Closed razvan closed 1 year ago
Stumbled upon a blocker when running kuttl
tests against the Spark-K8S operators deployed with olm
. The Spark pods are not allowed to mount ephemeral
volumes. These are needed for Secrets mounted by the secret-operator.
This problem doesn't arise when the operator is deployed as Helm chart because there we can specify a custom scc
.
Links:
@razvan The HBase checkbox is ticked above but I believe you mentioned today that it needs more work? If so: Do we already have a follow-up ticket for HBase?
This is marked as an epic - part of the refinement should be to decide whether this should be / needs to be split into multiple parts to be worked on separately.
Closing this now as current work is covered by https://github.com/stackabletech/issues/issues/376
Description
On OpenShift, product Pods must run with custom
ServiceAccount
(s) andSecurityContextConstraints
.Different Stackable products have different requirements with respect to the container permissions and capabilities.
The primary goal of this issue is to update all Stackable operators so that the products they manage run with custom
ServiceAccount
.The zookeeper-operator provides an example implementation where the operator's Helm chart creates a ClusterRole that references a custom SCC object. The operator creates a ServiceAccount and a ClusterRoleBinding per namespace for each Zookeeper instance.
Acceptance criteria
Tasks per operator
Part of getting the operators running on OpenShift at least the following tasks need to be performed per operator.
podSecurityContext
warnings that pop up during Helm installations.Operators