Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

"operator must set securityContext.seccompProfile.type" warning is shown on ocp + rhel worker node setup #1051

Open
saurabhwani5 opened this issue Oct 27, 2023 · 0 comments
Open

"operator must set securityContext.seccompProfile.type" warning is shown on ocp + rhel worker node setup #1051

saurabhwani5 opened this issue Oct 27, 2023 · 0 comments
Assignees
@badri-pathak
Labels
Customer Impact: Minor (1) misleading msgs, operational oddities not affecting workload. Failure of non critical services Customer Probability: High (5) Issue occurs in normal main path, IO load within expected norms, no failure triggers or oddities Found In: 2.10.0 Severity: 3 Indicates the the issue is on the priority list for next milestone. Type: Bug Indicates issue is an undesired behavior, usually caused by code error.

Comments

@saurabhwani5
Copy link
Member

saurabhwani5 commented Oct 27, 2023 •
edited

Describe the bug

When CSI operator.yaml is applied on ocp + rhel worker nodes warning is shown as: Warning: would violate PodSecurity "restricted:v1.24": seccompProfile (pod or container "operator" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

How to Reproduce?

  1. Install CSI 2.10.0 dev on ocp+ rhel env
[OCP+rhel latest]# oc apply -f ibm-spectrum-scale-csi-operator-ocp-rhel.yaml
Warning: would violate PodSecurity "restricted:v1.24": seccompProfile (pod or container "operator" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")
deployment.apps/ibm-spectrum-scale-csi-operator created
clusterrole.rbac.authorization.k8s.io/ibm-spectrum-scale-csi-operator created
clusterrolebinding.rbac.authorization.k8s.io/ibm-spectrum-scale-csi-operator created
serviceaccount/ibm-spectrum-scale-csi-operator created
customresourcedefinition.apiextensions.k8s.io/csiscaleoperators.csi.ibm.com created
securitycontextconstraints.security.openshift.io/spectrum-scale-csiaccess created

[OCP+rhel latest]# oc apply -f ~/csiscaleoperators.csi.ibm.com_cr.yaml
csiscaleoperator.csi.ibm.com/ibm-spectrum-scale-csi created
[OCP+rhel latest]#
[OCP+rhel latest]# oc get pods
NAME                                                  READY   STATUS    RESTARTS   AGE
ibm-spectrum-scale-csi-6s28b                          3/3     Running   0          17m
ibm-spectrum-scale-csi-attacher-6ffd46f894-q6m8p      1/1     Running   0          17m
ibm-spectrum-scale-csi-attacher-6ffd46f894-zzwdz      1/1     Running   0          17m
ibm-spectrum-scale-csi-gblph                          3/3     Running   0          17m
ibm-spectrum-scale-csi-operator-75c6775498-spx28      1/1     Running   0          18m
ibm-spectrum-scale-csi-provisioner-89bf76648-wcvf2    1/1     Running   0          17m
ibm-spectrum-scale-csi-r4dt6                          3/3     Running   0          17m
ibm-spectrum-scale-csi-resizer-76dbb644b6-2q7xc       1/1     Running   0          17m
ibm-spectrum-scale-csi-snapshotter-797c96c5f9-vtnpb   1/1     Running   0          17m

[OCP+rhel latest]# oc describe scc spectrum-scale-csiaccess
Name:						spectrum-scale-csiaccess
Priority:					<none>
Access:
  Users:					system:serviceaccount:ibm-spectrum-scale-csi-driver:ibm-spectrum-scale-csi-attacher,system:serviceaccount:ibm-spectrum-scale-csi-driver:ibm-spectrum-scale-csi-provisioner,system:serviceaccount:ibm-spectrum-scale-csi-driver:ibm-spectrum-scale-csi-node,system:serviceaccount:ibm-spectrum-scale-csi-driver:ibm-spectrum-scale-csi-snapshotter,system:serviceaccount:ibm-spectrum-scale-csi-driver:ibm-spectrum-scale-csi-resizer
  Groups:					<none>
Settings:
  Allow Privileged:				true
  Allow Privilege Escalation:			true
  Default Add Capabilities:			<none>
  Required Drop Capabilities:			KILL,MKNOD,SETUID,SETGID
  Allowed Capabilities:				<none>
  Allowed Seccomp Profiles:			<none>
  Allowed Volume Types:				configMap,downwardAPI,emptyDir,hostPath,persistentVolumeClaim,projected,secret
  Allowed Flexvolumes:				<all>
  Allowed Unsafe Sysctls:			<none>
  Forbidden Sysctls:				<none>
  Allow Host Network:				true
  Allow Host Ports:				false
  Allow Host PID:				false
  Allow Host IPC:				false
  Read Only Root Filesystem:			false
  Run As User Strategy: RunAsAny
    UID:					<none>
    UID Range Min:				<none>
    UID Range Max:				<none>
  SELinux Context Strategy: RunAsAny
    User:					<none>
    Role:					<none>
    Type:					<none>
    Level:					<none>
  FSGroup Strategy: MustRunAs
    Ranges:					<none>
  Supplemental Groups Strategy: RunAsAny
    Ranges:					<none>

