Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fails to install on OCP/OKD due to scc violations #5

Open
kaplan-michael opened this issue May 14, 2024 · 1 comment
Open

Fails to install on OCP/OKD due to scc violations #5

kaplan-michael opened this issue May 14, 2024 · 1 comment
Assignees

Comments

@kaplan-michael
Copy link

Describe the bug
Fix SCC for OCP/OKD

To Reproduce
Install via helm and set

ocpCompatibility:
  enabled: true

scc fails

would violate PodSecurity "restricted:v1.24": allowPrivilegeEscalation != false (containers "postgres-upgrade", "postgres-init", "postgres", "yugaware" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (containers "postgres-upgrade", "postgres-init", "postgres", "yugaware" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or containers "postgres-upgrade", "postgres-init" must set securityContext.runAsNonRoot=true), seccompProfile (pod or containers "postgres-upgrade", "postgres-init", "postgres", "yugaware" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

Expected behavior
Installs/deals with scc automatically.

Additional context
Can be worked around by oc adm policy add-scc-from-user anyuid -z <installed-svc-account-name> -n <namespace>

@amannijhawan amannijhawan self-assigned this May 20, 2024
@bhavin192
Copy link
Contributor

@kaplan-michael can you try with following set as well?

securityContext:
  enabled: false

See https://github.com/yugabyte/charts/blob/b8aa3c46b3f020eeed206262233dcb12aa0106cf/stable/yugaware/openshift.values.yaml#L33 for reference. We rely mostly on OpenShift to set correct values of runAsUser, runAsGroup etc.

Do you have restricted SCC enabled in your cluster? Because in our clusters the line you shared shows up as a warning and not as error.

cc @baba230896

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants