pulp / pulp-operator

Kubernetes Operator for Pulp 3. Under active development.
https://docs.pulpproject.org/pulp_operator/
GNU General Public License v2.0
67 stars 50 forks source link

pods "ocp-example-database-0" is forbidden: unable to validate against any security context constraint #1319

Closed git-hyagi closed 3 months ago

git-hyagi commented 3 months ago

Version https://github.com/pulp/pulp-operator/commit/03b7d6914e807007cb46f6bacc23e648bf043ba1

Describe the bug

Database pods failing to be deployed in OCP:

 4m36s       Warning   FailedCreate          statefulset/ocp-example-database                                      create Pod ocp-example-database-0 in StatefulSet ocp-example-database failed error: pods "ocp-example-database-0" is forbidden: unable to validate against any security context constraint: [provider "anyuid": Forbidden: not usable by user or serviceaccount, provider restricted-v2: .spec.securityContext.fsGroup: Invalid value: []int64{999}: 999 is not an allowed group, provider restricted-v2: .containers[0].runAsUser: Invalid value: 999: must be in the ranges: [1000680000, 1000689999], provider "restricted": Forbidden: not usable by user or serviceaccount, provider "nonroot-v2": Forbidden: not usable by user or serviceaccount, provider "nonroot": Forbidden: not usable by user or serviceaccount, provider "hostmount-anyuid": Forbidden: not usable by user or serviceaccount, provider "machine-api-termination-handler": Forbidden: not usable by user or serviceaccount, provider "hostnetwork-v2": Forbidden: not usable by user or serviceaccount, provider "hostnetwork": Forbidden: not usable by user or serviceaccount, provider "hostaccess": Forbidden: not usable by user or serviceaccount, provider "node-exporter": Forbidden: not usable by user or serviceaccount, provider "privileged": Forbidden: not usable by user or serviceaccount] 

To Reproduce Steps to reproduce the behavior: Deploy the operator with commit 03b7d69 in OCP (without providing an external database).

Additional context This error happens only in OCP environments because of OCP SCC.

https://prow.ci.openshift.org/view/gs/test-platform-results/logs/periodic-ci-pulp-pulp-operator-main-deploy-pulp-on-openshift/1820309083530465280