runAsNonRoot: true doesn't work if your container image uses a non-numeric UID.

[danderson]

Is this a bug report or a feature request?:

Bug

What happened:

I embarrassingly discovered that metallb 0.2.0 is broken. The manifests as configured cannot start either controller or bgp-speaker, because they require runAsNonRoot, and apparently k8s cannot verify that "nobody" is non-root because it's not a numeric UID.

What you expected to happen:

MetalLB 0.2.0 should work :(

How to reproduce it (as minimally and precisely as possible):

Try to apply the MetalLB manifests from the website.

[danderson]

Fixed in 0.2.1. Master is probably still broken, but master is completely broken right now anyway because of the chaos from the speaker merge. There's #53 open to track the re-hardening of all containers post-merge.

[miekg]

This is also why I removed all that when I added the other Docker files. Didn't file a bug at the time :(

…

On 16 Dec 2017 20:36, "Dave Anderson" ***@***.***> wrote: *Is this a bug report or a feature request?*: Bug *What happened*: I embarrassingly discovered that metallb 0.2.0 is broken. The manifests as configured cannot start either controller or bgp-speaker, because they require runAsNonRoot, and apparently k8s cannot verify that "nobody" is non-root because it's not a numeric UID. *What you expected to happen*: MetalLB 0.2.0 should work :( *How to reproduce it (as minimally and precisely as possible)*: Try to apply the MetalLB manifests from the website. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#85>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAVkWycuX8GlRq2VekXtzxV_Sc58wFRaks5tBCndgaJpZM4REc1V> .