Uploaded image for project: 'OpenShift API Server'
  1. OpenShift API Server
  2. API-1527

scc validation is failing due to seccomp profile configuration at the deployment

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Undefined Undefined
    • None
    • openshift-4.10.z, openshift-4.8.z
    • api
    • None
    • False
    • None
    • False

      Deployment that specify seccomp profile at security context level is not able to identify the correct scc, even if it's created.
      Steps to reproduce issue:

      • create a scc with the required capabilities
      • create the sa
      • role binding the sa with the scc
      • create the deployment

      Required Security Capabilities are:
      ~~~
      serviceAccountName: hellosa
      securityContext:
      allowPrivilegeEscalation: false
      capabilities:
      drop:

      • ALL
        privileged: false
        readOnlyRootFilesystem: false
        runAsNonRoot: true
        seccompProfile:
        type: RuntimeDefault
        ~~~

      Current Behavior:
      Error event reported
      ~~~
      Error creating: pods "hello-6967cf9864-h4kc8" is forbidden: unable to validate against any security context constraint: [pod.metadata.annotations.seccomp.security.alpha.kubernetes.io/pod: *Forbidden: seccomp may not be set pod.metadata.annotations.container.seccomp.security.alpha.kubernetes.io/ubi-minimal*: Forbidden: seccomp may not be set provider "anyuid": Forbidden: not usable by user or serviceaccount pod.metadata.annotations.seccomp.security.alpha.kubernetes.io/pod: Forbidden: seccomp may not be set pod.metadata.annotations.container.seccomp.security.alpha.kubernetes.io/ubi-minimal: Forbidden: seccomp may not be set provider "nonroot": Forbidden: not usable by user or serviceaccount provider "hostmount-anyuid": Forbidden: not usable by user or serviceaccount provider "machine-api-termination-handler": Forbidden: not usable by user or serviceaccount provider "hostnetwork": Forbidden: not usable by user or serviceaccount provider "hostaccess": Forbidden: not usable by user or serviceaccount provider "node-exporter": Forbidden: not usable by user or serviceaccount provider "privileged": Forbidden: not usable by user or serviceaccount]
      ~~~

      Expectation:
      Customer expect not event errors when deployment is created with the required seccomp profile at security context configuration.

      Environment:
      OCP 4.8, OCP 4.10

            Unassigned Unassigned
            rhn-support-pescorza Pamela Lizeth Escorza Gil
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: