openyurtio / yurt-app-manager

The workload controller manager from NodePool level in OpenYurt cluster
Apache License 2.0
6 stars 1 forks source link

[BUG]UnitedDeployment/YurtAppSet/YurtAppDaemon cannot be enable pod privileged #128

Open gbtyy opened 1 year ago

gbtyy commented 1 year ago

What happened: UnitedDeployment/YurtAppSet/YurtAppDaemon set pod privileged,will happend error: The UnitedDeployment "ud-test" is invalid: spec.workloadTemplate.deploymentTemplate.spec.template.spec.containers[0].securityContext.privileged: Forbidden: disallowed by cluster policy

ud-test.yaml:

apiVersion: apps.openyurt.io/v1alpha1
kind: UnitedDeployment
metadata:
  labels:
    controller-tools.k8s.io: "1.0"
  name: ud-test
spec:
  selector:
    matchLabels:
      app: ud-test
  workloadTemplate:
    deploymentTemplate:
      metadata:
        labels:
          app: ud-test
      spec:
        template:
          metadata:
            labels:
              app: ud-test
          spec:
            tolerations:
            - key: "node-role.openyurt.io/edge"
              operator: "Exists"
              effect: "NoSchedule"
            containers:
              - name: nginx
                image: nginx:latest
                securityContext:
                  AllowPrivilegeEscalation: true
                  privileged: true
                ports:
                - containerPort: 80
                readinessProbe:
                  failureThreshold: 5
                  httpGet:
                    path: /
                    port: 80
                    scheme: HTTP
                  initialDelaySeconds: 10
                  periodSeconds: 10
                  successThreshold: 1
                  timeoutSeconds: 5
  topology:
    pools:
    - name: np1
      nodeSelectorTerm:
        matchExpressions:
        - key: apps.openyurt.io/nodepool
          operator: In
          values:
          - np1
      replicas: 1
  revisionHistoryLimit: 5

What you expected to happen: UnitedDeployment/YurtAppSet/YurtAppDaemon will work to enable the privileged

How to reproduce it (as minimally and precisely as possible):

Anything else we need to know?:

Environment:

others

/kind bug

rambohe-ch commented 1 year ago

@kadisi PTAL