GoogleCloudPlatform / flink-on-k8s-operator

[DEPRECATED] Kubernetes operator for managing the lifecycle of Apache Flink and Beam applications.
Apache License 2.0
658 stars 266 forks source link

How to run the flink-operator-controller-manager as non root user? #454

Open timsn opened 3 years ago

timsn commented 3 years ago

If I set the securityContext for the flink-operator container inside the flink-operator-controller-manager to run as non-root user (or to drop all capabilites) the container fails to run with the following error:

ERROR   setup   Problem running manager {"error": "listen tcp :443: bind: permission denied"}
github.com/go-logr/zapr.(*zapLogger).Error
        /root/go/pkg/mod/github.com/go-logr/zapr@v0.1.0/zapr.go:128
main.main
        /workspace/main.go:101
runtime.main
        /usr/local/go/src/runtime/proc.go:203

Is this a technical limitation that the flink-operator has to run an root? Or is there a way to make it possible to run it as a different user?

Here is one example securityContext I tried (I also tried other users):

securityContext:
  runAsNonRoot: true
  runAsUser: 1000

Thank you!