title: StatefulSet FailedCreate ElasticSearch
body: <p>When attempting to install ElasticSearch for Kubernetes on a PKS instance I am running into an issue where after running <code>kubectl get events --all-namespaces</code> I see <code>create Pod logging-es-default-0 in StatefulSet logging-es-default failed error: pods "logging-es-default-0" is forbidden: SecurityContext.RunAsUser is forbidden</code>. Does this have something to do with a pod security policy? Is there any way to be able to deploy ElasticSearch to Kubernetes if privileged containers are not allowed?</p>
  
  <p>Edit: here is the values.yml file that I am passing into the elasticsearch helm chart.</p>
  
  <pre><code>---
  clusterName: "elasticsearch"
  nodeGroup: "master"
  
  # The service that non master groups will try to connect to when joining the cluster
  # This should be set to clusterName + "-" + nodeGroup for your master group
  masterService: ""
  
  # Elasticsearch roles that will be applied to this nodeGroup
  # These will be set as environment variables. E.g. node.master=true
  roles:
    master: "true"
    ingest: "true"
    data: "true"
  
  replicas: 3
  minimumMasterNodes: 2
  
  esMajorVersion: ""
  
  # Allows you to add any config files in /usr/share/elasticsearch/config/
  # such as elasticsearch.yml and log4j2.properties
  esConfig: {}
  #  elasticsearch.yml: |
  #    key:
  #      nestedkey: value
  #  log4j2.properties: |
  #    key = value
  
  # Extra environment variables to append to this nodeGroup
  # This will be appended to the current 'env:' key. You can use any of the kubernetes env
  # syntax here
  extraEnvs: []
  #  - name: MY_ENVIRONMENT_VAR
  #    value: the_value_goes_here
  
  # A list of secrets and their paths to mount inside the pod
  # This is useful for mounting certificates for security and for mounting
  # the X-Pack license
  secretMounts: []
  #  - name: elastic-certificates
  #    secretName: elastic-certificates
  #    path: /usr/share/elasticsearch/config/certs
  
  image: "docker.elastic.co/elasticsearch/elasticsearch"
  imageTag: "7.4.1"
  imagePullPolicy: "IfNotPresent"
  
  podAnnotations: {}
    # iam.amazonaws.com/role: es-cluster
  
  # additionals labels
  labels: {}
  
  esJavaOpts: "-Xmx1g -Xms1g"
  
  resources:
    requests:
      cpu: "100m"
      memory: "2Gi"
    limits:
      cpu: "1000m"
      memory: "2Gi"
  
  initResources: {}
    # limits:
    #   cpu: "25m"
    #   # memory: "128Mi"
    # requests:
    #   cpu: "25m"
    #   memory: "128Mi"
  
  sidecarResources: {}
    # limits:
    #   cpu: "25m"
    #   # memory: "128Mi"
    # requests:
    #   cpu: "25m"
    #   memory: "128Mi"
  
  networkHost: "0.0.0.0"
  
  volumeClaimTemplate:
    accessModes: [ "ReadWriteOnce" ]
    resources:
      requests:
        storage: 30Gi
  
  rbac:
    create: false
    serviceAccountName: ""
  
  podSecurityPolicy:
    create: false
    name: ""
    spec:
      privileged: false
      fsGroup:
        rule: RunAsAny
      runAsUser:
        rule: RunAsAny
      seLinux:
        rule: RunAsAny
      supplementalGroups:
        rule: RunAsAny
      volumes:
        - secret
        - configMap
        - persistentVolumeClaim
  
  persistence:
    enabled: true
    annotations: {}
  
  extraVolumes: ""
    # - name: extras
    #   emptyDir: {}
  
  extraVolumeMounts: ""
    # - name: extras
    #   mountPath: /usr/share/extras
    #   readOnly: true
  
  extraInitContainers: ""
    # - name: do-something
    #   image: busybox
    #   command: ['do', 'something']
  
  # This is the PriorityClass settings as defined in
  # https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
  priorityClassName: ""
  
  # By default this will make sure two pods don't end up on the same node
  # Changing this to a region would allow you to spread pods across regions
  antiAffinityTopologyKey: "kubernetes.io/hostname"
  
  # Hard means that by default pods will only be scheduled if there are enough nodes for them
  # and that they will never end up on the same node. Setting this to soft will do this "best effort"
  antiAffinity: "hard"
  
  # This is the node affinity settings as defined in
  # https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#node-affinity-beta-feature
  nodeAffinity: {}
  
  # The default is to deploy all pods serially. By setting this to parallel all pods are started at
  # the same time when bootstrapping the cluster
  podManagementPolicy: "Parallel"
  
  protocol: http
  httpPort: 9200
  transportPort: 9300
  
  service:
    labels: {}
    labelsHeadless: {}
    type: ClusterIP
    nodePort: ""
    annotations: {}
    httpPortName: http
    transportPortName: transport
  
  updateStrategy: RollingUpdate
  
  # This is the max unavailable setting for the pod disruption budget
  # The default value of 1 will make sure that kubernetes won't allow more than 1
  # of your pods to be unavailable during maintenance
  maxUnavailable: 1
  
  podSecurityContext:
    fsGroup: null
    runAsUser: null
  
  # The following value is deprecated,
  # please use the above podSecurityContext.fsGroup instead
  fsGroup: ""
  
  securityContext:
    capabilities: null
    # readOnlyRootFilesystem: true
    runAsNonRoot: null
    runAsUser: null
  
  # How long to wait for elasticsearch to stop gracefully
  terminationGracePeriod: 120
  
  sysctlVmMaxMapCount: 262144
  
  readinessProbe:
    failureThreshold: 3
    initialDelaySeconds: 10
    periodSeconds: 10
    successThreshold: 3
    timeoutSeconds: 5
  
  # https://www.elastic.co/guide/en/elasticsearch/reference/current/cluster-health.html#request-params wait_for_status
  clusterHealthCheckParams: "wait_for_status=green&amp;timeout=1s"
  
  ## Use an alternate scheduler.
  ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
  ##
  schedulerName: ""
  
  imagePullSecrets: []
  nodeSelector: {}
  tolerations: []
  
  # Enabling this will publically expose your Elasticsearch instance.
  # Only enable this if you have security enabled on your cluster
  ingress:
    enabled: false
    annotations: {}
      # kubernetes.io/ingress.class: nginx
      # kubernetes.io/tls-acme: "true"
    path: /
    hosts:
      - chart-example.local
    tls: []
    #  - secretName: chart-example-tls
    #    hosts:
    #      - chart-example.local
  
  nameOverride: ""
  fullnameOverride: ""
  
  # https://github.com/elastic/helm-charts/issues/63
  masterTerminationFix: false
  
  lifecycle: {}
    # preStop:
    #   exec:
    #     command: ["/bin/sh", "-c", "echo Hello from the postStart handler &gt; /usr/share/message"]
    # postStart:
    #   exec:
    #     command: ["/bin/sh", "-c", "echo Hello from the postStart handler &gt; /usr/share/message"]
  
  sysctlInitContainer:
    enabled: false
  
  keystore: []
  </code></pre>
  
  <p>The values listed above produce the following error:</p>
  
  <pre><code>create Pod elasticsearch-master-0 in StatefulSet elasticsearch-master failed error: pods "elasticsearch-master-0" is forbidden: SecurityContext.RunAsUser is forbidden
  </code></pre>
  
  <p>Solved: I learned that my istio deployment was causing issues when attempting to deploy any other service into my cluster. I had made a bad assumption that istio along with my cluster security policies weren't causing my issue.</p>