Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Pods can't be started on OCP 3.x clusters with default configuration #41

Closed
LCaparelli opened this issue May 3, 2020 · 2 comments · Fixed by #52
Closed

Pods can't be started on OCP 3.x clusters with default configuration #41

LCaparelli opened this issue May 3, 2020 · 2 comments · Fixed by #52
Assignees
@LCaparelli
Labels
bug 🐛 Something isn't working openshift This issue/PR is related to OpenShift deployments only
Milestone
v0.2.0

Comments

@LCaparelli
Copy link
Member

LCaparelli commented May 3, 2020 •
edited
Loading

When attempting to deploy to an OCP 3.x cluster the following error pops up:

Error creating: pods "nexus3-695b67564f-" is forbidden: unable to validate against any security context constraint: [fsGroup: Invalid value: []int64{200}: 200 is not an allowed group spec.containers[0].securityContext.securityContext.runAsUser: Invalid value: 200: must be in the ranges: [1000160000, 1000169999]]

As Nexus must run using this UID the cluster administrator needs to create a scc to work around this. It would be nice if we could supply this scc and have this documented.
@ricardozanini ricardozanini added bug 🐛 Something isn't working openshift This issue/PR is related to OpenShift deployments only labels May 3, 2020
@ricardozanini ricardozanini added this to the v0.2.0 milestone May 3, 2020
@ricardozanini
Copy link
Member

The reason of this BUG is that OCP 3.11 has a default SCC that prevents userID with low numbers, such as 200 (the one Nexus uses). To fix this, a custom SCC must be created in the namespace. See: https://docs.openshift.com/container-platform/3.11/install_config/persistent_storage/pod_security_context.html

We will document and add a SCC example to the project to help administrators have the operator working on OCP 3.11 clusters.

@ricardozanini ricardozanini modified the milestones: v0.2.0, v0.3.0 May 5, 2020
@ricardozanini
Copy link
Member

Pushing to 0.2.0, if we have the time by the end of the milestone we should include this one.

@ricardozanini ricardozanini modified the milestones: v0.3.0, v0.2.0 May 6, 2020
@LCaparelli LCaparelli mentioned this issue May 7, 2020
Open
LCaparelli added a commit to LCaparelli/nexus-operator that referenced this issue May 7, 2020
@LCaparelli
Make Deployments use a ServiceAccount
6fb9213 
Make Deployments use the ServiceAccount informed in
`nexus.spec.serviceAccountName`. If none is informed the default SA
created by the operator-sdk in `deploy/`is used. Assumes the default
account has not been deleted, the Deployment will trigger an event
otherwise.

Fix m88i#41 by adding SCCs which can be used by the cluster admin and
documenting their use.

Signed-off-by: Lucas Caparelli <lucas.caparelli112@gmail.com>
@LCaparelli LCaparelli mentioned this issue May 7, 2020
Merged
LCaparelli added a commit to LCaparelli/nexus-operator that referenced this issue May 7, 2020
@LCaparelli
Make Deployments use a ServiceAccount
1f54be4 
Make Deployments use the ServiceAccount informed in
`nexus.spec.serviceAccountName`. If none is informed the default SA
created by the operator-sdk in `deploy/`is used. Assumes the default
account has not been deleted, the Deployment will trigger an event
otherwise.

Fix m88i#41 by adding SCCs which can be used by the cluster admin and
documenting their use.

Signed-off-by: Lucas Caparelli <lucas.caparelli112@gmail.com>
LCaparelli added a commit to LCaparelli/nexus-operator that referenced this issue May 8, 2020
@LCaparelli
Make Deployments use a ServiceAccount
e8f4406 
Create default RBAC resources for use by the Operator.

Make Deployments use the ServiceAccount informed in
`nexus.spec.serviceAccountName`. If none is informed the default SA
created by the Operator is used.

Fix m88i#41 by adding SCCs which can be used by the cluster admin and
documenting their use.

Signed-off-by: Lucas Caparelli <lucas.caparelli112@gmail.com>
LCaparelli added a commit to LCaparelli/nexus-operator that referenced this issue May 8, 2020
@LCaparelli
Make Deployments use a ServiceAccount
616350d 
Create default RBAC resources for use by the Operator.

Make Deployments use the ServiceAccount informed in
`nexus.spec.serviceAccountName`. If none is informed the default SA
created by the Operator is used.

Fix m88i#41 by adding SCCs which can be used by the cluster admin and
documenting their use.

Signed-off-by: Lucas Caparelli <lucas.caparelli112@gmail.com>
LCaparelli added a commit to LCaparelli/nexus-operator that referenced this issue May 8, 2020
@LCaparelli
Make Deployments use a ServiceAccount
e6e4984 
Create default RBAC resources for use by the Operator.

Make Deployments use the ServiceAccount informed in
`nexus.spec.serviceAccountName`. If none is informed the default SA
created by the Operator is used.

Fix m88i#41 by adding SCCs which can be used by the cluster admin and
documenting their use.

Signed-off-by: Lucas Caparelli <lucas.caparelli112@gmail.com>
LCaparelli added a commit to LCaparelli/nexus-operator that referenced this issue May 9, 2020
@LCaparelli
Make Deployments use a ServiceAccount
47ed94d 
Create default RBAC resources for use by the Operator.

Make Deployments use the ServiceAccount informed in
`nexus.spec.serviceAccountName`. If none is informed the default SA
created by the Operator is used.

Fix m88i#41 by adding SCCs which can be used by the cluster admin and
documenting their use.

Signed-off-by: Lucas Caparelli <lucas.caparelli112@gmail.com>
@nwalens nwalens mentioned this issue May 15, 2020
Merged
@ricardozanini ricardozanini mentioned this issue May 15, 2020
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@LCaparelli LCaparelli

Labels
bug 🐛 Something isn't working openshift This issue/PR is related to OpenShift deployments only
Projects
None yet
Milestone
v0.2.0
Development

Successfully merging a pull request may close this issue.

Make Deployments use a ServiceAccount LCaparelli/nexus-operator
2 participants
@ricardozanini @LCaparelli