billimek / billimek-charts

DEPRECATED - new home is https://github.com/k8s-at-home/charts
Apache License 2.0
89 stars 52 forks source link

[home-assistant] if zwave is enabled or hostmounts are set: allowPrivilegeEscalation=true #305

Closed marshallford closed 4 years ago

marshallford commented 4 years ago

Special notes for your reviewer:

allowPrivilegeEscalation must not be nil to avoid the error below when a PodSecurityPolicy resource impacting home-assistant has the option defaultAllowPrivilegeEscalation configured to false.

Aug 03 03:32:42 ubuntu k3s[1054]: I0803 03:32:42.795525    1054 event.go:281] Event(v1.ObjectReference{Kind:"ReplicaSet", Namespace:"home-assistant", Name:"home-assistant-69fcc65c5b", UID:"7dea02a5-9d92-46de-9252-53edfd936006", APIVersion:"apps/v1", ResourceVersion:"14526114", FieldPath:""}): type: 'Warning' reason: 'FailedCreate' Error creating: Pod "home-assistant-69fcc65c5b-g4plr" is invalid: spec.containers[0].securityContext: Invalid value: core.SecurityContext{Capabilities:(*core.Capabilities)(nil), Privileged:(*bool)(0xc01d9859ea), SELinuxOptions:(*core.SELinuxOptions)(nil), WindowsOptions:(*core.WindowsSecurityContextOptions)(nil), RunAsUser:(*int64)(nil), RunAsGroup:(*int64)(nil), RunAsNonRoot:(*bool)(nil), ReadOnlyRootFilesystem:(*bool)(nil), AllowPrivilegeEscalation:(*bool)(0xc01d9859e9), ProcMount:(*core.ProcMountType)(nil)}: cannot set `allowPrivilegeEscalation` to false and `privileged` to true

Checklist

[Place an '[x]' (no spaces) in all applicable fields. Please remove unrelated fields.]