Operator v1.2.50 ignores custom args and always injects default wrapper/flags

[rahulduvedi]

ArangoDB Kubernetes Operator Custom Args Issue

Problem Description

Running ArangoDB Kubernetes Operator v1.2.50 in namespace kube-arangodb in Single mode. Need to pass custom startup flags to the ArangoDB server, but the operator's built-in wrapper:

• Injects its own arangod command and default args (including --log.file=/var/log/arangodb3/arangod.log)
• Ignores or drops any overrides provided via spec.single.args or the v2alpha1 override.container.args fields

This results in ArangoDB crashing with:

cannot write to file '/var/log/arangodb3/arangod.log': Permission denied

The default file-logger is opened before custom flags take effect.

Attempted Solutions

1. spec.single.args (v1 API)

• Result: Appends custom flags, but default --log.file is still present before mine
• Outcome: PermissionDenied persists

2. v2alpha1 override.container.command/args

• Result: CRD conversion to v1 silently drops these fields
• Outcome: Operator never sees them

3. --log.output=- & --log.file=- flags

• Result: ArangoDB still opens default arangod.log before CLI parsing
• Outcome: No effect

4. Features: ephemeral-volumes: true + secured-containers: true

• Result: Makes /var/log/arangodb3 writable by arangod user
• Outcome: Wrapper still hard-codes and opens default log file

5. InitContainer chmod 777 /var/log/arangodb3

• Result: Grants permissions
• Outcome: No effect because wrapper's default args are still applied too early

Minimal Reproduction (Single-Server)

apiVersion: database.arangodb.com/v1
kind: ArangoDeployment
metadata:
  name: test-arangodb
  namespace: kube-arangodb
spec:
  mode: Single
  image: arangodb/arangodb:latest
  architecture: ["amd64"]
  auth:
    jwtSecretName: None
  features:
    ephemeral-volumes: true
    secured-containers: true
  single:
    args:
      - --log.output=-
      - --log.file=-
      - --temp.path=/data/tmp
      - --javascript.app-path=/data/apps
    volumeClaimTemplate:
      spec:
        accessModes: ["ReadWriteOnce"]
        resources:
          requests:
            storage: 1Gi
    volumes:
      - name: log-volume
        emptyDir: {}
    volumeMounts:
      - name: log-volume
        mountPath: /var/log/arangodb3

Actual Pod Command & Args

$ kubectl get pod -l arango_deployment=test-arangodb -n kube-arangodb \
    -o jsonpath='{.items[0].spec.containers[0].command}{"\n"}{.items[0].spec.containers[0].args}'

Output:

["/usr/sbin/arangod","--database.directory=/data","--log.output=+","--server.authentication=false","--server.endpoint=tcp://[::]:8529"]

Expected Behavior

1. Operator should honor spec.single.args (and/or the v2alpha1 override API) by replacing or at least prepending its defaults
2. --log.file=- and --log.output=- should disable the file logger entirely
3. override.container.command/args fields in v2alpha1 should be respected without requiring a full API-version switch or operator upgrade

Required Custom Flags

• --log.output=-
• --javascript.app-path=/data/apps
• --temp.path=/data/tmp
• --log.file=-

[ajanikow]

Hello!

Can you please share the name of the pod? As args were not passed, it could be ID pod instead of Single, which failed.

Best Regards,
Adam.

[ajanikow]

Documentation for a reference: https://arangodb.github.io/kube-arangodb/docs/features/secured_containers.html#secured-containers (it might enable you to secure all the required security aspects to run in the limited environments)

[rahulduvedi]

Update: Critical Argument Not Applied to Pod

@ajanikow - Thanks for the quick reply and reference to the docs which were really helpful
Here are some finding and information that may help us to understand the issue better.
Following the secured containers documentation, I enabled both required features:

helm install kube-arangodb ... \
  --set "operator.args={--deployment.feature.ephemeral-volumes=true,--deployment.feature.secured-container

Here are the Pod Details:

• Pod: test-arangodb-id-7c7dba
• Namespace: kube-arangodb
• Error: cannot write to file '/var/log/arangodb3/arangod.log': Read-only file system

Configuration

spec:
  single:
    args:
      - --log.output=+
      - --log.file=-        # Should disable file logging
      - --temp.path=/data/tmp
      - --javascript.app-path=/data/apps

Issue

The deployment spec contains --log.file=- but it's missing from the pod:

kubectl get pod test-arangodb-id-7c7dba -o yaml | grep -A 10 "command:"

command:
- /usr/sbin/arangod
- --database.directory=/data
- --javascript.app-path=/ephemeral/app
- --log.output=+                      # ✓ Applied
- --server.authentication=false
- --server.endpoint=tcp://[::]:8529
- --temp.path=/ephemeral/tmp
# ✗ --log.file=- is MISSING

Without --log.file=-, ArangoDB tries to write logs to the default location which fails on read-only filesystem.

Question

Is the operator intentionally filtering out --log.file=-? This prevents secured containers from working as documented.

[ajanikow]

Hello!

It is ID Pod, please use: https://arangodb.github.io/kube-arangodb/docs/api/ArangoDeployment.V1.html#specidargs

But something is wrong: We are working with ArangoDB with the ReadOnly filesystem enabled, and to make it work, we only enable SecuredContainers.

If we are missing something, we need to change the Operator's defaults, but our latest QA with features enabled was green.

Can you please share the YAML of the ID pod and the exact error message?

Also, I do not see even this flag --log.file defaulted anywhere in ArangoDB.

Best Regards,
Adam.

[ajanikow]

Hello @rahulduvedi !

Any update?

Best Regards,
Adam.