Skip to content

Conversation

@mcoops
Copy link

@mcoops mcoops commented Aug 5, 2021

Add in the correct SCC for each SA to allow the pods to be accepted by admission.

machine-config-controller - anyuid (asks for runAsUser: 65534)
machine-config-daemon - privileged (asks for hostNetwork, privileged: true)
machine-config-server - hostnetwork (asks for hostNetwork: true)

Otherwise we get:

LAST SEEN TYPE REASON OBJECT MESSAGE
12s Warning FailedCreate daemonset/machine-config-daemon Error creating: pods "machine-config-daemon-" is forbidden: unable to validate against any security context constraint: [provider "anyuid": Forbidden: not usable by user or serviceaccount, provider restricted: .spec.securityContext.hostNetwork: Invalid value: true: Host network is not allowed to be used, provider restricted: .spec.securityContext.hostPID: Invalid value: true: Host PID is not allowed to be used, spec.volumes[0]: Invalid value: "hostPath": ...

Roll back some of the changes to the other NS to just remove the run-level from the machine-config-operator to simplify this PR as other changes to the MCO are required.

Also assign the correct SCC's to the ServiceAccounts to allow the pods thru admission

Signed-off-by: mcoops <[email protected]>
@mcoops
Copy link
Author

mcoops commented Aug 10, 2021

Confirmed for machineconfigcontroller we don't require any privileges, it can run in the restricted scc, i.e.:

# oc get pod machine-config-controller-b559cbf8-2wp7v -o yaml | grep scc
    openshift.io/scc: restricted

And the pod is running fine with no issues in the event logs:

machine-config-controller-b559cbf8-2wp7v   1/1     Running   0          75m

@yuvalk yuvalk merged this pull request into yuvalk:no_runlevel Aug 18, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants