[libbeat] APM Server does not start when running as an arbitrary user ID

[barkbay]

#28265 added a call to user.Current(). Unfortunately user.Current() fails if the user UID does not exist in /etc/passwd, which is likely to be the case on K8S if user sets an arbitrary UID in the securityContext.

A workaround can be to catch this specific error and fall back to os.Getuid() and os.Getgid():

		if u, err := user.Current(); err != nil {
			// UnknownUserIdError may happen if the user UID does not exist in /etc/passwd. It might be the case on K8S
			// if the user set securityContext.runAsUser to an arbitrary value.
			_, ok := err.(user.UnknownUserIdError)
			if !ok {
				return err
			}
			monitoring.NewString(registry, "uid").Set(strconv.Itoa(os.Getuid()))
			monitoring.NewString(registry, "gid").Set(strconv.Itoa(os.Getgid()))
		} else {
			monitoring.NewString(registry, "username").Set(u.Username)
			monitoring.NewString(registry, "uid").Set(u.Uid)
			monitoring.NewString(registry, "gid").Set(u.Gid)
		}

Happy to raise the relevant PR if you agree with this approach.

---

For confirmed bugs, please report:

• Version: 7.16.0-SNAPSHOT (It works as expected with 7.15.x)
• Related change: Add start of elastic-agent diagnostics command #28265
• Operating System: Docker
• Steps to Reproduce:

Deploy an APM Server using ECK and the following manifest, APM Server fails with message user: unknown userid 12345 :

apiVersion: elasticsearch.k8s.elastic.co/v1
kind: Elasticsearch
metadata:
  name: es-apm-sample
spec:
  version: 7.16.0-SNAPSHOT
  nodeSets:
  - name: default
    count: 3
    config:
      node.store.allow_mmap: false
---
apiVersion: kibana.k8s.elastic.co/v1
kind: Kibana
metadata:
  name: kb-apm-sample
spec:
  version: 7.16.0-SNAPSHOT
  count: 1
  elasticsearchRef:
    name: "es-apm-sample"
---
apiVersion: apm.k8s.elastic.co/v1
kind: ApmServer
metadata:
  name: apm-apm-sample
spec:
  version: 7.16.0-SNAPSHOT
  count: 1
  elasticsearchRef:
    name: "es-apm-sample"
  kibanaRef:
    name: "kb-apm-sample"
  podTemplate:
    spec:
      securityContext:
        runAsUser: 12345
        runAsGroup: 12345
        fsGroup: 0

[elasticmachine]

Pinging @elastic/elastic-agent-control-plane (Team:Elastic-Agent-Control-Plane)

[jlind23]

@michel-laterman would you mind taking care of it as you introduced the diagnostic command? Or if we agree with @barkbay would you review his PR?

[michel-laterman]

@barkbay, thanks for catching this. your idea for catching this seems fine, please create the PR.

[david-kow]

Fixed by #28696, hence closing.