search

kubevirt / cluster-network-addons-operator

Deploy additional networking components on top of your Kubernetes cluster
Apache License 2.0
75 stars 51 forks source link

Macvtap DaemonSet is lacking SecurityContextConstraints for Openshift #1583

Closed shawnhwei closed 11 months ago

shawnhwei commented 1 year ago

What happened: The DaemonSet cannot start any pods due to the default security in Openshift.

Error creating: pods "macvtap-cni-" is forbidden: unable to validate against any security context constraint: [provider "anyuid": Forbidden: not usable by user or serviceaccount, provider restricted-v2: .spec.securityContext.hostNetwork: Invalid value: true: Host network is not allowed to be used, provider restricted-v2: .spec.securityContext.hostPID: Invalid value: true: Host PID is not allowed to be used, spec.volumes[0]: Invalid value: "hostPath": hostPath volumes are not allowed to be used, spec.volumes[1]: Invalid value: "hostPath": hostPath volumes are not allowed to be used, provider restricted-v2: .initContainers[0].privileged: Invalid value: true: Privileged containers are not allowed, provider restricted-v2: .initContainers[0].hostNetwork: Invalid value: true: Host network is not allowed to be used, provider restricted-v2: .initContainers[0].hostPID: Invalid value: true: Host PID is not allowed to be used, provider restricted-v2: .containers[0].privileged: Invalid value: true: Privileged containers are not allowed, provider restricted-v2: .containers[0].hostNetwork: Invalid value: true: Host network is not allowed to be used, provider restricted-v2: .containers[0].hostPID: Invalid value: true: Host PID is not allowed to be used, provider "restricted": Forbidden: not usable by user or serviceaccount, provider "containerized-data-importer": Forbidden: not usable by user or serviceaccount, provider "nonroot-v2": Forbidden: not usable by user or serviceaccount, provider "nonroot": Forbidden: not usable by user or serviceaccount, provider "hostmount-anyuid": Forbidden: not usable by user or serviceaccount, provider "kubevirt-controller": Forbidden: not usable by user or serviceaccount, provider "machine-api-termination-handler": Forbidden: not usable by user or serviceaccount, provider "bridge-marker": Forbidden: not usable by user or serviceaccount, provider "hostnetwork-v2": Forbidden: not usable by user or serviceaccount, provider "hostnetwork": Forbidden: not usable by user or serviceaccount, provider "hostaccess": Forbidden: not usable by user or serviceaccount, provider "linux-bridge": Forbidden: not usable by user or serviceaccount, provider "macvtap-cni": Forbidden: not usable by user or serviceaccount, provider "kubevirt-handler": Forbidden: not usable by user or serviceaccount, provider "node-exporter": Forbidden: not usable by user or serviceaccount, provider "privileged": Forbidden: not usable by user or serviceaccount]

What you expected to happen: The DaemonSet is able to start the pods.

How to reproduce it (as minimally and precisely as possible): Enable the kubevirt-hyperconverged operator, add a jsonpatch to the hyperconverged config to enable macvtap in the addons operator.

Anything else we need to know?: Probably the DaemonSet needs to have a dedicated ServiceAccount which can assign a privileged SCC to.

Environment: OKD 4

shawnhwei commented 1 year ago

After further checking it seems like an SCC for macvtap is included in the operator but the referenced serviceaccount doesn't exist and is not used in the daemonset anyways.

RamLavi commented 1 year ago

AFAIR macvtap is not deployed on U/S CNV (@maiqueb keep me honest here). Are you deploying macvtap standalone on OKD?

kubevirt-bot commented 1 year ago

Issues go stale after 90d of inactivity. Mark the issue as fresh with /remove-lifecycle stale. Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

/lifecycle stale

kubevirt-bot commented 1 year ago

Stale issues rot after 30d of inactivity. Mark the issue as fresh with /remove-lifecycle rotten. Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

/lifecycle rotten

kubevirt-bot commented 11 months ago

Rotten issues close after 30d of inactivity. Reopen the issue with /reopen. Mark the issue as fresh with /remove-lifecycle rotten.

/close

kubevirt-bot commented 11 months ago

@kubevirt-bot: Closing this issue.

In response to [this](https://github.com/kubevirt/cluster-network-addons-operator/issues/1583#issuecomment-1868222602): >Rotten issues close after 30d of inactivity. >Reopen the issue with `/reopen`. >Mark the issue as fresh with `/remove-lifecycle rotten`. > >/close Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.