Open istvanszoke opened 6 years ago
I can remember I had the same issue and started using:
args: ["--copy-service"]
Thanks for the reply! Unfortunately it didn't solve my issue :(
This privileged: true
parameter is very important.
Hello everyone, I have exactly the same problem on Openshift Origin (with Kubernetes under the hood), I have the feeling that it's related to security measure about "root" execution in container.
I'll look into it shortly :)
I did tested a little, and yes, in my case, it was clearly related to the root restricted use in Openshift (and maybe could the same for OP in Kubernetes).
FYI, here is the command line (for Openshift) to execute to solve this problem (by allowing root execution in container for the specified project name) :
oc adm policy add-scc-to-user anyuid -z default -n <yourprojectname>
Need to find how to do it for Kubernetes, but it's cleary related to Security-Context concept...
But keep in mind that, sanitizing directly the container to avoid root call is way better. Cheers
I have same issue in a pure k8s cluster, not only OpenShift. I guess is related to a change in k8s behavior due to a security issue: https://github.com/coreos/bugs/issues/2384
I think this is an issue that must be solved in the ldap container.
I'm running into the same issues as @istvanszoke, with the official Helm chart on Kubernetes 1.9.7-gke.3 with Security policy's enabled.
Is there any work around to get this up and running?
Getting the same error here. Does anyone solve this matter?
I am running into the same error, trying to run in OCP. Does anyone have a fix for this? I have tried the --copy-service
option and it did not work.
Hi, OKD 3.11. I could workaround with:
oc adm policy add-scc-to-user anyuid -z default -n
But I also had to edit the openldap deployment and use emptyDir for the volume "ldap-certs" instead of hostPath
Hello, I have exactly the same issue on a k8s cluster, did someone manage to make it work ?
I encounter similar issue today. However, my k8s cluster is created by kind, and I found the root cause is related to apparmor, and can be solved by disable apparmor profile on host machine. Details: https://github.com/kubernetes-sigs/kind/issues/1224
I encounter similar issue today. However, my k8s cluster is created by kind, and I found the root cause is related to apparmor, and can be solved by disable apparmor profile on host machine. Details: kubernetes-sigs/kind#1224
hello, disabling security features such as apparmor or selinux is really bad on mutualized kubernetes clusters as it break container isolation.
could be solved if someone create a PR for #398
Apart of this: https://github.com/osixia/docker-openldap/issues/184#issuecomment-542429421
I have faced also this issue if using NFS for the Persistent Volumes and depending on the /etc/exports of the NFS Server. I could make it work exposing the NFS file system as:
/mnt/mcm-openldap 10.10.0.0/24(rw,sync,no_root_squash)
Hello,
I am trying to deploy to Kubernetes 1.8 with persistent volumes with the following yaml:
I am getting these errors:
If I don't specify the security context I get different errors
This yaml worked with Kubernetes 1.7 but now it doesn't with 1.8. I don't understand how I get permission denied on /container/run since it is not nfs.
Any comment on the issue would really help!
Thanks!