Env:

[OCP+rhel latest]# oc get nodes -owide
NAME                   STATUS   ROLES                  AGE   VERSION           INTERNAL-IP   EXTERNAL-IP   OS-IMAGE                                                       KERNEL-VERSION                 CONTAINER-RUNTIME
master0.ocp2.vmlocal   Ready    control-plane,master   37d   v1.26.3+b404935   172.16.2.10   <none>        Red Hat Enterprise Linux CoreOS 413.92.202305041429-0 (Plow)   5.14.0-284.13.1.el9_2.x86_64   cri-o://1.26.3-3.rhaos4.13.git641290e.el9
master1.ocp2.vmlocal   Ready    control-plane,master   37d   v1.26.3+b404935   172.16.2.11   <none>        Red Hat Enterprise Linux CoreOS 413.92.202305041429-0 (Plow)   5.14.0-284.13.1.el9_2.x86_64   cri-o://1.26.3-3.rhaos4.13.git641290e.el9
master2.ocp2.vmlocal   Ready    control-plane,master   37d   v1.26.3+b404935   172.16.2.12   <none>        Red Hat Enterprise Linux CoreOS 413.92.202305041429-0 (Plow)   5.14.0-284.13.1.el9_2.x86_64   cri-o://1.26.3-3.rhaos4.13.git641290e.el9
worker0.ocp2.vmlocal   Ready    worker                 37d   v1.26.3+b404935   172.16.2.20   <none>        Red Hat Enterprise Linux CoreOS 413.92.202305041429-0 (Plow)   5.14.0-284.13.1.el9_2.x86_64   cri-o://1.26.3-3.rhaos4.13.git641290e.el9
worker1.ocp2.vmlocal   Ready    worker                 37d   v1.26.3+b404935   172.16.2.21   <none>        Red Hat Enterprise Linux CoreOS 413.92.202305041429-0 (Plow)   5.14.0-284.13.1.el9_2.x86_64   cri-o://1.26.3-3.rhaos4.13.git641290e.el9
worker2.ocp2.vmlocal   Ready    worker                 36d   v1.26.7+0ef5eae   172.16.2.22   <none>        Red Hat Enterprise Linux 8.8 (Ootpa)                           4.18.0-477.21.1.el8_8.x86_64   cri-o://1.26.4-3.rhaos4.13.git615a02c.el8
worker3.ocp2.vmlocal   Ready    worker                 36d   v1.26.7+0ef5eae   172.16.2.23   <none>        Red Hat Enterprise Linux 8.8 (Ootpa)                           4.18.0-477.21.1.el8_8.x86_64   cri-o://1.26.4-3.rhaos4.13.git615a02c.el8
worker4.ocp2.vmlocal   Ready    worker                 36d   v1.26.7+0ef5eae   172.16.2.24   <none>        Red Hat Enterprise Linux 8.8 (Ootpa)                           4.18.0-477.21.1.el8_8.x86_64   cri-o://1.26.4-3.rhaos4.13.git615a02c.el8

Expected behavior :

Warning message shouln't be shown

Data Collection and Debugging

CSI snap:
/scale-csi/D.1051
@saurabhwani5 saurabhwani5 added Severity: 3 Indicates the the issue is on the priority list for next milestone. Type: Bug Indicates issue is an undesired behavior, usually caused by code error. Customer Probability: High (5) Issue occurs in normal main path, IO load within expected norms, no failure triggers or oddities Customer Impact: Minor (1) misleading msgs, operational oddities not affecting workload. Failure of non critical services Found In: 2.10.0 labels Oct 27, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@badri-pathak badri-pathak

Labels
Customer Impact: Minor (1) misleading msgs, operational oddities not affecting workload. Failure of non critical services Customer Probability: High (5) Issue occurs in normal main path, IO load within expected norms, no failure triggers or oddities Found In: 2.10.0 Severity: 3 Indicates the the issue is on the priority list for next milestone. Type: Bug Indicates issue is an undesired behavior, usually caused by code error.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@saurabhwani5 @badri-pathak