Uploaded image for project: 'OpenShift Virtualization'
  1. OpenShift Virtualization
  2. CNV-30192

[2216774] [RFE] HCO should remove option to run VMs as root

XMLWordPrintable

    • CNV I/U Operators Sprint 238, CNV I/U Operators Sprint 239
    • Medium
    • No

      Description of problem:
      when creating VM after setting root:True in HCO CR , it stucks in starting state with following message:

      [akriti@fedora ~]$ oc describe vm vm3-rhel84-ocs | grep Message

      Message: virt-launcher pod has not yet been scheduled
      Message: failed to create pod for vmi default/vm3-rhel84-ocs, it needs a privileged namespace to run: pods "virt-launcher-vm3-rhel84-ocs-tfr7d" is forbidden: violates PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "compute" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "compute" must set securityContext.capabilities.drop=["ALL"]; container "compute" must not include "SYS_NICE" in securityContext.capabilities.add), runAsNonRoot != true (container "compute" must not set securityContext.runAsNonRoot=false), runAsUser=0 (pod and container "compute" must not set runAsUser=0)

      Version-Release number of selected component (if applicable):

      How reproducible:

      Steps to Reproduce:
      1. set root: true in HCO
      2. create a vm
      3. start the VM

      Actual results:
      VM fails to be running

      Expected results:
      VM is running with virt-launcher pod running as Root

      Additional info:

            stirabos Simone Tiraboschi
            akrgupta@redhat.com Akriti gupta
            Debarati Basu-Nag Debarati Basu-Nag
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: