Uploaded image for project: 'OpenShift GitOps'
  1. OpenShift GitOps
  2. GITOPS-7461

Redis container fails with "runAsNonRoot and image will run as root" after upgrade to argocd-operator 0.14.1

XMLWordPrintable

    • GitOps Crimson Sprint 20, GitOps Crimson Sprint 21

      After upgrading argocd-operator from version 0.13.1 to 0.14.1, the argocd-redis pod fails to start with the following error:
      state:
      waiting:
      message: 'container has runAsNonRoot and image will run as root (pod: "argocd-redis-64656fd77c-5b58n_argocd(4433a4b7-dc74-4ab6-b270-5f47ce031643)", container: redis)'
      reason: CreateContainerConfigError

       
      Environment:

      • ArgoCD Operator version: 0.14.1 (previously 0.13.1)
      • Kubernetes version: v1.32.4-gke.1698000
      • Redis image: redis@sha256:8061ca607db2a0c80010aeb5fc9bed0253448bc68711eaa14253a392f6c48280

      Root Cause:
      The security context configuration changed between versions. The working configuration (v0.13.1) included:
      securityContext: allowPrivilegeEscalation: falsecapabilities: drop:

      • ALLrunAsNonRoot: truerunAsUser: 999 # This line is missing in v0.14.1seccompProfile: type: RuntimeDefault
         
        The new configuration (v0.14.1) is missing the runAsUser: 999 field:
        securityContext: allowPrivilegeEscalation: falsecapabilities: drop:
      • ALLrunAsNonRoot: true # Without runAsUser, defaults to root (UID 0)seccompProfile: type: RuntimeDefault
         
        Expected Behavior:
        The Redis container should start successfully with the same security context as the previous version.

      Actual Behavior:
      The container fails to start because runAsNonRoot: true is specified but no runAsUser is set, causing the container to attempt running as root (UID 0), which violates the runAsNonRoot constraint.

              rh-ee-ansingh Anand Singh
              rh-ee-ansingh Anand Singh
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved: