-
Bug
-
Resolution: Done
-
Blocker
-
3.3.0.GA
-
None
-
False
-
None
-
False
-
Release Notes
-
-
Bug Fix
-
Done
-
-
Description of problem:
The 'container-build` scc found on dev-sandbox clusters (sandbox, sandbox-m2 and sandbox-m3) is causing OLM catalogSource pods to crash.
This is because OLM catalogSource pods are expected to run with `anyuid` scc. 'anyuid' scc has a priority of '10'. As 'container-build' scc supplied dev-space operator gets applied to OLM catalogSource pods as this scc has an explicitly set priority of 20.
This is problematic as pods like OLM catalogSources and pods from other products are deployed expecting to run with anyuid scc.
Steps to Reproduce
- login to a cluster with `container-build` scc from dev-space operator
- create a catalogSource (specifically old ones, which needs to run in 'legacy' mode)
- the catalogSource Pods will crash as the pods will be running with a userid without necessary privileges to access the catalogsource db inside
Actual results:
- 'container-build` scc gets applied to pods as this scc has higher priority
Expected results:
- -catalogSource pods should get anyuid scc by default
- if possible set priority of `container-build` to a value less than anyuid priority
- if possible use some other explicit measure to associate pods with 'contiainer-build' sc
Reproducibility (Always/Intermittent/Only Once):
Always
Additional info (Such as Logs, Screenshots, etc):
- sample anyuid scc (present on cluster by default):anyuid.yaml
- container-build scc(present on sandbox clusters: container-build.yaml
- Cluster version: 4.12
- slack threads:
- ira issues