-
Bug
-
Resolution: Done
-
Normal
-
None
-
3
-
False
-
-
False
-
-
-
GitOps Crimson Sprint 20, GitOps Crimson Sprint 21
After upgrading argocd-operator from version 0.13.1 to 0.14.1, the argocd-redis pod fails to start with the following error:
state:
waiting:
message: 'container has runAsNonRoot and image will run as root (pod: "argocd-redis-64656fd77c-5b58n_argocd(4433a4b7-dc74-4ab6-b270-5f47ce031643)", container: redis)'
reason: CreateContainerConfigError
Environment:
- ArgoCD Operator version: 0.14.1 (previously 0.13.1)
- Kubernetes version: v1.32.4-gke.1698000
- Redis image: redis@sha256:8061ca607db2a0c80010aeb5fc9bed0253448bc68711eaa14253a392f6c48280
Root Cause:
The security context configuration changed between versions. The working configuration (v0.13.1) included:
securityContext: allowPrivilegeEscalation: falsecapabilities: drop:
- ALLrunAsNonRoot: truerunAsUser: 999 # This line is missing in v0.14.1seccompProfile: type: RuntimeDefault
The new configuration (v0.14.1) is missing the runAsUser: 999 field:
securityContext: allowPrivilegeEscalation: falsecapabilities: drop: - ALLrunAsNonRoot: true # Without runAsUser, defaults to root (UID 0)seccompProfile: type: RuntimeDefault
Expected Behavior:
The Redis container should start successfully with the same security context as the previous version.
Actual Behavior:
The container fails to start because runAsNonRoot: true is specified but no runAsUser is set, causing the container to attempt running as root (UID 0), which violates the runAsNonRoot constraint.