Lumi, do the following:

1. Create the namespace for your Lumi deployment.
2. Grant security context constraints (SCCs) to the cluster-TENANT_ID and iow-otel-collector-agent-opentelemetry-collector service accounts.
3. Make sure you can run the installation as a user with the built-in OpenShift cluster-admin role.

In this topic, placeholder values are shown in uppercase—for example, NAMESPACE. Replace these with values for your own environment.

Create the namespace

Create the namespace for your Lumi deployment. Later topics assume that this namespace already exists.

oc new-project NAMESPACE

Grant SCCs to service accounts

Lumi runs some pods with elevated security context constraints (SCCs), which OpenShift doesn't allow by default. Grant these permissions before you install.

The cluster-TENANT_ID service account needs the following SCCs:

Security context constraint	Grants	Used for
system:openshift:scc:privileged	containers[0].securityContext.fsGroup: 1001	Allows Druid pods to read from and write to their own storage.
system:openshift:scc:privileged	containers[0].privileged: true	Allows data nodes to access and manage Non-Volatile Memory Express® (NVMe®) devices.
system:openshift:scc:privileged	hostPath volume for local NVMe storage at /mnt/k8s-disks/0	Mounts the local NVMe storage in data node pods for the best segment storage performance.
system:openshift:scc:anyuid	Root user	Lets task pods access /opt/imply. OpenShift runs containers as a random non-root user ID by default, and /opt/imply isn't reassigned to that ID, so task pods can't read it without root access.

The iow-otel-collector-agent-opentelemetry-collector service account needs the following SCCs:

Security context constraint	Grants	Used for
system:openshift:scc:privileged	hostPath volumes for /var/log/pods and /var/lib/docker/containers	Allows reading pod logs directly from disk.
system:openshift:scc:privileged	hostPort bindings for ports 4317, 4318, 6831, 9411, 14250, and 14268	Opens the Jaeger, Zipkin, and OTLP ports required by the opentelemetry-collector chart to collect telemetry logs and data.
system:openshift:scc:privileged	containers[0].securityContext.runAsUser: 0	Root access is required to open the log files.
system:openshift:scc:privileged	containers[0].securityContext.seLinuxOptions.type: spc_t	Runs the container as super-privileged. Allows reading host paths not labeled for container access.

How you grant these SCCs depends on your environment. For example, you can use the following OpenShift CLI (oc) commands:

# Grants the Druid service account the privileged SCC.
oc adm policy add-scc-to-user privileged -z cluster-TENANT_ID -n NAMESPACE

# Grants the OpenTelemetry collector service account the privileged SCC.
oc adm policy add-scc-to-user privileged -z iow-otel-collector-agent-opentelemetry-collector -n NAMESPACE

# Grants the Druid service account the anyuid SCC, so task pods can run as root.
oc adm policy add-scc-to-user anyuid -z cluster-TENANT_ID -n NAMESPACE

Installation permissions

To install Lumi, you need the built-in OpenShift cluster-admin role. The bootstrap Job uses the cluster-admin role to set up everything Lumi requires.

When you run helm install, Lumi installs the cluster and its services into the single namespace you provide. During installation, the Lumi Helm chart creates the following roles for the lumi service account:

Role	Scope	Grants	Used for
lumi-admin Role	Namespace	Full access to all resources within the Lumi namespace	Superset of the permissions needed by all current and future Lumi components. Runs helm install commands.
lumi-admin ClusterRole	Cluster	GET on customresourcedefinitions for rollouts.argoproj.io	Allows the update-client to manage Argo Rollouts deployments.
lumi-admin ClusterRole	Cluster	CREATE, GET, UPDATE, DELETE on validatingwebhookconfigurations for admissionregistration.k8s.io	Allows Lumi to validate deployments through a webhook.

Next step

After you configure permissions, continue to Provision dependencies.