[WIP] OCPBUGS-64663 runAsUser/runAsGroup not behaving to the expected range values in user namespaces #2511
Conversation
openshift-ci-robot
added
the
backports/unvalidated-commits
openshift-ci
bot
added
do-not-merge/hold
|
@ropatil010: the contents of this pull request could not be automatically validated. The following commits could not be validated and must be approved by a top-level approver:
Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: ropatil010 The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci-robot
added
backports/validated-commits
|
@ropatil010: the contents of this pull request could be automatically validated. The following commits are valid:
Comment |
openshift-ci
bot
removed
the
do-not-merge/work-in-progress
|
/unhold |
openshift-ci
bot
removed
the
do-not-merge/hold
|
This is just a partial fix for max range, we can add RFE for runAsGroup when we enter the value: 999(min value). |
openshift-ci-robot
added
backports/unvalidated-commits
|
@ropatil010: the contents of this pull request could not be automatically validated. The following commits are valid:
The following commits could not be validated and must be approved by a top-level approver:
Comment |
openshift-ci-robot
added
backports/validated-commits
|
@ropatil010: the contents of this pull request could be automatically validated. The following commits are valid:
Comment |
|
/test-with openshift/apiserver-library-go#154 |
|
@ropatil010: the contents of this pull request could be automatically validated. The following commits are valid:
Comment |
…, and supplementalGroups
|
@ropatil010: the contents of this pull request could be automatically validated. The following commits are valid:
Comment |
|
/retitle OCPBUGS-64663 runAsUser/runAsGroup not behaving to the expected range values in user namespaces |
openshift-ci
bot
changed the title
|
Execution result: When try to create deployment with invalid user/group(after 64534+) id, it gives error that it must be in the ranges: [1000, 65534] |
|
Just for reference: https://issues.redhat.com/browse/CNTRLPLANE-1909 |
openshift-ci-robot
added
backports/unvalidated-commits
|
@ropatil010: the contents of this pull request could not be automatically validated. The following commits are valid:
The following commits could not be validated and must be approved by a top-level approver:
Comment |
|
/hold |
openshift-ci
bot
added
the
do-not-merge/hold
ropatil010
changed the title
openshift-ci
bot
added
vendor-update
…, and supplementalGroups2
openshift-ci-robot
added
backports/validated-commits
|
@ropatil010: the contents of this pull request could be automatically validated. The following commits are valid:
Comment |
openshift-ci-robot
added
backports/unvalidated-commits
|
@ropatil010: the contents of this pull request could not be automatically validated. The following commits are valid:
The following commits could not be validated and must be approved by a top-level approver:
Comment |
|
@ropatil010: the contents of this pull request could not be automatically validated. The following commits are valid:
The following commits could not be validated and must be approved by a top-level approver:
Comment |
|
@ropatil010: The following tests failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
Hi Team,
Can you PTAL for this PR.
Without this PR: There is no proper message to user why the deployment is not in ready state.
https://issues.redhat.com/browse/OCPBUGS-64663
Try to create deployment with value runAsGroup: 65536
oc get deploy -n testropatil
NAME READY UP-TO-DATE AVAILABLE AGE
deployment-invalid-group-test-65536 0/1 1 0 57m
Check output message:
oc get deploy/deployment-invalid-group-test-65536 -n testropatil -o yaml
hostUsers: false
restartPolicy: Always
schedulerName: default-scheduler
securityContext:
fsGroup: 1000
runAsGroup: 65536
runAsNonRoot: true
runAsUser: 1000
seccompProfile:
type: RuntimeDefault
terminationGracePeriodSeconds: 30
status:
conditions:
lastUpdateTime: "2025-11-05T05:50:19Z"
message: Deployment does not have minimum availability.
reason: MinimumReplicasUnavailable
status: "False"
type: Available
lastUpdateTime: "2025-11-05T05:50:19Z"
message: ReplicaSet "deployment-invalid-group-test-65536-75474b4bdf" is progressing.
reason: ReplicaSetUpdated
status: "True"
type: Progressing
observedGeneration: 1
replicas: 1
unavailableReplicas: 1
updatedReplicas: 1
With PR:
When try to create deployment with invalid max value: 65536 it wont creates the deployment and gives below info/message
oc create -f deployment-invalid-group-test-65536.yaml
Will get message info as:
The Deployment "deployment-invalid-group-test-65536" is invalid: spec.template.spec.securityContext.runAsGroup: Invalid value: 65536: must be between 0 and 65535 when user namespaces are enabled (hostUsers=false)
/hold