Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

Pods can't be started on OCP 3.x clusters with default configuration #41

Closed
LCaparelli opened this issue May 3, 2020 · 2 comments · Fixed by #52
Closed

Pods can't be started on OCP 3.x clusters with default configuration #41

LCaparelli opened this issue May 3, 2020 · 2 comments · Fixed by #52
Assignees
@LCaparelli
Labels
bug 🐛 Something isn't working openshift This issue/PR is related to OpenShift deployments only
Milestone
v0.2.0

Comments

@LCaparelli
Copy link
Member

LCaparelli commented May 3, 2020 •
edited
Loading

When attempting to deploy to an OCP 3.x cluster the following error pops up:

Error creating: pods "nexus3-695b67564f-" is forbidden: unable to validate against any security context constraint: [fsGroup: Invalid value: []int64{200}: 200 is not an allowed group spec.containers[0].securityContext.securityContext.runAsUser: Invalid value: 200: must be in the ranges: [1000160000, 1000169999]]

As Nexus must run using this UID the cluster administrator needs to create a scc to work around this. It would be nice if we could supply this scc and have this documented.
@ricardozanini ricardozanini added bug 🐛 Something isn't working openshift This issue/PR is related to OpenShift deployments only labels May 3, 2020
@ricardozanini ricardozanini added this to the v0.2.0 milestone May 3, 2020
@ricardozanini
Copy link
Member

The reason of this BUG is that OCP 3.11 has a default SCC that prevents userID with low numbers, such as 200 (the one Nexus uses). To fix this, a custom SCC must be created in the namespace. See: https://docs.openshift.com/container-platform/3.11/install_config/persistent_storage/pod_security_context.html

We will document and add a SCC example to the project to help administrators have the operator working on OCP 3.11 clusters.

@ricardozanini ricardozanini modified the milestones: v0.2.0, v0.3.0 May 5, 2020
@ricardozanini
Copy link
Member

Pushing to 0.2.0, if we have the time by the end of the milestone we should include this one.

@ricardozanini ricardozanini modified the milestones: v0.3.0, v0.2.0 May 6, 2020
@LCaparelli LCaparelli mentioned this issue May 7, 2020
Open
LCaparelli added a commit to LCaparelli/nexus-operator that referenced this issue May 7, 2020
@LCaparelli
Make Deployments use a ServiceAccount
6fb9213 
Make Deployments use the ServiceAccount informed in
`nexus.spec.serviceAccountName`. If none is informed the default SA
created by the operator-sdk in `deploy/`is used. Assumes the default
account has not been deleted, the Deployment will trigger an event
otherwise.

Fix m88i#41 by adding SCCs which can be used by the cluster admin and
documenting their use.

Signed-off-by: Lucas Caparelli <lucas.caparelli112@gmail.com>
@LCaparelli LCaparelli mentioned this issue May 7, 2020
Merged
LCaparelli added a commit to LCaparelli/nexus-operator that referenced this issue May 7, 2020
@LCaparelli
Make Deployments use a ServiceAccount
1f54be4 
Make Deployments use the ServiceAccount informed in
`nexus.spec.serviceAccountName`. If none is informed the default SA
created by the operator-sdk in `deploy/`is used. Assumes the default
account has not been deleted, the Deployment will trigger an event
otherwise.

Fix m88i#41 by adding SCCs which can be used by the cluster admin and
documenting their use.

Signed-off-by: Lucas Caparelli <lucas.caparelli112@gmail.com>
LCaparelli added a commit to LCaparelli/nexus-operator that referenced this issue May 8, 2020
@LCaparelli
Make Deployments use a ServiceAccount
e8f4406 
Create default RBAC resources for use by the Operator.

Make Deployments use the ServiceAccount informed in
`nexus.spec.serviceAccountName`. If none is informed the default SA
created by the Operator is used.

Fix m88i#41 by adding SCCs which can be used by the cluster admin and
documenting their use.

Signed-off-by: Lucas Caparelli <lucas.caparelli112@gmail.com>
LCaparelli added a commit to LCaparelli/nexus-operator that referenced this issue May 8, 2020
@LCaparelli
Make Deployments use a ServiceAccount
616350d 
Create default RBAC resources for use by the Operator.

Make Deployments use the ServiceAccount informed in
`nexus.spec.serviceAccountName`. If none is informed the default SA
created by the Operator is used.

Fix m88i#41 by adding SCCs which can be used by the cluster admin and
documenting their use.

Signed-off-by: Lucas Caparelli <lucas.caparelli112@gmail.com>
LCaparelli added a commit to LCaparelli/nexus-operator that referenced this issue May 8, 2020
@LCaparelli
Make Deployments use a ServiceAccount
e6e4984 
Create default RBAC resources for use by the Operator.

Make Deployments use the ServiceAccount informed in
`nexus.spec.serviceAccountName`. If none is informed the default SA
created by the Operator is used.

Fix m88i#41 by adding SCCs which can be used by the cluster admin and
documenting their use.

Signed-off-by: Lucas Caparelli <lucas.caparelli112@gmail.com>
LCaparelli added a commit to LCaparelli/nexus-operator that referenced this issue May 9, 2020
@LCaparelli
Make Deployments use a ServiceAccount
47ed94d 
Create default RBAC resources for use by the Operator.

Make Deployments use the ServiceAccount informed in
`nexus.spec.serviceAccountName`. If none is informed the default SA
created by the Operator is used.

Fix m88i#41 by adding SCCs which can be used by the cluster admin and
documenting their use.

Signed-off-by: Lucas Caparelli <lucas.caparelli112@gmail.com>
@nwalens nwalens mentioned this issue May 15, 2020
Merged
@ricardozanini ricardozanini mentioned this issue May 15, 2020
Closed
# for free to join this conversation on GitHub. Already have an account? # to comment
Assignees

@LCaparelli LCaparelli

Labels
bug 🐛 Something isn't working openshift This issue/PR is related to OpenShift deployments only
Projects
None yet
Milestone
v0.2.0
Development

Successfully merging a pull request may close this issue.

Make Deployments use a ServiceAccount LCaparelli/nexus-operator
2 participants
@ricardozanini @LCaparelli